Entra ID - provision user administrative roles alongside app roles using SCIM

Question

Entra ID - provision user administrative roles alongside app roles using SCIM

Florin Dragos 25

I have a SCIM integration that provisions users from EntraID to my SCIM application. I've followed the instructions provided in Provisioning a role to a SCIM app to make sure it provisions any roles that are assigned to a user. Unfortunately, this only provisions the roles that are assigned for that specific application.

Is there a way to read all roles (Administrative Roles) that user has assigned in EntraID, not just the roles assigned for the SCIM app itself?

Thanks!

William Nieto 545 Reputation points

2024-06-21T14:25:20.2966667+00:00

To retrieve all roles, including administrative roles, assigned to a user in EntraID through your SCIM integration, you'll need to:

Check EntraID's API Capabilities:

Verify if EntraID provides APIs that expose all roles assigned to a user, beyond those specifically tied to the SCIM application. This may involve querying EntraID’s user management or role assignment APIs directly.

Extend SCIM Implementation:

Extend your SCIM integration to accommodate additional attributes or custom schema to handle administrative roles from EntraID. Ensure your integration logic supports fetching and mapping these roles correctly.

Integration Design:

Configure your SCIM integration to accurately synchronize all assigned roles, including administrative roles, to your application’s user management system. Integrate EntraID’s role retrieval APIs if available to ensure comprehensive role provisioning.

By following these steps, you can enhance your SCIM implementation to effectively manage and synchronize all roles assigned to users within EntraID, providing comprehensive visibility and provisioning across your applications.

If this answer solves your issue, please vote for it so other community members know that this is a quality answer.

Answer accepted by question author

0 additional answers

Your answer

William Nieto 545 Reputation points

2024-06-21T14:25:20.2966667+00:00

To retrieve all roles, including administrative roles, assigned to a user in EntraID through your SCIM integration, you'll need to:

Check EntraID's API Capabilities:

Verify if EntraID provides APIs that expose all roles assigned to a user, beyond those specifically tied to the SCIM application. This may involve querying EntraID’s user management or role assignment APIs directly.

Extend SCIM Implementation:

Extend your SCIM integration to accommodate additional attributes or custom schema to handle administrative roles from EntraID. Ensure your integration logic supports fetching and mapping these roles correctly.

Integration Design:

Configure your SCIM integration to accurately synchronize all assigned roles, including administrative roles, to your application’s user management system. Integrate EntraID’s role retrieval APIs if available to ensure comprehensive role provisioning.

By following these steps, you can enhance your SCIM implementation to effectively manage and synchronize all roles assigned to users within EntraID, providing comprehensive visibility and provisioning across your applications.

If this answer solves your issue, please vote for it so other community members know that this is a quality answer.

Answer 1

Is there a way to read all roles (Administrative Roles) that user has assigned in EntraID, not just the roles assigned for the SCIM app itself?

No.

Most applications do not care about the administrative directory roles (Global Admin, etc..) assigned to users in Entra ID. Applications have their own concepts of entitlements. Those app-specific roles are usually represented on the Enterprise Application object in Entra ID, where they can be assigned to users, and SSO + Provisioning can both then leverage those app-specific assignments to send role/entitlement data in SSO claims or SCIM create/update payloads.

If your application does have a reason to care about the Entra ID directory roles assigned to users, it will need to make calls to Microsoft Graph API to obtain that data, as it is not possible to use a user's assigned Entra ID directory roles as a data source with our provisioning service at this time.

Florin Dragos 25 Reputation points

2024-06-25T10:08:49.9+00:00

Thank you! This basically confirms my own findings!

Share via

Entra ID - provision user administrative roles alongside app roles using SCIM

0 additional answers

Your answer