> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/administration/scim-and-sso/scim-with-microsoft-entra-id.md).

# SCIM with Microsoft Entra ID

Learn about configuring Couchdrop to sync with Azure for accounts

## Overview

Couchdrop supports SCIM provisioning with Microsoft Entra ID to keep users and groups synchronized between Microsoft Entra and Couchdrop.

Once configured, changes made in Microsoft Entra can be pushed to Couchdrop automatically.

### How provisioning works

Microsoft Entra remains the source for the users and groups assigned to the Enterprise Application.

When provisioning runs, supported user and group changes are pushed to Couchdrop through the SCIM endpoint:

`https://api.couchdrop.io/scim/v2`

This allows user creation, updates, deactivation, group creation, group updates, and group deactivation to be managed from Microsoft Entra rather than maintained separately in Couchdrop.

## Configure SCIM provisioning

{% hint style="warning" %}

### Before you start

To configure SCIM provisioning, you will need:

* Owner access to Couchdrop
* Access to configure an Enterprise Application in Microsoft Entra ID
  {% endhint %}

{% stepper %}
{% step %}

### Create a User Provisioning Token in Couchdrop

In Couchdrop, navigate to **User Provisioning** and create a new **Provisioning Token**.

Copy the token. You will use it when configuring provisioning in Microsoft Entra.
{% endstep %}

{% step %}

### Create an Enterprise Application

In the Microsoft Entra admin center, navigate to **Enterprise applications** > **New application** > **Create your own application**.

Enter a meaningful name for the application and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
{% endstep %}

{% step %}

### Assign users and groups

In the Enterprise Application, open **Users and groups**.

Select **Add user/group**, choose the users or groups that should be provisioned to Couchdrop, then select **Assign**.

Only users and groups assigned to the application will be included in provisioning.
{% endstep %}

{% step %}

### Configure automatic provisioning

In the Enterprise Application, open **Provisioning** and select **Get started**.

Set **Provisioning Mode** to **Automatic**, then configure:

<table><thead><tr><th width="194.10546875">Microsoft Entra field</th><th>Value</th></tr></thead><tbody><tr><td><strong>Tenant URL</strong></td><td><code>https://api.couchdrop.io/scim/v2</code></td></tr><tr><td><strong>Secret Token</strong></td><td>The Provisioning Token created in Couchdrop</td></tr></tbody></table>

Select **Test Connection**.

Microsoft Entra will attempt to connect to Couchdrop and retrieve the schema information required for user and group mappings.

If the connection test succeeds, select **Save**.
{% endstep %}

{% step %}

### Configure user attribute mappings

Open **Provision Azure Active Directory Users**.

Couchdrop requires the following SCIM attributes to be mapped. Remove mappings that are not required.

| Custom Application SSO Attribute |
| -------------------------------- |
| `userName`                       |
| `active`                         |
| `emails[type eq "work"].value`   |
| `name.givenName`                 |
| `name.familyName`                |
| `externalId`                     |

{% hint style="info" %}
Depending on your Microsoft Entra configuration, the `externalId` attribute may need to be mapped from `mailNickname` to `objectId`.
{% endhint %}
{% endstep %}

{% step %}

### Configure group attribute mappings

Open **Provision Azure Active Directory Groups**.

Couchdrop requires the following SCIM attributes to be mapped:

| Custom Application SSO Attribute |
| -------------------------------- |
| `displayName`                    |
| `externalId`                     |
| `members`                        |

{% endstep %}

{% step %}

### Start provisioning

Return to the Enterprise Application and open **Provisioning**.

Select **Start provisioning**.

After the first provisioning cycle completes, Microsoft Entra will display the number of users and groups provisioned to Couchdrop.

For additional detail, select **View provisioning logs**.
{% endstep %}
{% endstepper %}

## Supported features

<table><thead><tr><th width="197.87109375">Feature</th><th>Description</th></tr></thead><tbody><tr><td><strong>Push Users</strong></td><td>Users created in Microsoft Entra are also created in Couchdrop.</td></tr><tr><td><strong>Push User Updates</strong></td><td>User updates in Microsoft Entra are pushed to the corresponding Couchdrop users.</td></tr><tr><td><strong>User Deactivation</strong></td><td>Users deactivated in Microsoft Entra are deactivated in Couchdrop.</td></tr><tr><td><strong>Push Groups</strong></td><td>Groups created in Microsoft Entra are also created in Couchdrop.</td></tr><tr><td><strong>Push Group Updates</strong></td><td>Group updates in Microsoft Entra are pushed to Couchdrop.</td></tr><tr><td><strong>Group Deactivation</strong></td><td>Groups deactivated in Microsoft Entra are deactivated in Couchdrop.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.couchdrop.io/administration/scim-and-sso/scim-with-microsoft-entra-id.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.