SCIM 2.0 Entra ID setup guide

This article provides step-by-step instructions to set up the SCIM connection between Microsoft Entra ID and deskbird, enabling seamless synchronization of user and group data.

💡 Note: After setting up SCIM, the first sync may take 1–2 hours. Please wait and check again later.

⚠️ Provisioning objects must only include users and/or groups that require access to deskbird. Any objects included in the sync will be provisioned automatically.

1. Create the SCIM token in deskbird
2. Setting up the SCIM application
3. Steps to provision the selected objects

1. Create the SCIM token in deskbird

1. Go to the "API keys" menu in the admin section
2. Click the "Generate key" button and choose the SCIM option

3. Choose your SCIM provider and generate your token (there is only one token per company)

4. Copy your SCIM token and paste it into a secure location (the token will not be visible on the UI)

5. You can always revoke an existing key and generate a new one

Now you have all you need to proceed with setting up your SCIM application

2. Setting up the SCIM application

1. Go to https://entra.microsoft.com/ and click on Enterprise applications

2. Click on New application

3. Click on Create your own application

4. Give it a name, and make sure that Integrate any other application you don't find in the gallery (Non-gallery) is checked:

5. Click Create

6. You should now be redirected to the newly created application

7. Go to Provisioning

8. Click Get started

9. Select Automatic from the dropdown

10. In the Tenant URL field, insert the following URL: https://api.deskbird.app/v2/scim
11. In the Secret Token field, enter the company SCIM token you generated in the first step
12. Click Test Connection

If everything works as expected, you will see a confirmation pop-up.

13. Click Save

14. Click Provision Microsoft Entra ID Users under Mappings

15. Scroll to the bottom of the page, and delete the mailNickname attribute

16. At the bottom of the page, click Add New Mapping

17. Go to Source attribute and select objectId from the dropdown

18. Go to Target attribute and select externalId from the dropdown

19. Click Save

20. You should now see the added mapping in the list:

21. Click Provision Microsoft Entra ID Users under Mappings

💡 Recommended check for group-based provisioning:
If you are using group-based SCIM provisioning, we strongly recommend verifying the group attribute mappings to ensure users are correctly deactivated in deskbird when they are removed from an Entra ID group.

1. In the Mappings section, select Provision Microsoft Entra ID Groups from the dropdown.
2. Scroll to the bottom and click Show advanced options.
3. Locate the attribute with the target attribute members.

Ensure the following configuration:

• ❌ urn:ietf:params:scim:schemas:core:2.0:Group is not selected
• ✅ urn:ietf:params:scim:schemas:extension:enterprise:2.0:User remains selected

Save the changes and allow a few minutes for Microsoft Entra ID to apply them. With this configuration, users removed from Entra ID groups will be correctly set to Inactive in deskbird during the next provisioning cycle.

22. Go to Enterprise Applications and select Users and Groups

23. Click Add user/group

24. Click None selected

25. Search and choose the group(s)/user(s) you wish to provision. Click on Select

26. Click Assign

Everything should be configured now!

3. Steps to provision the selected objects

1. Go to your SCIM application and click Provisioning

2. Go to Start provisioning

3. The process will be kicked off in the background. Once completed, it should look like this:

💡 Note: After setting up SCIM, the first sync may take 1–2 hours. Please wait and check again later. After the initial setup, a sync will happen every 40 minutes.