> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/administration/scim-and-sso/scim-with-microsoft-entra-id.md).

# SCIM with Microsoft Entra ID

Learn about configuring Couchdrop to sync with Azure for accounts

## Overview

Couchdrop supports SCIM provisioning with Microsoft Entra ID to keep users and groups synchronized between Microsoft Entra and Couchdrop.

Once configured, changes made in Microsoft Entra can be pushed to Couchdrop automatically.

### How provisioning works

Microsoft Entra remains the source for the users and groups assigned to the Enterprise Application.

When provisioning runs, supported user and group changes are pushed to Couchdrop through the SCIM endpoint:

`https://api.couchdrop.io/scim/v2`

This allows user creation, updates, deactivation, group creation, group updates, and group deactivation to be managed from Microsoft Entra rather than maintained separately in Couchdrop.

## Configure SCIM provisioning

{% hint style="warning" %}

### Before you start

To configure SCIM provisioning, you will need:

* Owner access to Couchdrop
* Access to configure an Enterprise Application in Microsoft Entra ID
  {% endhint %}

{% stepper %}
{% step %}

### Create a User Provisioning Token in Couchdrop

In Couchdrop, navigate to **User Provisioning** and create a new **Provisioning Token**.

Copy the token. You will use it when configuring provisioning in Microsoft Entra.
{% endstep %}

{% step %}

### Create an Enterprise Application

In the Microsoft Entra admin center, navigate to **Enterprise applications** > **New application** > **Create your own application**.

Enter a meaningful name for the application and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
{% endstep %}

{% step %}

### Assign users and groups

In the Enterprise Application, open **Users and groups**.

Select **Add user/group**, choose the users or groups that should be provisioned to Couchdrop, then select **Assign**.

Only users and groups assigned to the application will be included in provisioning.
{% endstep %}

{% step %}

### Configure automatic provisioning

In the Enterprise Application, open **Provisioning** and select **Get started**.

Set **Provisioning Mode** to **Automatic**, then configure:

<table><thead><tr><th width="194.10546875">Microsoft Entra field</th><th>Value</th></tr></thead><tbody><tr><td><strong>Tenant URL</strong></td><td><code>https://api.couchdrop.io/scim/v2</code></td></tr><tr><td><strong>Secret Token</strong></td><td>The Provisioning Token created in Couchdrop</td></tr></tbody></table>

Select **Test Connection**.

Microsoft Entra will attempt to connect to Couchdrop and retrieve the schema information required for user and group mappings.

If the connection test succeeds, select **Save**.
{% endstep %}

{% step %}

### Configure user attribute mappings

Open **Provision Azure Active Directory Users**.

Couchdrop requires the following SCIM attributes to be mapped. Remove mappings that are not required.

| Custom Application SSO Attribute |
| -------------------------------- |
| `userName`                       |
| `active`                         |
| `emails[type eq "work"].value`   |
| `name.givenName`                 |
| `name.familyName`                |
| `externalId`                     |

{% hint style="info" %}
Depending on your Microsoft Entra configuration, the `externalId` attribute may need to be mapped from `mailNickname` to `objectId`.
{% endhint %}
{% endstep %}

{% step %}

### Configure group attribute mappings

Open **Provision Azure Active Directory Groups**.

Couchdrop requires the following SCIM attributes to be mapped:

| Custom Application SSO Attribute |
| -------------------------------- |
| `displayName`                    |
| `externalId`                     |
| `members`                        |

{% endstep %}

{% step %}

### Start provisioning

Return to the Enterprise Application and open **Provisioning**.

Select **Start provisioning**.

After the first provisioning cycle completes, Microsoft Entra will display the number of users and groups provisioned to Couchdrop.

For additional detail, select **View provisioning logs**.
{% endstep %}
{% endstepper %}

## Supported features

<table><thead><tr><th width="197.87109375">Feature</th><th>Description</th></tr></thead><tbody><tr><td><strong>Push Users</strong></td><td>Users created in Microsoft Entra are also created in Couchdrop.</td></tr><tr><td><strong>Push User Updates</strong></td><td>User updates in Microsoft Entra are pushed to the corresponding Couchdrop users.</td></tr><tr><td><strong>User Deactivation</strong></td><td>Users deactivated in Microsoft Entra are deactivated in Couchdrop.</td></tr><tr><td><strong>Push Groups</strong></td><td>Groups created in Microsoft Entra are also created in Couchdrop.</td></tr><tr><td><strong>Push Group Updates</strong></td><td>Group updates in Microsoft Entra are pushed to Couchdrop.</td></tr><tr><td><strong>Group Deactivation</strong></td><td>Groups deactivated in Microsoft Entra are deactivated in Couchdrop.</td></tr></tbody></table>