User synchronization using SCIM

On the first tab – Parameters – give a name to the synchronization and set up its basic parameters.

The checkboxes in section More settings specify some operation parameters for the synchronization.

Click the Mapping group memberships button (or select the tab of the same name above) to switch to the tab where you can set up how to map users to groups.

Click Add a row to create rows with a pair of fields that will be used to map remote groups to Sofa groups.

In Group in Sofa, select a group from the list created in Sofa administration.

In Remote group identifier, copy the identifier corresponding to a group of users in the remote company that will contact Sofa.

How to get the identifier? You need access to the Microsoft Entra admin center portal. Log in to the company that is supposed to contact your company in Sofa.

In the main menu on the left, select Groups.

On the right, in the submenu, select the option All groups. In the list of groups, look up the group whose identifier you need. The identifier is in the column Object Id.

Copy the identifier in the field Remote group identifier in the setting in Sofa environment.

Use the button Add a row to create as many mappings as you need.

Then use the Mapping role membership button (or the tab of the same name) to switch to the role mapping tab.

Use the same steps to create as many mappings as you need.

Use the Logging button (or tab) to switch to the tab of the same name, where you select the level of information on progress to be logged during synchronization. In Logging level, select one of the levels Debug (debugging data), Information and Warning.

Click Save synchronization to save the synchronization description.

The named synchronization entry is then displayed in the Synchronization window. If you select it, a toolbar is displayed with the usual editing options available.

Click the link + Generate key to open the dialog to set up key validity between 90 and 730 days. Select the required value and click Generate key.

The key is displayed in the open dialog.

This means you will not be able to get the generated keys again, but if you need to, you can regenerate them in the Access details dialog. The key expiry date is also displayed here so that you can regenerate them on time.

An enabled synchronization can be disabled; the Enable synchronization button the changes to Disable synchronization.

Once the synchronization starts, the Synchronization window will display the last call time – when the remote application called the Sofa application.

After login, open the view Enterprise apps – All applications. Click + New application.

In the following window, click + Create your own application.

A modal window opens, where:

The application is created, which is noted by a message shortly displayed in the upper right corner of the window.

The basic application description is displayed in view Application name – Overview.

First you need to create a list of users and groups synchronized by the SCIM protocol.

Click Users and groups in the menu or the link Assign users and groups in tile no. 1.

In the following window, create a list of users and groups to have access to the application. Check the boxes next to the users to have access to the application. A list of such users will be gradually composed in the section on the right.

When you finish selecting, click Select. In the following window Add assignment, click Assign. The successful assignment is noted in the upper right window by a message with a green checkmark.

The created list is displayed in the view Application name – Users and groups.

Before creating the connection itself, you need to edit the mapping of the externalId attribute. The attribute mapping specifies how attributes are synchronized between Microsoft Entra ID and the user app.

In the inner menu, select Provisioning and then, in the modified menu, select Attribute mapping.

Then select Provision Microsoft Entra ID Users.

In the Attribute mapping window, in the column Attribute customappsso, look up the entry externalId and click the Edit button.

In the Edit attribute window, which now contains the mailNickname entry, click in the Source attribute field.

In the list of options, look up objectId and click it to transfer it to the field.

Select OK.

Now you can start creating the connection itself. Open the Enterprise apps window, select your application and in the inner menu, select Provisioning. Now we will set up the connection of the remote company to Sofa.

In the view Application name – Overview (Preview), click + New configuration.

In the following window New provisioning configuration, you will use the values you saved when setting up the synchronization in Sofa.

A test of the connection to Sofa is run and successful connection is announced in the upper right corner of the window by a message with a green checkmark.

Now you can click Create in the lower part of the window.

Successful creation of the configuration is again announced by a message with a green checkmark.

The window Application name – Overview (Preview) displays: Configuration status – Disabled. The application is created but not enabled. Now you need to click Start provisioning on the toolbar.

When the contact with Sofa is successfully made, the window displays: Configuration status – Enabled.

The provisioning is confirmed by a provisioning log in view SCIM – Provisioning logs.

You can also watch the successful run of each synchronization from within Sofa. For example, you can see in the administration that users synchronized from the remote company have been added.