Skip to main content

SCIM provisioning integration with Microsoft Entra ID (Azure AD)

Written by Martina
Updated this week

In this article, we will guide you on how to integrate Parallel with Microsoft Entra ID (Azure AD), enabling automatic user provisioning and deprovisioning in Parallel using SCIM (System for Cross-domain Identity Management).

Prerequisites

The SCIM integration with Parallel is an enterprise feature. Ensure this feature is included in your plan before proceeding with this guide.

⚠️ This feature is not available in all plans, check if it is included in your subscription plan or write to us at support@onparallel.com

⚠️ To enable this feature, you will need an authentication token that will be provided by our support team on request.

Steps

If you already have an enterprise application for Parallel within Entra ID (e.g. you already integrated with Parallel for SSO), you can skip steps 1 to 4 and use the same Enterprise application.


In order to integrate Parallel with your Microsoft Entra ID, please follow these steps:

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  2. Browse to Identity > Applications > Enterprise applications > New application.

  3. Click on Create your own application.

  4. Name your application Parallel and choose option Integrate any other application you don't find in the gallery (Non-gallery).
    ​

  5. Browse to Manage > Provisioning and click on New configuration.

  6. Fill the following information

  7. Click on Test connection and then Create.

  8. Browse to Manage > Attribute mapping.
    In this section we will map how Entra ID attributes are sent to Parallel. It is important that these mappings are accurate.
    ​

    1. Group mappings


      ​If you don't want to map Entra ID groups to Parallel teams, simply set Enabled: No and skip to User mappings below.


      ​Make sure you set the mapping to match by externalId (objectId). You will need to:

      • Edit externalId mapping and set Match objects using this attribute to Yes and Matching precedence to 2.

      • Edit displayName mapping and set Match objects using this attribute to No.

      • Edit externalId mapping and set Matching precedence to 1.

      When your mappings look like the image above, click on Save.

    2. User mappings

      Uncheck Delete in Target Object Actions
      ​

      Delete all mappings except for:

      • userName

      • active

      • emails[type eq "work"].value

      • name.givenName

      • name.familyName

      • externalId

      Make sure you set the mapping to match by externalId (objectId). You will need to:

      • Edit externalId mapping and set:

        • Match objects using this attribute to Yes

        • SourceAttribute to externalId

        • Matching precedence to 2.

      • Edit userName mapping and set Match objects using this attribute to No.

      • Edit externalId mapping and set Matching precedence to 1.
        ​

      Finally, edit the mapping for userName so that the Source attribute is set to mail.


      ​

      When your mappings look like the image above, click on Save.

  9. Browse to Manage > Provisioning and set Provisioning status to On.

  10. Browse to Manage > Users and groups and add any users or groups you wish to sync with Parallel.
    ​
    ​Please note that provisioning in Entra ID is not immediate and may take a few minutes to complete.

Did this answer your question?