Create Entra Scoping Filter based on AD Group Name

Cobb,Dave 0

I have an Azure Entra ID Application setup for managing OIDC SSO & SCIM Provisioning with GitHub Enterprise Cloud.

Is there any way I can use Scoping Filters to automatically add AD groups to SCIM based solely on the name of the AD Group?

i.e.
Group Name starts with "github-'"
or
Group Name starts with "github-'" and ends with "-maintainer"

Raja Pothuraju 2,020 Reputation points Microsoft Vendor

2024-05-31T13:15:27.72+00:00

Hello @Cobb,Dave,

Thank you for posting your query on Microsoft Q&A.

Based on my understanding, you were inquiring about setting up an Entra ID application to manage OIDC SSO & SCIM provisioning with GitHub Enterprise Cloud, specifically seeking a method to automatically add AD groups to SCIM solely based on the name of the AD Group.

However, according to the documentation provided below, it appears that the GitHub Enterprise Cloud - Enterprise Account application does not support enabling automatic SCIM provisioning
https://learn.microsoft.com/en-us/entra/identity/saas-apps/github-enterprise-cloud-enterprise-account-tutorial#scenario-description

The GitHub Enterprise Cloud - Enterprise Account application does not support enabling automatic SCIM provisioning. If you need to setup provisioning for your GitHub Enterprise Cloud environment, SAML must be configured at the organization level and the GitHub Enterprise Cloud - Organization Microsoft Entra application must be used instead. If you are setting up a SAML and SCIM provisioning integration for an enterprise that is enabled for Enterprise Managed Users (EMUs), then you must use the GitHub Enterprise Managed User Microsoft Entra application for SAML/Provisioning integrations or the GitHub Enterprise Managed User (OIDC) Microsoft Entra application for OIDC/Provisioning integrations.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Thanks,
Raja Pothuraju.
Cobb,Dave 0 Reputation points

2024-05-31T13:26:21.0533333+00:00
@Raja Pothuraju your information is incorrect... GitHub Enterprise Cloud does support SCIM via Entra, and I have that fully setup and working (link) .

I still have the question... can I add groups to the SCIM solely based on their group name using a scoping filter or any other means?
Cobb,Dave 0 Reputation points

2024-06-17T14:04:54.4833333+00:00

I've found you CAN create a scoping filter using the DisplayName of group.

Can you tell me how I can expand on this to specify a SCIM ROLE for the users that fall into this scoping filter by their membership in a matching named AD group?

1 answer

Raja Pothuraju 2,020 Reputation points Microsoft Vendor

2024-06-06T15:44:53.7+00:00

Hello @Cobb,Dave,

Yes, you were right. Previously, I was referring to a different gallery application, namely GitHub Enterprise Cloud - Enterprise Account. The GitHub Enterprise Cloud does support SCIM via Entra.

I still have the question... can I add groups to the SCIM solely based on their group name using a scoping filter or any other means?

This is not possible with our service at this time. Mappings and expressions can only be built using attributes contained on the object in question. This means that you can only use attributes on the user object when provisioning a user. Membership of a group is a property of the group object, not the user, and there is no way in our provisioning service to make a mapping that leverages group membership of a user in Azure AD to flow a value in a mapping from source -> target, with the sole exception of the roles attribute via role assignment in the Users and Groups blade of the Enterprise App.
Please sign in to rate this answer.
Raja Pothuraju 2,020 Reputation points Microsoft Vendor

2024-06-10T18:14:59.8433333+00:00

Hello @Cobb,Dave,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Share via

Create Entra Scoping Filter based on AD Group Name

1 answer