Skip to main content

Provision users from Microsoft Entra ID via SCIM

Microsoft Entra ID (formerly Azure Active Directory) provisions DQ Cloud users via the same SCIM 2.0 surface as Okta and Google Workspace. The configuration is slightly different — Entra uses aadOptscim062020 mode and emits patches with the path=name.givenName form, not the bare-value form Okta prefers — but DQ Cloud's SCIM handler supports both.

Goal​

Configure Entra ID's enterprise-application provisioning so:

  • Adding a user (or group member) to the DQ Cloud enterprise app in Entra triggers POST /scim/v2/Users in DQ Cloud.
  • Removing a user from the app sends PATCH active=false, deprovisioning the org membership.
  • Group assignments mirror as DQ Cloud workspace memberships.

Prereqs​

  • Org-owner or admin in DQ Cloud.
  • Entra ID P1 or higher (the free tier doesn't include outbound provisioning).
  • DQ Cloud reachable from Entra over HTTPS.

1. Mint a SCIM bearer in DQ Cloud​

Same as for Okta — see Provision users from Okta via SCIM. Use a distinct name (e.g. entra-prod) so a future revoke takes down one IdP without disrupting the other.

2. Create the enterprise application in Entra​

  1. Entra admin centre → Enterprise applications → New application → Create your own application.
  2. Name: "DQ Cloud", and pick Integrate any other application you don't find in the gallery (Non-gallery).
  3. After creation, open the app and choose Provisioning from the left nav.

3. Configure the provisioning connection​

  1. Provisioning mode: Automatic.
  2. Admin credentials:
    • Tenant URL: https://dq.example.com/scim/v2
    • Secret token: the dqs_... from step 1.
  3. Click Test Connection. Entra hits GET /Users?filter=userName eq "testuser@example.com" and GET /ResourceTypes; both should return 200.
  4. Save.

Note: Entra ID requires the ?aadOptscim062020 query string on every endpoint to enable the compatibility mode it expects. DQ Cloud accepts that query string as a no-op so this works out of the box; you do not need to configure anything extra.

4. Set up the attribute mappings​

Entra's default User attribute mappings work without modification, but verify them:

Entra attributeSCIM targetDQ Cloud column
userPrincipalNameuserNameusers.email
mailemails[type=work].valueusers.email
givenNamename.givenNamefirst token of users.full_name
surnamename.familyNameremainder of users.full_name
Switch([IsSoftDeleted], ...)activepresence of org_memberships row

Optional but recommended: delete the mappings for phoneNumbers, addresses, and roles. DQ Cloud ignores them; sending them just bloats the audit trail.

5. Enable provisioning​

  1. Set Provisioning Status to On.
  2. Under Settings, pick Scope = Sync only assigned users and groups for the first run — this keeps the blast radius small until you've validated the mapping.

6. Assign users and groups​

  1. Open the Users and groups tab in the same app.
  2. Add user/group → pick the users or security groups to provision.
  3. Trigger an immediate sync via Provisioning → Provision on demand → Provision and paste a test user's UPN. The right-hand pane shows the SCIM call Entra emitted and the response from DQ Cloud — useful for diagnosing mapping issues without waiting 40 minutes for the scheduled sync.

For groups, enable Push Groups (the toggle is on the Provisioning page). Each pushed group lands as a DQ Cloud workspace; renaming the group in Entra triggers a PATCH /Groups/{id} displayName=... and DQ Cloud updates the workspace name and slug.

7. Deprovisioning​

When a user is disabled in Entra (or removed from the app), Entra sends:

PATCH /scim/v2/Users/{id}
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{"op": "Replace", "path": "active", "value": "False"}]
}

DQ Cloud accepts the string "False" as a falsy value (Entra ID quirk) and deletes the org_memberships row + any workspace memberships in this org. The global users row stays put so the same person can still log in to other tenants.

Trouble­shooting​

SymptomLikely cause
Entra "Test Connection" returns 401dqs_ bearer was copy-pasted with whitespace or has been revoked.
Provisioning attempt logs 400 invalidValueEntra sent a payload without userName. Check the userName mapping is set to userPrincipalName.
409 uniqueness on every assignmentThe user is already in the org. This is expected on re-syncs; Entra logs it and continues.
Provisioning fails with 415 unsupportedMediaTypeA reverse proxy in front of DQ Cloud is rewriting the Content-Type. Make sure application/scim+json is allowed through.

Revoking the connector​

  1. In Entra ID, Provisioning Status → Off, then Save.
  2. In DQ Cloud, Settings → SCIM provisioning → Revoke the entra-prod token. The Redis-backed auth cache picks up the revoke within ~5 s.