Skip to main content

Set Up SCIM Provisioning with Azure AD

Automatically create, update, and deactivate wxrks user accounts from Azure AD using SCIM, including role mapping and a default Organizational Unit for new users.

SCIM (System for Cross-domain Identity Management) is an open standard for keeping user accounts synced between an identity provider — like Azure Active Directory (Azure AD / Microsoft Entra ID) — and an application such as wxrks. Once it's configured, your IT team can create, update, and deactivate wxrks user accounts directly from Azure AD, instead of a wxrks admin managing every account by hand.
​

💡 Who is this for? This guide is for Account Admin who needs to set up automated user provisioning between Azure AD and wxrks using SCIM within the wxrks platform.

How SCIM provisioning works

SCIM provisioning is separate from wxrks Single Sign-On (SSO) — SSO controls how a user logs in, while SCIM controls whether their wxrks account exists at all, and which role and Organizational Unit it starts in. Many accounts run both together (see Use one Azure application for both SSO and SCIM below), but neither one requires the other.
​

With SCIM provisioning turned on, wxrks can automatically:

  • Create a wxrks account the moment a user is assigned to the application in Azure AD.

  • Update a user's wxrks role when their Azure AD role or group assignment changes.

  • Deactivate the wxrks account when the user is unassigned in Azure AD.

Prerequisites

  • Account Admin access in wxrks.

  • An Azure AD (Microsoft Entra ID) tenant with permission to create and manage Enterprise Applications.

  • An Azure AD plan that supports automatic provisioning to a non-gallery application — check your Azure AD licensing if the Provisioning tab isn't available on your Enterprise Application.

Find your SCIM credentials in wxrks

Go to Settings > Account Settings > SSO, then open the Provisioning sub-tab (see All about Settings for the rest of the Settings menu). This is where wxrks generates the two values Azure AD needs to connect, and where you decide how a provisioned user's role and Organizational Unit are set.
​

Settings, Account Settings, SSO, Provisioning sub-tab, showing SCIM Base URL, Secret Token, Role Mapping, and Default Organizational Unit

  • SCIM Base URL: the wxrks endpoint your identity provider sends SCIM requests to. It's unique to your account — use the copy button next to the field rather than retyping it.

  • Secret Token: click Generate to create the bearer token Azure AD authenticates with. The token is shown only once and can't be retrieved later, so copy it immediately. Generating a new token invalidates the previous one, so update your Azure AD configuration if you ever regenerate it.

  • Role Mapping: pairs a role value your identity provider sends (free text, matching how you named your Azure AD App Roles) with the corresponding wxrks role, such as Account Admin, Project Manager, Vendor, or Client. Add one row per role you want SCIM to assign.

  • Default Organizational Unit: the Organizational Unit every user created via SCIM is placed into.

A status line at the bottom of the tab shows when wxrks last created a user via SCIM, so you can confirm a sync actually reached wxrks without switching over to check Azure AD.

Configure SCIM in Azure AD

Create the Enterprise Application

  1. Go to the Azure portal and open Microsoft Entra ID (Azure AD).

  2. Navigate to Enterprise Applications.

  3. If you don't already have one for wxrks: click + New Application, select Create your own application, give it a name (for example, "wxrks SCIM"), and choose Integrate any other application you don't find in the gallery (non-gallery).

  4. Click Create.

Configure the Provisioning tab

  1. In the Enterprise Application, go to the Provisioning tab and set Provisioning Mode to Automatic.

  2. Paste the SCIM Base URL and Secret Token you copied from wxrks above.

  1. Click Test Connection to confirm Azure AD can reach wxrks.

  2. Configure the attribute mapping:

    • Turn off Provision Microsoft Entra ID Groups — wxrks provisions users, not Azure AD groups directly.

    • Map the externalId attribute to the user's mail field.

    • Add a mapping with Mapping Type: Expression, value AssertiveAppRoleAssignmentsComplex([appRoleAssignments]), and target attribute roles[primary eq "True"].value — this is what feeds the value your Role Mapping rows in wxrks match against.

  3. Click Save.

Assign users and groups in Azure AD

  1. In the Enterprise Application, go to the Users and groups tab.

  2. Click Add user/group and select the users or groups you want to sync to wxrks.

  3. Click Assign.

Map Azure AD roles to wxrks roles

  1. In Azure AD, open App registrations > App roles and create a role value for each wxrks role you want to assign automatically (for example, "admin", "vendor").

  2. Assign users or groups to each role in Azure AD.

  3. Back in wxrks, add a matching row under Role Mapping (Settings > Account Settings > SSO > Provisioning): the Azure AD role value on the left, the corresponding wxrks role on the right.

When a role is assigned to a group in Azure AD, every member of that group receives the mapped wxrks role automatically.
​

Turn on auto-provisioning

  1. In the Enterprise Application's Provisioning tab, set Provisioning Status to On.

  2. Click Save.

Note: The first sync starts immediately. After that, Azure AD checks for changes roughly every 20–40 minutes, depending on how much data it's syncing.

Use one Azure application for both SSO and SCIM

It's possible — and recommended — to use a single Azure AD Enterprise Application for both provisioning (SCIM) and login (SSO) with wxrks. This keeps user access and permissions in sync and gives you one application to manage in Azure instead of two.
​

This article only covers provisioning. For the SSO login setup itself, see wxrks Single Sign-On (SSO).

Other identity providers

wxrks's SCIM endpoint (the SCIM Base URL and Secret Token pair) follows the standard SCIM 2.0 protocol, so it isn't inherently tied to Azure AD. wxrks also supports Okta and OneLogin for SSO alongside Azure AD (see wxrks Single Sign-On (SSO)) — a SCIM-capable Okta or OneLogin app can generally point at the same SCIM Base URL and Secret Token. This article's step-by-step instructions are specific to Azure AD; wxrks doesn't currently publish a dedicated Okta or OneLogin provisioning walkthrough, so reach out to support if you need help adapting these steps to another identity provider.

Related articles

Related Articles
Did this answer your question?