Configuring SCIM External Provisioning on Entra ID
Microsoft provide extensive documentation here on provisioning, planning etc from a Microsoft Point of View.
Specifically, this guide here provides an in-depth how-to guide for provisioning.
Some key takeaways are as follows:
- Mappings - where EntraID fields are mapped through to SCIM and therefore CX fields
- Admin Credentials - where the provisioning URL and token shown in the NeonNow Admin app are copied. Entra ID labels the URL field Tenant URL
- Provisioning Modes - this should be set to ‘Automatic’ to ensure regular SCIM provisioning occurs
- User assignment - users must be assigned to the application itself - either directly, or via a Group. Generally it is better practice to assign groups only to the Enterprise Application
By default, Entra ID sends extension attributes as strings, so a CX attribute that expects a boolean - such as e911Disabled - arrives as a string and is rejected. See Disabling E911 for Specific Agents for what that attribute controls and why a string value is rejected.
To make Entra ID emit correctly typed SCIM 2.0 values, so that booleans arrive as booleans, append the aadOptscim062020 flag as a query parameter to the Tenant URL - for example https://…/scim?aadOptscim062020. This is set in the provisioning Admin Credentials section, alongside the URL and token copied from the NeonNow Admin app.
Microsoft document the flag under known issues with SCIM 2.0 protocol compliance.
This applies to any boolean extension attribute, not just E911.