How to enable Azure AD for SCIM provisioning

You can automate the process of provisioning and deprovisioning your Azure Active Directory (AD) users and groups in Atlan with System for Cross-domain Identity Management (SCIM).

To enable Azure AD for SCIM provisioning, complete the following steps.

Prerequisites

• Azure AD SSO must be enabled for Atlan.
• Azure AD users or groups must be assigned to Atlan.
• Group mapping must be configured, only required if syncing mapped groups from Azure AD to Atlan. For any new groups created in Azure AD, you will first need to create corresponding groups in Atlan and then map the groups to sync them through SCIM provisioning.

Retrieve SCIM token in Atlan

 You will need to generate a SCIM token in Atlan for authentication in Azure AD.

To retrieve the SCIM token, within Atlan:

1. From the left menu on any screen, click Admin.
2. Under the Workspace heading, click SSO.
3. On the Single Sign on page for Azure AD, under Overview, navigate to Automate Provisioning with SCIM and toggle it on.
4. Under SCIM token, click the + Generate token button to create a SCIM token.
5. In the SCIM token generated dialog, click the Copy button to copy the SCIM token and store it in a secure location.

Enable SCIM provisioning in Azure AD

You can enable SCIM provisioning in Azure AD to automatically sync your users and groups to Atlan.

Configure SCIM provisioning in Azure AD

To configure SCIM provisioning, within Azure AD:

1. Log in to your Azure portal and search for and select Azure Active Directory.
2. From the left menu under Manage, select Enterprise applications.
3. From the All applications page, select the SAML application you created to configure SSO in Atlan.
4. In the left menu of your application page, under Manage, click Provisioning.
5. From the Provisioning mode dropdown, click Automatic.
6. Under Admin credentials, enter the following details:
   1. For Tenant URL, enter your Atlan tenant URL in the following format — https://<your-tenant-dns>/api/service/scim.
   2. For Secret Token, enter the SCIM token you copied in Atlan.
   3. Click the Test connection button to confirm connectivity to Atlan.
7. When successful, in the top right, click Save to save the configuration.
8. In the Mappings section, verify that Provision Azure Active Directory Groups and Provision Azure Active Directory Users are enabled. Under Mappings:
   
   1. Click Provision Azure Active Directory Groups, and under Attribute Mappings, define the following mappings from Azure AD on the left to Atlan on the right:
      • displayName —> displayName — Note that this field is currently unsupported in Atlan.
      • objectId —> externalId
      • members —> members
   2. Click Provision Azure Active Directory Users, and under Attribute Mappings, define the following mappings from Azure AD on the left to Atlan on the right:
      • mailNickname —> userName — If the username is not mapped, the default username will be the UserPrincipalName (UPN).
      • Switch([IsSoftDeleted], , "False", "True", "True", "False") —> active
      • displayName —> displayName
      • mail —> emails[type eq "work"].value
      • givenName —> name.givenName
      • surname —> name.familyName
      • objectId —> externalId
   3. To save any changes, click Save.

Provision users and groups

After you have enabled SCIM provisioning and assigned users and groups to Atlan in Azure AD, you can provision them to Atlan. In Azure AD, users and groups can be provisioned in two ways — provisioning cycle and on-demand provisioning.

Note the following:

• The username and email address of new and existing users cannot be changed once users have been provisioned to Atlan.
• If provisioning any users that already exist in Atlan, ensure that their Azure AD credentials match the existing credentials in Atlan for provisioning to be successful.

To provision users and groups, within Azure AD:

1. Log in to your Azure portal and search for and select Azure Active Directory.
2. From the left menu under Manage, select Enterprise applications.
3. From the All applications page, select the SAML application you created to configure SSO in Atlan.
4. In the left menu of your application page, under Manage, click Provisioning and select a provisioning method:
   
   • To enable provisioning cycle, in the upper left of the Overview page, click Start provisioning and toggle the Provisioning Status to On.
   • To enable on-demand provisioning, from the left menu, click Provision on demand. To provision users or groups on demand:
     • For Select a user or group, search for and select a user or group.
     • At the bottom of the screen, click Provision. Repeat the steps for every user or group you want to provision.

Once you have enabled SCIM provisioning, Azure AD will automatically provision and update user accounts in Atlan. However, the sync typically happens every 40 minutes. So, it may take up to 40 minutes for user provisioning to be completed in Atlan.