> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # SCIM Directory Integration with Microsoft Entra ID > Configure SCIM directory integration between Microsoft Entra ID and Iru Endpoint. Automatically provision and deprovision users and groups via SCIM. ### About SCIM Directory Integration with Microsoft Entra ID SCIM Directory Integration with Microsoft Entra ID in Iru Endpoint allows you to set up SCIM-based user directory synchronization between Microsoft Entra ID and Iru Endpoint, enabling automatic user and group provisioning and deprovisioning. ### How It Works The SCIM integration creates a secure connection between Microsoft Entra ID and Iru Endpoint, enabling automatic synchronization of user and group data. When users or groups are added, modified, or removed in Microsoft Entra ID, these changes are automatically reflected in Iru Endpoint through the SCIM protocol. ### Prerequisites * Be sure to review the supported user and group attributes listed in the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration#scim-schema-and-supported-attributes) article. * Ensure that nested groups are not included with SCIM as Microsoft does not support this functionality. ### Get the SCIM Token and API URL Complete these steps in Iru Endpoint first. You will need the SCIM access token and API URL when configuring Microsoft Entra ID. For full details, see the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration) article. In Iru Endpoint, in the sidebar, click the [**Account Menu Button**](/en/iru/platform-overview/account-menu), then select **Integrations**. Screenshot of the account menu with Integrations option highlighted Click **Discover integrations** in the upper-right of the Integrations page. On the **SCIM protocol** tile, click **Add and configure**. Add new integration page with SCIM protocol tile and Add and configure button Click **Get started**. Enter a unique name for the SCIM integration. Click **Generate token**. The SCIM integration uses an HTTP authorization header with a Bearer Token. Configure a SCIM user integration screen with name field and Generate token button Click **Copy token**. The token will not be visible again after you click Done. Store it securely, as you will need it in the **Microsoft Entra ID** tab. Confirm that you have copied the token by checking the box, then click **Done**. You will return to the **Integrations** page. Copy token and configure with your identity provider dialog with Copy token button Click the **ellipsis** on the SCIM directory integration you created. Select **View Details**. Directory integrations list with SCIM integration and ellipsis menu showing View details, Rename, Rotate token, Delete Copy the SCIM API URL (e.g. `https://subdomain.api.iru.com/api/v1/scim`). Your identity provider will require this. The URL displayed in your tenant may still show the `api.kandji.io` domain. The `api.kandji.io` version of the SCIM API URL will also work for this purpose. Click **Close**. View user integration details modal with SCIM API URL and copy button Keep the token and API URL available, then switch to the **Microsoft Entra ID** tab to create and configure the SCIM app integration. Complete the **Iru Endpoint** tab first to obtain the SCIM token and API URL. You will enter these in the steps below. ### Creating the SCIM Integration in Microsoft Entra ID Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). Open the portal menu and then select **Entra ID**. On the **Entra ID** menu, select **Enterprise apps**. Select **New application**. If you have already created a SAML single sign-on application, you can select that application and add SCIM. Microsoft Entra ID Enterprise applications All applications with New application button Select **Create your own application**. Microsoft Entra ID Browse gallery with Create your own application Give the application a name. Select **Integrate any other application you don't find in the gallery (Non-gallery)**. Click **Create**. Microsoft Entra ID Create your own application dialog with app name and Non-gallery option You will be taken to the Overview page for the newly created app. Under **Manage**, select **Provisioning**. Microsoft Entra ID Iru SCIM Overview with Provisioning in Manage Click **New Configuration**. Microsoft Entra ID Provisioning Get started with New configuration button In the **Select authentication method** dropdown, choose **Bearer authentication**. Microsoft Entra ID New provisioning configuration with Bearer authentication, Tenant URL, and Secret token Paste the SCIM API URL you copied from the **Iru Endpoint** tab into the **Tenant URL** field. Paste the token you obtained in the **Iru Endpoint** tab into the **Secret token** field. Click **Test connection**. You should see a successful test notification. Microsoft Entra ID Provisioning test connection success message Click **Create**. In the Manage section, click **Provisioning**. Microsoft Entra ID Provisioning configuration Overview Expand the **Mappings** reveal triangle and ensure that both Groups and Users are enabled. Expand the **Settings** reveal triangle. For **Scope**, choose **Sync only assigned users and groups**. Set the **Provisioning Status** to On. Click **Save**. Microsoft Entra ID Provisioning Mappings and Settings with Scope and Provisioning Status Click the **X** in the upper-right corner to close the settings. ### Assigning Users and Groups Under **Manage**, select **Users and groups**. On the menu, select **Add user/group**. On the **Add Assignment** dialog, select the link under **Users and groups**. A list of users and security groups is displayed. You can search for a specific user or group or select multiple users and groups that appear in the list. Select the user(s) and group(s) you would like to be assigned. Click **Select**. Select **Assign** to finish assigning users and groups to the app. Confirm that the users and groups you added appear in the **Users and groups** list. If you see a message indicating that a free tier is being used, it means you can only add users (not groups) to the SCIM Enterprise App. ### Considerations #### Syncing User syncing is one-way, meaning the Microsoft Entra ID SCIM app will send user information to Iru Endpoint only when new information is needed. If a user or group is added to the SCIM app in Microsoft Entra ID after the app was created, a sync will happen every 40 minutes (set by Microsoft Entra ID). If you want the sync to happen sooner, you can stop/start the provisioning in the SCIM app on the Microsoft Entra ID. This will not impact existing users/groups in Iru Endpoint. #### Removing Users * If Entra ID sets a user to inactive, the user will be set as inactive in your Iru Endpoint tenant. * If Entra ID deletes a user, the user will be deleted from your Iru Endpoint tenant. #### Blueprint Conditional Logic If you use [Assignment Map](/en/endpoint/blueprints/assignment-maps/using-conditional-logic-in-blueprints) conditional logic with groups, you must explicitly add each group you want to have provisioned in Iru Endpoint to the SCIM app. Groups will not sync automatically by adding users that happen to be members of the group. #### AD CS Strong Certificate Mapping If you use Microsoft Active Directory Certificate Services for certificate-based authentication, ensure your SCIM attribute mappings support strong certificate mapping requirements. For required mapping and certificate updates, see [Active Directory Strong Certificate Mapping Configuration](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-strong-mapping-configuration). #### Microsoft Device Compliance If you are using an Entra ID SCIM user directory integration and the Microsoft Device Compliance integration, ensure that the user and group attribute mappings for the **externalId** attribute in your SCIM application map to objectId as listed below. The **objectId** is used by Iru Endpoint to map user and group resources in Intune.
User Attribute User Value
externalId objectId
Group Attribute Group Value
externalId objectId
**Updating User Mappings and Group Mappings** Navigate to the SCIM enterprise application in the [Microsoft Entra admin center](https://entra.microsoft.com). Select **Provisioning**. Select the **Attribute mapping (Preview)** section. If you are updating user attributes, click on **Provision Microsoft Entra ID Users.** If you are updating group attributes, click on **Provision Microsoft Entra ID Groups**. Verify that externalId is mapped to objectId. If it is not, click the **Edit** button to the right of the attribute and select objectId from the list. Click **Save**. Click the **X** to go back. Once back on the Provisioning overview page, if any values were changed, you need to push the updated values to Iru Endpoint immediately by stopping and then starting the provisioning service. Click the **Pause provisioning** button. Click the **Start provisioning** button.