New article
Recently updated
Setting up SCIM for Entra SAML and OIDC
Who is this article for?
Administrators responsible for managing organization security settings in Mazlan Home.
Admin Console access is required.
You can set up SCIM so that Entra creates, updates and deactivates users in Mazlan Home. SCIM is enabled per external identity provider, so Entra must already be set up as your external identity provider in Mazlan Home.
This article outlines how to enable SCIM in Mazlan Home and link it to an app in Entra.
Enabling SCIM in Mazlan Home
To enable SCIM in Mazlan Home:
- Sign in to Mazlan Home.
- Navigate to the Admin Console.
- Go to the Security Center.
- Select SCIM Configuration and Configure.
- In the Identity Providers list, find the Entra IdP and toggle to enable SCIM.
- Once SCIM is enabled, the Client ID and Client Secret are revealed.
- Copy the SCIM base URL, Token endpoint, Scope, Client ID and Client Secret for use in your Okta configuration.
Configuring SCIM in Entra
To configure SCIM in your Entra SAML and OIDC app:
- Sign in to the Microsoft Entra admin center and go to Entra ID > Enterprise apps.
- Select Provisioning in the left panel.
- Click + New configuration
- Set Authentication method to OAuth2 client credentials grant.
- Enter the Tenant URL (the SCIM base URL), OAuth token endpoint, Client identifier, Client secret and Scope copied from Mazlan Home.
- To verify the setup, click Test Connection.
Attribute mapping
The following Entra user profile attributes are synced to Mazlan Home:
| Entra user property | Mazlan Home field | Notes |
|---|---|---|
User principal name (userPrincipalName) |
Username | Required. Cannot be changed through SCIM after the user is created |
First name (givenName) |
First name | Required. |
Last name (surname) |
Last name | Required. |
Email (mail) |
Required. Users with no email in Entra cannot be provisioned. | |
Display name (displayName) |
Display name | Optional. |
Job title (jobTitle) |
Job title | Optional. |
Mobile phone (mobile) |
Mobile number | Optional. Must be in international format (E.164), for example +15551234567. Other formats are rejected. |
| Account enabled | Active | If a user is disabled in Entra, they are deactivated in Mazlan Home, not deleted. |
Preferred language (preferredLanguage) |
Preferred language | Optional. Defaults to en-gb if not sent. Must be a supported language. |
Attributes that are not synced: User type, Authorization info, Company name, Department, Employee ID, Employee type, Employee hire date, Office location, Manager, Sponsors, address fields (Street address, City, State or province, ZIP or postal code, Country or region), Business phone, Fax number, Other emails, Mail nickname, Age group, Consent provided for minor and Usage location. Roles and passwords are also not synced.
Time zone is not sent by Entra, so users are created with the default of Europe/London. All Tenant Administrators and standard Users can update their time zone in Mazlan Home as required.
Important notes
Groups are reserved for future use. Mazlan Home can receive groups and their membership from Entra, but no Ideagen application uses groups yet. Syncing them doesn’t affect user roles, permissions or access, and you don’t need to sync groups to provision users. Groups can only be created, renamed or deleted in Entra, which is the source of truth, so they can’t be changed in Mazlan Home. We’ll share more on how groups map to roles and permissions once applications start using them.
Each new user gets the standard User role, and is assigned your organisation’s default product instances. Tenant Administrators can change roles and instance assignments in Mazlan Home.
- Email must be filled in. Mazlan Home uses email as the primary means of contacting the user. If the user does not have an email, please refer to Handling users without an email address for further guidance.
- Phone numbers must be in E.164 format. Entra does not enforce this, so check your users’ phone numbers before you enable provisioning. Otherwise, the phone number will be left blank.
- Entra sends the object ID as the external ID. This is how Mazlan Home recognises the user on later updates, so customers shouldn’t remap it.
- Sync is not instant. Entra provisions in cycles, so changes can take a while to appear in Mazlan Home. For further information, refer to Understand how Application Provisioning in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn and Find out when a specific user is able to access an app in Microsoft Entra Application Provisioning - Microsoft Entra ID | Microsoft Learn
- Using more than one identity provider. Each IdP has its own SCIM setup and credentials. Usernames must be unique within your organisation. If a second IdP tries to provision a username that is already linked to another IdP, Mazlan Home links that IdP to the existing user.
- Deleting an identity provider. If you delete an identity provider configuration in Mazlan Home, its SCIM credentials are revoked and syncing stops. Users and groups that were already provisioned are not removed.
Further reading
- Setting up Microsoft Entra for SAML-based Single Sign-On (SSO)
- Setting up Microsoft Entra for OIDC-based Single Sign-On (SSO)
- Configuring Single Sign-On (SSO) for Mazlan Home
- Troubleshooting Single-Sign On (SSO) with an external identity provider (IdP)