❗Important
In order to set up Azure SCIM, you must first set up SSO for Azure. You must be a Guru Admin to set up SCIM for your team.
Setting up SCIM through Microsoft Azure
1. Open the SSO/SCIM page in Team Settings and toggle "Authorize SCIM Provisioning" to on. You must be an Admin to turn on SCIM for your team. If you don't see the option to turn SCIM on, please reach out to your Account Manager or support@getguru.com to ensure that it is in your Guru plan.
2. Navigate to your Apps landing page in Azure, and select Provisioning under the “Manage” section in the left column and click Get Started.
3. Identify Automatic as your “Provisioning Mode"
4. For “Admin Credentials” enter the following:
Tenant URL - https://api.getguru.com/api/scim/v2/
Secret Token - Copy the SCIM Username and SCIM Token fields from Guru, then paste both of these into this field separated by a colon.
Confirm by selecting Test Connection (you should see confirmation in the top right corner of the page.)
✍️ Note
To continue on to the next step you may need to refresh your page or select save. Then, back on the Guru app landing page, select Edit Provisioning at the top of the screen.
Provisioning Azure Active Directory Users:
1. Under “Mappings,” choose Provision Azure Active Directory Users:
2. Ensure "Enabled" is Yes and "Target Object Actions" Create, Update, and Delete are checked off. Your Attribute Mappings should mirror those listed below.
Capitalization matters.
The "customappsso Attribute" externalID needs to be updated from the default value to objectId.
Attribute Mappings:
Azure Active Directory Attribute: | custommapsso Attribute: | Matching preference: |
userPrincipalName | userName | 1 |
Switch([IsSoftDeleted], , "False", "True", "True", "False") | active | |
displayName | displayName | |
emails[type eq "work"].value | ||
givenName | name.givenName | |
surname | name.familyName | |
objectId | externalId | |
employeeId | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber |
3. Save these settings.
Provisioning Azure Active Directory Groups:
1. Under “Mappings,” choose Provision Azure Active Directory Groups.
2. Your Attribute Mappings should mirror those listed below.
Capitalization matters.
Ensure that Create, Update, and Delete are checked off.
Attribute Mappings:
Azure Active Directory Attribute: | custommapsso Attribute: | Matching preference: |
displayName | displayName | 1 |
objectid | externalId | |
members | members |
3. Save these settings.
Start Provisioning
1. After Provision Azure Active Directory Users and Provision Azure Active Directory Groups setup is complete, close the Provisioning screen.
2. Click ▶️ Start Provisioning to begin syncing users and groups in the Azure Enterprise application to your Guru Team.
📑 Related articles