SCIM User Provisioning

Starmind supports SCIM provisioning with Azure Entra ID (former Azure Active Directory). The SCIM protocol simplifies the process of creating and managing user accounts in Starmind. When you add, update, or remove users in Entra ID, SCIM automatically propagates these changes to the configured Starmind network.

Requirements

1. Your Identity Provider is Azure Active Directory.
2. Users in your Active Directory have the following properties:
   1. Email (the matching attribute)
   2. First Name
   3. Last Name

Configuration

Here is Microsoft tutorial: Configure Starmind for automatic user provisioning

To configure SCIM provisioning, you will need an API key, which you can receive from your Solution Architect.

1. Sign in to the Azure Portal. In Entra ID, select Enterprise Application, then select All applications.

2. Select New application.

3. Search for Starmind

4. Click Create.
5. Select Provisioning.

7. Select Get started.

8. Select Provisioning Mode -> Automatic.

9. Under the Admin Credentials section, input the SCIM Base URL for your network in Tenant URL and the API key provided by Starmind in secret token. Click Test Connection to ensure that Entra ID can connect to Starmind. If the connection fails, ensure that your provided credentials are correct or get in touch with your Solution Architect.

10. In the Settings -> Notification Email field, enter the email address of a person or group who should receive the provisioning error notifications and check the Send an email notification when a failure occurs box.

11. Click Save.
12. Under the Mappings section, select Provision Azure Active Directory Users.

13. The attribute mapping can now be configured. The following sub-steps describe the attribute mapping:

• Set Enabled to Yes.
• Disable/enable target object actions (actions on users.)

• In the Attribute Mapping table, search for the userPrincipalName attribute in the left column and click on it. A form will show the details of this attribute. SelectMatch objects using this attribute -> No and click OK.

• In the Attribute Mapping table, search for the mail attribute in the left column and click on it. Select Match objects using this attribute -> Yes, enter Matching precedence -> 1 and click OK.

• Configure the remaining Attribute Mapping as shown in the picture below. This image demonstrates the correct attribute mapping for Starmind.

• Save all changes.
• To enable the Entra ID provisioning service for Starmind, change the Provisioning Status to On in the Settings section.

• Define the users that you would like to provision to Starmind by choosing the desired values in Scope in the Settings section.

• When you are ready to provision, click Save.

This operation starts the initial synchronization of all users defined in Scope in the Settings section. The initial sync takes longer to perform than subsequent syncs, which occur approximately every 40 minutes as long as the Entra ID provisioning service is running. You can use the Synchronization Details section to monitor progress and follow links to the provisioning activity report, which describes all actions performed by the Entra ID provisioning service on Starmind.