SCIM with Microsoft Entra

Create API Key in Vertesia

Sign in to Vertesia as an account administrator and select the project that will own the key.

• Go to Settings → API Keys → New.
• Name the key Microsoft Entra.
• Enable Organization SCIM provisioning. This sets the key's role to admin.
• Create the key and copy its one-time secret into Microsoft Entra's provisioning token field.

An ordinary project admin key cannot manage SCIM groups or provision users. To reuse an existing admin secret key, an account administrator can select Enable SCIM in the API key list. This keeps its role, secret, and owning project unchanged. Once enabled, the designation cannot be removed. Only account administrators can manage designated keys. Disable or delete the key in Settings to revoke its SCIM management authority.

SCIM group operations and user writes check the current key state on every request. User list and lookup endpoints retain the existing account_read permission policy: disabling or deleting a key does not immediately invalidate that read permission in an already-issued JWT. Those reads remain subject to normal token validation and expiry. Requests already authorized may finish.

Create App in Microsoft Entra

Create an “Enterprise Application” in Microsoft Entra:

• Select "New application"
• Select "Create your own application" from Microsoft Entra Gallery
• Name the app e.g. "Vertesia"
• Select "Integrate any other application you don't find in the gallery (Non-gallery)"

Add user/groups:→

• Go to "Users and groups" → "Add user/group"

Provision User and Groups

Provisioning

• Go to "Manage" → "Provisioning" → "New configuration"
• Tenant URL: https://api.vertesia.io/api/v1/iam/scim/v2/
• Token: VERTESIA_API_KEY

Provision on demand or as a job

• "Get Started" → "Map attributes (optional) or "Manage" → "Attribute mapping"
• Remove all except below for users
  • Consider disabling delete

• Remove all except below for groups

• "Provision on demand" or "Start provisioning"

After users are provisioned as Vertesia org and group members, the group can be:

• assigned a role on a project
• assigned to an application

Additional Information

• Use the consumer role for custom apps with end users.
• Existing non-SCIM users provisioned through SCIM will be updated to SCIM users.
• User org role will be set to member.

Troubleshooting in Micrsoft Entra

Access the SCIM log in Microsoft Entra:

• Go to “Monitor” → “Provisioning logs”
• Go to “Monitor” → “Audit logs”