This document shows you how to synchronize users or user groups from Microsoft Entra ID (also known as Azure AD) to Tencent Cloud Identity Center by using the SCIM protocol.
Background
All configuration operations in Microsoft Entra ID need to be performed by an administrator (who has been granted global administrator permissions). For information on how to create a user and authorize the user as an administrator in Microsoft Entra ID, refer to Microsoft Entra Documentation.
2. In the left navigation bar, click User Management > Settings.
3. Click
in the SCIM User Synchronization Configuration area and click Enable in the pop-up window to enable SCIM synchronization.
4. After enablement, in the SCIM User Synchronization Configuration area, view or copy the SCIM server address, which will be used when configuring SCIM synchronization in the external IdP.
1. Click Generate New SCIM Key in the SCIM User Synchronization Configuration area.
2. In the Create CredentialSecret dialog box, you can save the SCIM key by Download CSV File or Copy. After saving the key, click OK.
Configuration in Azure
Step 1: Creating an Application in Microsoft Entra ID
1. Log in to the Azure portal as an administrator and click the menu icon in the top-left corner.
2. In the left navigation bar, select Microsoft Entra ID.
3. In the left navigation bar, select Manage > Enterprise applications and then go to All applications.
4. Click New application.
5. On the Browse Microsoft Entra Gallery page, click Create your own application, enter the name of your app in the right window, select Integrate any other application you don't find in the gallery (Non-gallery), and then click Create.
Step 2: Configuring SCIM Synchronization in Microsoft Entra ID
1. On the SCIM intl application page, click Provisioning in the left navigation bar.
2. On the Provisioning page, click Get Started.
3. Set the provisioning mode to Automatic. In the Admin Credentials area, configure the admin credentials.
In the Tenant URL area, enter the SCIM server address.
After the test is successful, you can proceed with the Next operation.
4. In the Mappings section, you can use default configuration or modify attribute mapping as needed. The userName uses Microsoft Entra ID's userPrincipalName by default.
5. In the Settings section, the Scope module is selected by default to Sync only assigned users and groups. To synchronize, users and groups must first be assigned to the application.
Note:
If selected to Sync all users and groups,it will automatically syncall users and groups in Microsoft Entra ID.
6. Click On at Provisioning status, and click save. Configuration complete.
Step 3: Assign Users/Groups
1. On the Provisioning page, select Users and groups in the left menu, then click Add user/group.
2. On the Add Assignment page, select users or groups, and click Select.
3. Click Assign. Assigned users/groups display in the list.
