Set up the validation Logic App in the Azure portal (preview)

The Azure Logic Apps validation template tests your System for Cross-Domain Identity Management (SCIM) provisioning integration against the Microsoft Entra provisioning service. This article shows you how to create the resources and deploy the template yourself, so you keep full control over every step.

As an independent software vendor (ISV), you first create an ISV Onboarding app in the Microsoft Entra admin center and start a provisioning job against your SCIM endpoint. Then you deploy the Logic App, grant it the permissions it needs, set its run parameters, and run the tests.

If you'd rather automate this setup, the SCIM onboarding agent creates the same resources through a conversation in about half the time. For a comparison of both approaches, see Validate user provisioning for Microsoft Entra App Gallery.

Prerequisites

• Completion of the prerequisites in Validate user provisioning for Microsoft Entra App Gallery.
• A verified domain in your Microsoft Entra tenant. The template creates test users in this domain and provisions them to your SCIM endpoint.
• Azure PowerShell or the Azure CLI, used to deploy the workflows and assign permissions.

Create the ISV Onboarding app

The Logic App runs its tests through a provisioning job, so you need a working ISV Onboarding app before you deploy the template.

1. Sign in to the Microsoft Entra admin center.

2. Browse to Enterprise applications > New application, and then search for Entra Gallery Provisioning Test App.

   

3. Enter a name for your application, and then select Create.

4. On the application's Overview page, copy the Object ID. This value is the servicePrincipalId parameter for the Logic App.

   

5. Select Provisioning, set Provisioning Mode to Automatic, select New Configuration, enter your OAuth client credentials, and then select Test Connection.

6. Browse to Provisioning > Mappings > Provision Users to create the provisioning job and set up your schema.

   

7. Prune the schema so it contains only the attributes your SCIM endpoint supports. Select Show advanced options, select Edit attribute list, and then update or delete attributes to match your endpoint.

   

   Attributes that your endpoint doesn't support cause the Schema_Discoverability_Test to fail, so keep the list tight. To export the schema, select Review your schema here, and then select Download in the schema editor. For more information about mappings, see Customize attribute mappings.

8. On the Overview page, select Start provisioning. When the job starts without errors, you're ready to deploy the Logic App.

   

Create the Logic App

Create the Logic App in the same tenant as your ISV Onboarding app.

1. Sign in to the Azure portal.

2. Search for Subscriptions, select the subscription you want to use, and then create a resource group for the Logic App.

3. Search for Logic apps, and then select Add > Workflow Service Plan (Standard).

   

4. Enter a name and select the resource group you created.

5. On the Storage tab, set Blob service diagnostics settings to configure now, and then select the default workspace.

6. Leave the remaining settings at their defaults, and then select Review + create.

7. When deployment finishes, open the Logic App.

Deploy the validation workflows

The template ships as a set of workflow definitions in the SCIMReferenceCode repository. You upload them to your Logic App and deploy them with a provided script.

1. Download every file from the StandardLogicApp folder and keep them together in one folder.

2. In your Logic App, select Development Tools > Logic app code view, paste the contents of logicAppTemplate.json, and then select Save.

   

3. Open Azure Cloud Shell or a local terminal, and then upload the downloaded files.

4. On the Logic App Overview page, copy the subscription ID, resource group, and Logic App name.

   

5. Run the deployment script.

   .\Deploy-LogicAppWorkflows.ps1 `
     -SubscriptionId $subscriptionId `
     -ResourceGroup $resourceGroupName `
     -LogicAppName $LogicAppName
   

6. Confirm that all five workflows deployed.

   

The template uses a nested workflow architecture. Orchestrator_Workflow is the entry point and calls the others as child workflows. Initialization_Workflow prepares the test run, and UserTests_Workflow, GroupTests_Workflow, and SCIMTests_Workflow hold the tests. The final section of Orchestrator_Workflow evaluates the results.

Grant permissions to the Logic App

The Logic App calls Microsoft Graph to create, update, and delete test users and groups, and to read provisioning logs. Give it a managed identity and assign the roles those calls require.

1. In your Logic App, select Settings > Identity.

2. On the System assigned tab, set Status to On, select Yes in the confirmation dialog, and then select Save.

   

3. Copy the Object ID of the managed identity. The permissions script needs this value.

   

4. Select Azure role assignments > Add role assignment, and then assign the Owner role.

   

5. Download AssignRolesTOManagedIdentity-LogicApps 1.ps1, set the $miObjId variable to the object ID you copied, and then run the script.

   In Azure Cloud Shell, upload the file first, and then run it from the shell.

When the script finishes, the managed identity holds every role the tests need.

Set the run parameters

Open Orchestrator_Workflow in the designer and select Parameters. Save the Logic App after you update the values.

Parameter	Value
servicePrincipalId	The object ID of the ISV Onboarding app you created.
scimEndpoint	Your SCIM endpoint URL. Don't include feature flags such as aadOptscim062020, even when your ISV Onboarding app uses them. Configure flags only in the Tenant URL field of the provisioning configuration.
scimBearerToken	A bearer token that stays valid for at least 24 hours.
testUserDomain	A verified domain in your tenant. The tests create users in this domain.
defaultUserProperties	One or more sets of user property values. The template picks one set at random to create a user and another to update it, so provide at least two sets.
EnabledTests	A single value that controls which tests run. Use All to run everything, or UserTests, GroupTests, or SCIMTests to run one workflow. You can also name an individual test, such as Create_User_Test.
scimClientId	Your OAuth client ID.
scimClientSecret	Your OAuth client secret.
scimTokenEndpoint	Your OAuth token endpoint.

A run that completes all tests cleans up the test users it created. If a run fails partway through or you cancel it, test user stubs can remain in your tenant. Delete them before you run the tests again.

Run the tests

1. Browse to Workflows > Orchestrator_Workflow.

2. In the designer, select Run.

   

3. Track progress in Run history. A full run takes 60–90 minutes.

   

4. Select a run, select the Final_TestResults action, and then select Show raw outputs to see which tests passed.

To interpret the output and understand which failures block onboarding, see Validate user provisioning for Microsoft Entra App Gallery. If a test fails, see Troubleshoot user provisioning validation.

You can also check a run from the command line with ValidateLogicAppRun-Standard.ps1.

Clean up resources

If you no longer need the validation resources, delete the resource group that contains the Logic App. Deleting the resource group removes the Logic App and its workflows, which stops any further cost.

Keep the resources until Microsoft finishes reviewing your submission. Also delete any test users left behind by an incomplete run, and stop the provisioning job on your ISV Onboarding app when you're done testing.

Next step

Submit your validation results