Before you begin, make sure you have already configured SAML Single Sign-On (SSO) for your Archie workspace, as it is required for users to sign in to Archie.
Please note that SCIM requires its own Microsoft Enterprise Application. You will need to create a new application in Microsoft Entra specifically for SCIM provisioning.
This guide will walk you through configuring SCIM provisioning between Microsoft Entra ID (Azure Active Directory) and Archie, allowing you to automatically synchronize users and groups from Microsoft into your Archie workspace.
Configure SCIM Provisioning with Microsoft Entra ID (Azure)
Step 1: Create the SCIM Integration in Archie
In Archie, go to Settings > Integrations.
Open the SCIM integration, click Set Up Provisioning App, then select Azure.
Keep the generated Authorization Token handy, as you will need it later during the Microsoft configuration.
Step 2: Open Your Enterprise Application in Microsoft Entra
Sign in to the Microsoft Entra Admin Center.
Navigate to Azure Active Directory > Enterprise Applications.
Click New Application.
Select Create your own application.
Enter a name (for example, Archie SCIM).
Click Create.
Step 3: Configure Provisioning
Open the Enterprise Application.
Select Provisioning.
Click Get Started.
Configure the following settings:
Provisioning Mode: Automatic
Tenant URL:
https://archieapp.co/scim/v2Secret Token: Paste the authorization token generated in Archie.
Step 4: Assign Users and Groups
Before provisioning can begin, assign the users and groups that should synchronize with Archie.
Open the Users and Groups tab.
Assign the desired users and groups to the Enterprise Application.
Only assigned users and groups will be synchronized.
Step 5: Configure User Provisioning
Navigate to:
Provisioning > Mappings > Provision Azure Active Directory Users
Enable Target Object Actions
Make sure the following actions are enabled:
Create
Update
Delete
Required Attribute Mappings
Configure at least the following mappings:
Azure Attribute | SCIM Attribute |
userPrincipalName | userName |
givenName | name.givenName |
surname | name.familyName |
emails[type eq "work"].value | |
displayName | displayName |
city | addresses[type eq "work"].locality |
preferredLanguage | preferredLanguage |
Step 6: Configure Group Provisioning
Navigate to:
Provisioning > Mappings > Provision Azure Active Directory Groups
Enable Target Object Actions
Enable:
Create
Update
Delete
Required Attribute Mappings
Azure Attribute | SCIM Attribute |
displayName | displayName |
objectId | externalId |
members | members |
Step 7: Enable Provisioning
Return to the main Provisioning page.
Verify that both User Provisioning and Group Provisioning are enabled.
Set Provisioning Status to On.
Your automatic synchronization is now configured.
Step 8: Complete the Configuration in Archie
Now that the Microsoft Entra configuration is complete, return to your Archie workspace to finish setting up the SCIM integration.
Go to Settings > Integrations > App Marketplace.
Locate the SCIM integration and open it.
Configure User Synchronization
Under the Users section, review the available synchronization options.
At a minimum, make sure that Create Users is enabled. If this option is disabled, new users synchronized from Microsoft Entra will not be created in Archie.
Depending on your organization's needs, you can also review the additional user synchronization options available in this section.
Configure Group Mapping
Next, review the options under the Groups section.
Here you can configure how Microsoft Entra groups will be mapped to Archie groups. This allows synchronized users to be automatically assigned to the appropriate groups within Archie based on their Microsoft group memberships.
Once these settings have been configured, your SCIM integration is ready to synchronize users and groups between Microsoft Entra and Archie.
Testing Your SCIM Integration
To verify everything is working correctly:
Assign a test user and a test group under Users and Groups.
Microsoft normally provisions changes automatically, but this may take some time.
If you would like to test immediately:
Go to Provisioning > Provision on Demand.
Select:
The test user
The test group
(If applicable) the user who belongs to that group
Click Provision.
After the provisioning process finishes:
The new user should appear in Archie.
The new group should appear in the SCIM Configuration page within Archie.
Once the group has been synchronized, you can map the SCIM group to an Archie group. If a user belongs to that group in Microsoft Entra and the group has been mapped in Archie, the user will automatically be synchronized into the corresponding Archie group.