Provision Users with Microsoft Entra ID (Azure) SCIM

Step 1: Create a SCIM Scoped Token

1. In Ironclad, navigate to Company Settings > Integrations > SAML
2. At the top, select the SCIM Configuration tab.
3. Under Token Generation, enter a descriptive name for the token.
4. Click + Generate New Token.
5. Copy and paste the new token into your identity provider's setup.
6. Save this token in a safe place. Once you close the window, you will not be able to access it again.

Step 2: Enable API Integration in Microsoft Entra ID

You may need to change the default settings for Switch to the following if the default does not allow for you to remove users:

1. Log in to your Microsoft Entra admin center with your admin account. In the Entra ID panel on the left, click Enterprise Apps then find the Ironclad app you created to enable SSO (e.g. Ironclad).
2. Select the Ironclad application you previously configured.
3. From the application's configuration screen, click the Provisioning tab.
4. Click Connect your application.
   
5. Select Bearer Authentication as the authentication method.
6. In the Tenant URL field, enter https://ironcladapp.com/scim/v2.
   1. If you are in the European Union and/or your SSO SAML Callback URL begins with [https://eu1.ironcladapp.com,](https://eu1.ironcladapp.com,) you must enter https://eu1.ironcladapp.com/scim/v2 instead.
7. In the Secret Token field, enter the user’s Ironclad API Token.
   
8. Click Test connection to verify the connection.
9. Click Create. The admin credentials are created.

10. Click the Attribute Mapping section, and then click Provision Microsoft Entra ID Users and unmap the following array type fields. You can remap these in the future:

    • physicalDelivery
    • OfficeName
    • streetAddress
    • city
    • state
    • postalCode
    • country
    • telephoneNumber
    • mobile
    • facsimileTelephoneNumber
    • mailNickname

    The Manager attribute is not compatible with Ironclad's reference chains.

11. Click Save.

Step 3: Assign Users And Groups to the Ironclad Application

Pushing users into Ironclad with SCIM is only supported when a single SAML configuration is in place in your Ironclad company.

Any subsequent updates to users or groups within Microsoft Entra ID Active Directory are periodically updated in Ironclad.

1. In your Microsoft Entra ID Active Directory admin account, under the application, click the Users and Groups tab.
2. Click the Add User button and select the users and groups to assign the to application.
3. On the bottom left-hand side of the screen, click the Assign button. These users will be added or updated in the next provisioning cycle (typically around 45 minutes).
4. From the Users and Groups tab, you can also remove users and groups from the application.

Step 4: Start Provisioning

Click the Provisioning section, and then click the Get Started tab. Click Start provisioning.

Step 5: Configure Group Permissions in Ironclad

You must manage group permissions in Ironclad after pushing groups via SCIM. Refer to the Group Permissions Overview for more information.