SCIM Provisioning with Azure

This article describes the steps to configure automatic user provisioning with Azure AD.

If your organization uses Azure to manage your employees' access to third-party services, you can take advantage of its provisioning feature to grant access to B12 to your users.

To learn more about how SCIM works with Azure, please refer to Microsoft's official documentation.

• https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning
• https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-works

Before proceeding, make sure you have:

• A B12 organization
• An Azure AD tenant
• A user account in Azure AD authorized to configure provisioning

Obtain an Access Token

Contact us specifying the B12 organization in which you want to synchronize users. We will then send you a secret token allowing access to the B12 SCIM API.

Create an Enterprise Application

1. Sign in to the Azure portal.
2. Go to "Enterprise applications"
3. Click "New application"
4. "Create your own application"
5. Name the application "B12 SCIM"
6. Select "Integrate any other application you don't find in the gallery (non-gallery)"
7. Click "Create"

Configure B12 Roles

In order to assign B12 roles to your users from Azure, it is necessary to declare the possible roles in the application's manifest.

1. Sign in to the Azure portal.
2. Go to "App registrations"
3. Click on "All applications"
4. Click on "B12 SCIM"
5. Go to "App roles"
6. Disable all existing roles
7. Go to "Manifest"
8. Edit the "appRoles" property to the following value:

  "appRoles":[
    {
      "allowedMemberTypes":["User"],
      "description":"Administrator",
      "displayName":"Administrator",
      "id":"4ecb2cd9-35be-4a52-8c6c-66765724713d",
      "isEnabled":true,
      "value":"ADMIN"
    },
    {
      "allowedMemberTypes":["User"],
      "description":"Designer",
      "displayName":"Designer",
      "id":"2c9f9dfc-c89c-4938-99ad-2fd3af53f127",
      "isEnabled":true,
      "value":"DESIGNER"
    },
    {
      "allowedMemberTypes":["User"],
      "description":"Trainer",
      "displayName":"Trainer",
      "id":"1d00e10d-fa3e-45f7-9857-357272e6f354",
      "isEnabled":true,
      "value":"TRAINER"
    },
    {
      "allowedMemberTypes":["User"],
      "description":"Manager",
      "displayName":"Manager",
      "id":"a0e41188-e8c9-479f-a458-52eeb55d0d12",
      "isEnabled":true,
      "value":"MANAGER"
    },
    {
      "allowedMemberTypes":["User"],
      "description":"Learner",
      "displayName":"Learner",
      "id":"05a44502-b6fc-476a-b27d-4bb89bb90333",
      "isEnabled":true,
      "value":"LEARNER"
    }
  ],
 

• https://learn.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles#roles-using-
• https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest#approles-attribute 

Configure Provisioning

1. Sign in to the Azure portal.
2. Go to "Enterprise applications"
3. Click on "B12 SCIM"
4. Go to "Provisioning"
5. Click "Start"
6. Select provisioning mode: Automatic
7. Enter the following tenant URL: https://b12.apprentx.rocks/api/scim/v2
8. Enter the secret token provided by our team
9. Click "Test Connection"
10. Press "Save"

Create and Map the Roles Attribute

To manage your B12 users' roles from Azure, you need to configure the "roles" attribute. To do this:

1. Sign in to the Azure portal.
2. Go to "Enterprise applications"
3. Click on "B12 SCIM"
4. Go to "Provisioning"
5. Click "Edit provisioning"
6. Click "Mappings"
7. Click "Provision Azure Active Directory Users"
8. Click "Show advanced options"
9. Click "Edit attribute list for customappsso"
10. At the bottom of the list, add an attribute:
    • Name: roles
    • Type: String
    • Multiple values: Yes
11. Click "Save"
12. Add a new User mapping
    • Mapping type: Expression
    • Expression: AppRoleAssignmentsComplex([appRoleAssignments])
    • Target attribute: roles
13. Save

Create and Map Custom Attributes

If your B12 organization contains custom fields for users (such as employee number, title, etc.), you can provision them automatically by following these steps:

1. Sign in to B12 as an administrator
2. Click your profile picture at the top right
3. Click "Settings"
4. Click "Custom fields"
5. On the custom field, click "Edit"
6. Copy the value of the "SCIM Attribute" field
7. Sign in to the Azure portal.
8. Go to "Enterprise applications"
9. Click on "B12 SCIM"
10. Go to "Provisioning"
11. Click "Edit provisioning"
12. Click "Mappings"
13. Click "Provision Azure Active Directory Users"
14. Click "Show advanced options"
15. Click "Edit attribute list for customappsso"
16. At the bottom of the list, add an attribute:
    • Name: The value copied in step 6 (similar to: urn:ietf:params:scim:schemas:extension:customb12:2.0:User:[ATTRIBUTE_ID])
    • Type: String
17. Click "Save"
18. Add a new User mapping
    • Mapping type: Direct
    • Source attribute: The attribute of your choice
    • Target attribute: urn:ietf:params:scim:schemas:extension:customb12:2.0:User:[ATTRIBUTE_ID])
19. Save

Note that B12 only supports custom attributes of type String.

Assign Users and Groups

Choose and assign the users and groups you want to provision in your B12 organization. To do this:

1. Sign in to the Azure portal.
2. Go to "Enterprise applications"
3. Click on "B12 SCIM"
4. Go to "Users and groups"
5. Click "Add user/group"
6. Select a user
7. Select a B12 role
8. Apply by clicking "Assign"

Start Provisioning

Once SCIM is configured, all that remains is to start provisioning:

1. Sign in to the Azure portal.
2. Go to "Enterprise applications"
3. Click on "B12 SCIM"
4. Go to "Provisioning"
5. Click "Start provisioning"

Note that Azure provisioning runs every 40 minutes. It is therefore normal that users are not immediately synchronized to B12: https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users