Skip to main content

SCIM Setup (For IT Admin of Enterprises Using Azure AD SSO)

Updated over a month ago

SCIM (System for Cross-domain Identity Management) is a standard protocol commonly used to automate the exchange of user identity information between an organization’s directory and connected applications. With SCIM, you can ensure that user accounts are automatically created, updated or deactivated in sync with your Azure AD configuration.

Setting up SCIM provisioning for your organization will require actions from Brief AI. Please get in touch if your organization would like to enable SCIM-based user lifecycle management to streamline onboarding and offboarding. Once SCIM is enabled, Brief AI support will no longer be able to create or delete user accounts on your behalf.

For segregated environments, a dedicated SCIM endpoint and app domain will be provided (for example https://organisation.wiseworks.ai). Your Brief AI contact will confirm if this applies to your deployment.

SCIM setup

1. Prerequisites

Before starting, please make sure you have received the following from Brief AI:

  • Tenant URL

  • Secret Token

To set up SCIM, please make following changes to the already-configured enterprise application:

2. Open the Enterprise Application in Azure

  1. Log in to the Azure Portal.

  2. Go to Enterprise applications.

  3. Select the existing Brief AI enterprise application already used for SSO.

3. Connect SCIM Provisioning

  1. In the application menu, select Provisioning.

  2. Choose Connect your application.

  3. Enter the Tenant URL and Secret Token provided by Brief AI.

  4. Click Test connection.

  5. When the test succeeds, click Save.

4. Create App Roles (Required for SCIM)

SCIM requires Azure AD to send a single combined role value for each user. This value tells Brief AI:

  • which organisation the user belongs to

  • what access level they should have (User or Admin)

The required role value depends on whether your organisation uses multiple Brief AI organisations or only one.

If your organisation uses multiple Brief AI organisations

Each role value must follow the format:

ORG.ROLE

Examples:

  • RED.USER

  • BLUE.ADMIN

If your organisation uses only one Brief AI organisation

Use the role alone:

  • USER

  • ADMIN

Creating App Roles in Azure

  1. Go to Azure Active Directory > App registrations.

  2. Select the App Registration associated with the Brief AI Enterprise Application.

  3. Open Manage > App roles.

  4. Click Create app role.

  5. Fill in the fields as follows:

    If you only have a single organisation, configure with just the role:

  6. Repeat for each required role value. If using multiple organisations, you will have two roles per organisation.
    Example:

    • RED.USER

    • RED.ADMIN

    • BLUE.USER

    • BLUE.ADMIN

5. Add SCIM Attribute Mapping

Azure AD must send the App Role value (RED.USER, BLUE.ADMIN, USER, etc.) to Brief AI through the SCIM roles attribute.

To configure this:

  1. In the Enterprise Application, select Attribute mapping (Preview).

  2. Locate or create a mapping for the SCIM roles attribute.

  3. Set the following:

    • Mapping type: Expression

    • Expression: SingleAppRoleAssignment([appRoleAssignments])

    • Target attribute: roles[primary eq "True"].value

    • Match objects using this attribute: No

    • Apply this mapping: Always

6. Assign Roles to Users

  1. In the Enterprise Application, select Users and groups.

  2. Click Add assignment.

  3. Select a user.

  4. Choose the correct App Role from the list.

  5. Click Assign.

Azure AD will now automatically create, update, or deactivate the user in Brief AI based on this role.

Did this answer your question?