Edit

Configure Secure Cloud User Integration for automatic user provisioning with Microsoft Entra ID

In this tutorial, you learn how to configure automatic user provisioning between Microsoft Entra ID and Secure Cloud. When configured, Microsoft Entra ID automatically creates, updates, and deprovisions users and groups in Secure Cloud using the SCIM 2.0 protocol. This reduces administrative overhead and helps ensure user access remains synchronized between Microsoft Entra ID and Secure Cloud.

For important details about what the service does, how it works, and frequently asked questions, see Automate user provisioning and deprovisioning to SaaS applications with Microsoft Entra ID.

Capabilities supported

  • Create users and groups in Secure Cloud.
  • Update user and group attributes in Secure Cloud.
  • Synchronize group memberships in Secure Cloud.
  • Deprovision users and groups in Secure Cloud.
  • Sign in to Secure Cloud with Microsoft Entra ID (single sign-on).
  • Supports OAuth 2.0 client credentials authentication for provisioning from Microsoft Entra ID to Secure Cloud.

Prerequisites

Before you begin, ensure that you have the following prerequisites:

Important

The Secure Cloud User Integration enterprise application is created during the initial Microsoft Entra sign-in and consent process. Please follow the steps in sequence begining with Step 1, to make sure that before you configure automatic provisioning, the single sign-on setup and consent process in Step 3 is completed, to ensure that the enterprise application exists in your Microsoft Entra tenant.

Step 1: Plan your provisioning deployment

  1. Learn about how the provisioning service works.
  2. Determine who is in scope for provisioning.
  3. Determine what data to map between Microsoft Entra ID and Secure Cloud User Integration.

Step 2: Configure Secure Cloud User Integration to support provisioning with Microsoft Entra ID

  1. Sign in to the Secure Cloud User Integration admin portal as an administrator.

  2. Browse to Service Administration > Account Management > User Integration > Import Plans.

    Screenshot of the User Integration page with Import Plans highlighted.

  3. Select New Microsoft Entra Plan.

    Screenshot of the User Integration Import Plans section with New Microsoft Entra Plan highlighted.

  4. Under Provisioning Settings, turn on Enable Microsoft Entra Provisioning.

    Screenshot of the Provisioning Settings section with Enable Microsoft Entra Provisioning turned on.

  5. Under Services, select the services to assign to provisioned users. These services are assigned only to newly provisioned users. Existing Secure Cloud User Integration users aren't changed by this setting.

    Screenshot of the Services section of the Microsoft Entra plan.

  6. Optionally, under Notifications, select Send Welcome Email.

    Screenshot of the Notifications section of the Microsoft Entra plan with Send Welcome Email.

  7. Select Save. The Plan Details - Microsoft Entra Provisioning Plan page opens.

    Screenshot of the Plan Details - Microsoft Entra Provisioning Plan page.

  8. In the Microsoft Entra Admin Center section, copy the following values. You enter them in Microsoft Entra ID in Step 5.

    Secure Cloud User Integration value Microsoft Entra field
    Tenant URL, for example https://api.appriver.com/scim/api Tenant URL
    Token Endpoint, for example https://account.appriver.com/identity/connect/token OAuth token endpoint
    Client ID Client identifier
    Client Secret (select Show to reveal it) Client secret

    Screenshot of the Microsoft Entra Admin Center section with the Tenant URL, Token Endpoint, Client ID, and Client Secret fields.

Important

Treat the client secret as a secret. Store it securely, and don't include a real client ID or client secret in documentation, screenshots, email, or support requests.

Step 3: Add Secure Cloud User Integration to your Microsoft Entra tenant

The Secure Cloud User Integration enterprise application uses consent-based onboarding. The application is created in your Microsoft Entra tenant when an administrator first signs in to Secure Cloud User Integration with Microsoft Entra ID and grants consent. Complete this step to enable single sign-on and create the application that you configure for provisioning in Step 5.

Enable Microsoft Entra authentication

  1. In the Secure Cloud User Integration admin portal, browse to Service Administration > Account Management > User Integration > Authentication.

    Screenshot of the User Integration page with Authentication highlighted.

  2. In the Authentication Type list, select Microsoft Entra SSO.

    Screenshot of the Authentication Type list with Microsoft Entra SSO selected.

  3. Under Configuration, turn on Enable Microsoft Entra Authentication.

    Screenshot of the Configuration section with Enable Microsoft Entra Authentication turned on.

  4. Optionally, turn on Fallback User Password during initial setup. This option provides an alternate sign-in method if Microsoft Entra authentication is unavailable.

    • If Fallback User Password is on, users can select Sign in with Microsoft, or sign in with their Secure Cloud User Integration credentials or LDAP credentials, if LDAP authentication is configured.
    • If Fallback User Password is off, users are redirected to Microsoft Entra ID after they enter their username, and Secure Cloud User Integration or LDAP credentials can't be used.

    Screenshot of the Fallback User Password option.

  5. Select Save.

  1. Sign out of Secure Cloud User Integration, or use a different browser, and go to the Secure Cloud User Integration sign-in page.

    Screenshot of the Secure Cloud User Integration sign-in page.

  2. Enter the username of a Secure Cloud User Integration account whose email address matches a Microsoft Entra account that can grant consent to applications in the tenant, and then select Continue.

    Screenshot of the sign-in page with Continue highlighted.

  3. If Fallback User Password is on, select Sign in with Microsoft under Use your organization's digital identity. If it's off, you're redirected to Microsoft Entra ID automatically.

    Screenshot of the sign-in page with Sign in with Microsoft highlighted.

  4. Sign in with your Microsoft Entra credentials and complete any multifactor authentication prompts.

  5. On the Permissions requested page, review the requested permissions.

    Screenshot of the Permissions requested page.

  6. Optionally, select Consent on behalf of your organization so that users aren't prompted for consent at their first sign-in. For more information, see Overview of user and admin consent.

    Screenshot of the Permissions requested page with Consent on behalf of your organization selected.

  7. Select Accept. Microsoft Entra ID creates the Secure Cloud User Integration enterprise application in your tenant and redirects you back to Secure Cloud User Integration, where you're signed in.

  8. To confirm, sign in to the Microsoft Entra admin center, browse to Entra ID > Enterprise apps, and search for Secure Cloud User Integration.

    Screenshot of the Enterprise applications list with Secure Cloud User Integration highlighted.

Step 4: Define who is in scope for provisioning

The Microsoft Entra provisioning service allows you to scope who is provisioned based on assignment to the application, or based on attributes of the user or group. If you choose to scope who is provisioned to your app based on assignment, you can use the steps to assign users and groups to the application. If you choose to scope who is provisioned based solely on attributes of the user or group, you can use a scoping filter.

  • Start small. Test with a small set of users and groups before rolling out to everyone. When scope for provisioning is set to assigned users and groups, you can control this by assigning one or two users or groups to the app. When scope is set to all users and groups, you can specify an attribute based scoping filter.

  • If you need extra roles, you can update the application manifest to add new roles.

Step 5: Configure automatic user provisioning to Secure Cloud User Integration

This section guides you through connecting Microsoft Entra ID to the Secure Cloud User Integration provisioning API. The Microsoft Entra provisioning service uses this connection to create, update, and disable assigned users and groups in Secure Cloud User Integration.

Configure automatic user provisioning for Secure Cloud User Integration in Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  2. Browse to Entra ID > Enterprise apps.

    Screenshot of the Enterprise applications page.

  3. In the applications list, select Secure Cloud User Integration.

  4. Select Provisioning.

    Screenshot of the Manage menu with Provisioning highlighted.

  5. Select New configuration.

    Screenshot of the New configuration option on the Provisioning page.

  6. Enter the values that you copied in Step 2:

    Microsoft Entra field Value
    Tenant URL Secure Cloud User Integration Tenant URL
    OAuth token endpoint Secure Cloud User Integration Token Endpoint
    Client identifier Secure Cloud User Integration Client ID
    Client secret Secure Cloud User Integration Client Secret

  7. Select Test Connection to ensure that Microsoft Entra ID can connect to Secure Cloud User Integration. If the connection fails, confirm that the values match those shown in the Secure Cloud User Integration provisioning plan and that Enable Microsoft Entra Provisioning is turned on.

  8. Select Create.

  9. On the Provisioning > Overview page, select Properties, and then edit Settings.

  10. In Notification Email, enter an email address to receive provisioning error notifications, and enable email notification when a failure occurs.

  11. Enable Prevent accidental deletion and set an appropriate threshold.

  12. Select Apply.

    Screenshot of the provisioning properties page.

  13. Select Attribute Mapping, and then select users.

  14. Review the user attributes that are synchronized from Microsoft Entra ID to Secure Cloud User Integration. The default user matching attribute is userName, sourced from userPrincipalName. Attributes selected as Matching properties are used to match user accounts in Secure Cloud User Integration for update operations. If you change the matching target attribute, ensure that the Secure Cloud User Integration API supports filtering users by that attribute. Select Save to commit any changes.

    Attribute Type Supported for matching/filtering Required by Secure Cloud User Integration Notes
    userName String Yes Yes Mapped from userPrincipalName.
    active Boolean Mapped from Switch([IsSoftDeleted], , "False", "True", "True", "False").
    displayName String Mapped from displayName.
    title String Mapped from jobTitle.
    emails[type eq "work"].value String Mapped from mail.
    name.givenName String Mapped from givenName.
    name.familyName String Mapped from surname.
    externalId String Mapped from mailNickname.
    phoneNumbers[type eq "work"].value String Mapped from telephoneNumber.
    phoneNumbers[type eq "mobile"].value String Mapped from mobile.
    phoneNumbers[type eq "fax"].value String Mapped from facsimileTelephoneNumber.
    addresses[type eq "work"].streetAddress String Mapped from streetAddress.
    addresses[type eq "work"].locality String Mapped from city.
    addresses[type eq "work"].region String Mapped from state.
    addresses[type eq "work"].postalCode String Mapped from postalCode.
    addresses[type eq "work"].country String Mapped from country.
    urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department String Mapped from department.
    urn:ietf:params:scim:schemas:extension:opentext:2.0:Mailbox:proxyAddresses String Mapped from Join(",", [proxyAddresses]).

  15. Select Attribute Mapping, and then select groups.

  16. Review the group attributes that are synchronized from Microsoft Entra ID to Secure Cloud User Integration. The default group matching attribute is displayName. Attributes selected as Matching properties are used to match groups in Secure Cloud User Integration for update operations. Select Save to commit any changes.

    Attribute Type Supported for matching/filtering Required by Secure Cloud User Integration Notes
    displayName String Yes Yes Mapped from displayName.
    members Reference Mapped from members.
    externalId String Mapped from objectId.
    urn:ietf:params:scim:schemas:extension:opentext:2.0:Mailbox:proxyAddresses String Mapped from Join(",", [proxyAddresses]).

  17. Set Scope to Sync only assigned users and groups (recommended). If you use Sync all users and groups, use scoping filters to limit which objects are provisioned. To configure scoping filters, follow the instructions in Attribute-based application provisioning with scoping filters.

  18. Use on-demand provisioning to validate initial synchronization with a small number of test users before deploying more broadly. Include a disposable test account for the deprovisioning test.

  19. Keep the provisioning scope limited to your test users and groups, and select Start Provisioning on the Overview page.

  20. Update a test user's attributes in Microsoft Entra ID and verify that the changes synchronize to Secure Cloud User Integration.

  21. Remove the disposable test user's application assignment and allow the appropriate provisioning cycle to process the assignment removal. Verify that the user is deprovisioned according to the configured provisioning behavior. The initial on-demand provisioning operation alone doesn't validate deprovisioning.

  22. Complete these validation checks before expanding the provisioning scope for broader deployment.

Step 6: Monitor your deployment

Once you configure provisioning, use the following resources to monitor your deployment:

  1. Use the provisioning logs to determine which users are provisioned successfully or unsuccessfully
  2. Check the progress bar to see the status of the provisioning cycle and how close it's to completion
  3. If the provisioning configuration seems to be in an unhealthy state, the application goes into quarantine. Learn more about quarantine states the application provisioning quarantine status article.

To confirm the results in Secure Cloud User Integration, browse to Service Administration > Users > User Management to check provisioned users, and to Service Administration > Users > User Groups to check provisioned groups and memberships.

Also verify the expected attributes and group memberships of test users before deploying more broadly.

Screenshot of the Users page with User Management highlighted.

Screenshot of the Users page with User Groups highlighted.

Troubleshooting

Secure Cloud User Integration doesn't appear in Enterprise apps

  • Cause: The enterprise application is created only after an administrator signs in with Microsoft Entra ID and grants consent.
  • Resolution:
    1. Repeat the sign-in in Step 3.
    2. Confirm that you selected Accept on the Permissions requested page and were redirected back to Secure Cloud User Integration.
  • Symptom: Users see a message that administrator approval is required.
  • Resolution: Check your tenant's consent settings, or ask a Cloud Application Administrator to grant consent on behalf of the organization. For more information, see Overview of user and admin consent.

A user can't sign in

  • Resolution: Verify that the user exists in Secure Cloud User Integration, that the user's email address matches the Microsoft Entra account, and that Enable Microsoft Entra Authentication is turned on.

Test Connection fails

  • Resolution:
    1. Confirm that the Tenant URL, token endpoint, client ID, and client secret were copied exactly from the Secure Cloud User Integration provisioning plan.
    2. Confirm that Enable Microsoft Entra Provisioning is turned on in the plan.
    3. Confirm that network access to the Secure Cloud User Integration SCIM endpoint is available.

Users or groups aren't provisioned

  • Resolution:
    1. Confirm that provisioning status is set to On.
    2. Confirm that the users or groups are assigned directly to the Secure Cloud User Integration application and are in the configured scope.
    3. Check the provisioning logs for errors.

Known limitations

  • Microsoft Entra ID doesn't provision users who are members of an assigned group only through nested groups. Assign all required users, or the groups that directly contain them, to the application.
  • Services selected in the Secure Cloud User Integration provisioning plan are assigned only to newly provisioned users. Existing users aren't changed.

Additional resources

Related content

  • Last updated on