Provision administrator accounts from Entra ID using SCIM

In this topic, you will learn how to create and manage Portnox™ Cloud administrator accounts in Microsoft Entra ID using SCIM.

SCIM (System for Cross-domain Identity Management) is an open standard protocol for managing user identities across applications. With SCIM, you create and manage Portnox Cloud administrator accounts in Entra ID. When you assign Entra ID users to the SCIM application, Portnox Cloud creates administrator accounts for these users. When you change the attributes of these users in Entra ID, Portnox Cloud updates their administrator accounts.

Note:

SCIM provisioning does not require a Portnox Cloud integration with Entra ID (see the following topic: Integrate with Microsoft Entra ID). The SCIM application is a separate Entra ID enterprise application.

Create an application API integration in Portnox Cloud

In this section, you will create a SCIM application API integration in Portnox Cloud.

In the Cloud portal top menu, click on the Settings option.
In the Cloud portal left-hand side menu, click on the Integration Services > APPLICATION API INTEGRATIONS option.
Click on the Add API integration button.
Enter a Name for the integration and in the Capability field, select the Admin provisioning (SCIM) option. Then, click on the Next: View variables button.

Portnox Cloud displays the values that you need for the Entra ID application: Tenant URL, OAuth token endpoint, Client identifier, and Client secret.
Keep this browser tab open.

From now on, we will call this tab the Portnox tab.

Important:
Portnox Cloud shows the client secret only once. If needed, click on the ⧉ icon before you click on the Finish button and save the copied value in a temporary text file. You cannot retrieve it later.

Create a new Entra ID enterprise application

In this section, you will access the Microsoft Azure administrative interface and use it to create a new Entra ID enterprise application for SCIM provisioning.

In another tab of your browser, open your Microsoft Azure Portal by accessing the following URL: https://portal.azure.com/
From now on, we will call this tab the Azure tab.
In the Azure Portal main menu, click on the Microsoft Entra ID option.
In the left-hand side menu, click on the Manage > Enterprise applications option.
In the top menu of the Enterprise applications screen, click on the New application button.
In the top menu of the Browse Microsoft Entra Gallery screen, click on the Create your own application button.
In the Create your own application pane, enter a name for the new application in the What is the name of your app field, select the Integrate any other application you don’t find in the gallery (Non-gallery) option, and then click on the Create button.

In this example, we used the name SCIM integration for the new application but you can use any name you like.
In the left-hand side menu of the application pane, click on the Manage > Provisioning option.
Keep this browser tab open.

From now on, we will call this tab the Azure tab.

Connect the Entra ID application to Portnox Cloud

In this section, you will copy the values displayed by Portnox Cloud and paste them in the connectivity settings of the Entra ID application.

In the Azure tab, in the Create configuration section, click on the Connect your application button.
In the New provisioning configuration pane, in the Select authentication method field, select the OAuth2 client credentials grant option.
Copy the connection values from the Portnox tab to the Azure tab.
1. In the Portnox tab, click on the ⧉ icon next to the Tenant URL field. In the Azure tab, paste the value into the Tenant URL field.
2. In the Portnox tab, click on the ⧉ icon next to the OAuth token endpoint field. In the Azure tab, paste the value into the OAuth token endpoint field.
3. In the Portnox tab, click on the ⧉ icon next to the Client identifier field. In the Azure tab, paste the value into the Client identifier field.
4. In the Portnox tab, click on the ⧉ icon next to the Client secret field. In the Azure tab, paste the value into the Client secret field.
Click on the Test connection button. After the test succeeds, click on the Create button.
In the Portnox tab, click on the Finish button.

Map the administrator attributes

In this section, you will map the Entra ID attributes that set the repository and the role of each Portnox Cloud administrator account.

Portnox Cloud uses the following SCIM attributes:


Target attribute	Purpose	Value	Result
`userType`	Sets the identity repository of the administrator account. Portnox Cloud uses this repository to authenticate the administrator at login.	`Clear`	Portnox Cloud repository
		`EntraId`	Entra ID repository
		`Google`	Google Workspace repository
		`Okta`	Okta repository
`roles[primary eq "True"].value`	Sets the administrator type.	`FullAdmin`	Administrator
		`ReadOnlyAdmin`	Read-only Administrator
		`GuestAdmin`	Guest Administrator
		`ReadOnlyGuestAdmin`	Guest Administrator + Read-only

Important:

The userType attribute controls the type of administrator account that Portnox Cloud creates when provisioning the account from Entra ID. We recommend that you use EntraId, but you can use a different value if needed. For example, if you provision an administrator from Entra ID with the Clear value, Portnox Cloud creates a Cloud administrator account. This administrator will then not be able to use the Entra ID SSO to log in, instead, they will have to log in with their Entra ID email address and a password that they will set using a link sent by Portnox Cloud via email.

In the Azure tab, in the left-hand side menu of the application pane, click on the Manage > Attribute mapping option.
In the Users tab, in the top menu, click on the Add attribute mapping button.

Note:
Repeat this step to add each of the mappings described in the following steps.
Add the mapping for the repository.
1. In the Mapping type field, select the Constant option.
2. In the Constant attribute (Microsoft Entra ID) field, enter EntraId.
3. In the Target attribute (customappsso) field, select the userType option.
4. Click on the Add button at the bottom of the Add Attribute Mapping screen.
Add the mapping for the administrator type.

Note:
You can also use the Constant mapping type to give all assigned users the same administrator type. The following procedure uses the Expression mapping type, which lets you choose the administrator type for each user based on their Entra ID attributes.
1. In the Mapping type field, select the Expression option.
2. In the Expression field, enter a Switch expression.
  Use the following format:
```
Switch([attribute], "default", "key1", "value1", "key2", "value2")
```
  - attribute: The Entra ID user attribute to check, for example department or jobTitle.
  - default: The administrator type for users whose attribute value matches no key.
  - key and value pairs: If the attribute value is exactly key, the user gets the administrator type value. Add as many pairs as you need.
  Each default and value must be one of the roles[primary eq "True"].value values from the table above.
  Examples:
  - Users in the IT department get full administrator access. All other assigned users get read-only access:
```
Switch([department], "ReadOnlyAdmin", "IT", "FullAdmin")
```
  - Users in the IT department get full administrator access. Users in the Support department get guest administrator access. Users in the Onboarding department get guest administrator and read-only access. All other assigned users get read-only access:
```
Switch([department], "ReadOnlyAdmin", "IT", "FullAdmin", "Support", "GuestAdmin", "Onboarding", "ReadOnlyGuestAdmin")
```
  - Users with the Network Administrator job title get full administrator access. Users with the Support Technician job title get guest administrator access. Users with the Onboarding Technician job title get guest administrator and read-only access. All other assigned users get read-only access:
```
Switch([jobTitle], "ReadOnlyAdmin", "Network Administrator", "FullAdmin", "Support Technician", "GuestAdmin", "Onboarding Technician", "ReadOnlyGuestAdmin")
```
3. In the Target attribute (customappsso) field, select the roles[primary eq "True"].value option.
4. Click on the Add button at the bottom of the Add Attribute Mapping screen.
Click on the Save button at the bottom of the Attribute mapping screen, then click on the Yes button in the confirmation dialog.

Note:

You can set the value of each attribute using any logic based on Entra ID user attributes. To build and test more complex expressions, click on the Use the expression builder link below the Expression field in the Add Attribute Mapping screen.

Assign users and start provisioning

In this section, you will select the Entra ID users that become Portnox Cloud administrators and start the provisioning process.

In the Azure tab, in the left-hand side menu, click on the Manage > Users and groups option.
In the top menu, click on the Add user/group button.

The browser displays the Add Assignment screen.
In the Users and groups section, click on the None Selected link.
In the Users and groups pane, click on the checkboxes next to the users or groups that should have Portnox Cloud administrator accounts. Then, click on the Select button.
Click on the Assign button at the bottom of the Add Assignment screen.

The selected users and groups show in the Users and groups list.
In the left-hand side menu, click on the Overview option. Then, in the top menu, click on the Start provisioning button and click on the Yes button in the confirmation dialog.

Result: Portnox Cloud creates administrator accounts for the assigned users during the next provisioning cycle. The accounts show in the Settings > Administrators list.

Note:

Entra ID runs automatic provisioning cycles about every 40 minutes. New assignments and attribute changes reach Portnox Cloud during the next cycle. The first cycle after you start provisioning can take longer.

To provision a single user immediately, in the Azure tab, in the left-hand side menu of the application pane, click on the Provision on demand option. Then, select the user and click on the Provision button.

Note:

You can also provision administrator accounts from other SCIM-compatible applications, for example Rippling HR software, PingOne, or CyberArk Identity. However, if integrating with a platform different than Entra ID, the names of the SCIM connection fields will differ. For example, the Tenant URL value is called SCIM base URL in Rippling and PingOne, and SCIM service URL in CyberArk Identity. If you integrate with an application other than Entra ID, adjust the procedure by consulting that application’s documentation for the relevant field names and settings.