Skip to main content

Set Up SCIM Provisioning with Azure AD

Automatically create, update, and deactivate wxrks user accounts from Azure AD using SCIM, including role mapping and a default Organizational Unit for new users.

SCIM (System for Cross-domain Identity Management) is an open standard for keeping user accounts synced between an identity provider — like Azure Active Directory (Azure AD / Microsoft Entra ID) — and an application such as wxrks. Once it's configured, your IT team can create, update, and deactivate wxrks user accounts directly from Azure AD, instead of a wxrks admin managing every account by hand.
​

💡 Who is this for? This guide is for Account Admin who needs to set up automated user provisioning between Azure AD and wxrks using SCIM within the wxrks platform.

How SCIM provisioning works

SCIM provisioning is separate from wxrks Single Sign-On (SSO) — SSO controls how a user logs in, while SCIM controls whether their wxrks account exists at all, and which role and Organizational Unit it starts in. Many accounts run both together (see Use one Azure application for both SSO and SCIM below), but neither one requires the other.
​

With SCIM provisioning turned on, wxrks can automatically:

  • Create a wxrks account the moment a user is assigned to the application in Azure AD.

  • Add a wxrks role when a role is assigned in Azure AD. Removing a role in Azure AD does not remove it in wxrks; remove it in People > Users.

  • Deactivate the wxrks account when the user is unassigned in Azure AD.

Prerequisites

  • Account Admin access in wxrks.

  • An Azure AD (Microsoft Entra ID) tenant with permission to create and manage Enterprise Applications.

  • An Azure AD plan that supports automatic provisioning to a non-gallery application — check your Azure AD licensing if the Provisioning tab isn't available on your Enterprise Application.

Find your SCIM credentials in wxrks

Go to Settings > Account Settings > Identity & Security, open the User Provisioning tab, then expand the SCIM Provisioning section (see All about Settings for the rest of the Settings menu). This is where wxrks generates the two values Azure AD needs to connect, and where you decide how a provisioned user's role and Organizational Unit are set.
​

Settings > Account Settings > Identity & Security, User Provisioning tab with the SCIM Provisioning section expanded: SCIM Base URL with copy button, Secret Token with copy and Generate buttons, Role Mapping row, Default Organizational Unit selector, Save SCIM Settings button and the Last user created status line; a collapsed SAML JIT Provisioning section below

  • SCIM Base URL: the wxrks endpoint your identity provider sends SCIM requests to. It's unique to your account — use the copy button next to the field rather than retyping it.

  • Secret Token: click Generate to create the bearer token Azure AD authenticates with. The token is shown only once and can't be retrieved later, so copy it immediately. Generating a new token invalidates the previous one, so update your Azure AD configuration if you ever regenerate it.

  • Role Mapping: pairs a role value your identity provider sends (free text, matching how you named your Azure AD App Roles) with the corresponding wxrks role, such as Account Admin, Project Manager, Vendor, or Client. Add one row per role you want SCIM to assign.

  • Default Organizational Unit: the Organizational Unit every user created via SCIM is placed into.

Changes to Role Mapping and Default Organizational Unit apply only after you click Save SCIM Settings.

A status line at the bottom of the SCIM Provisioning section shows when wxrks last created a user via SCIM, so you can confirm a sync actually reached wxrks without switching over to check Azure AD.

Configure SCIM in Azure AD

Create the Enterprise Application

  1. Go to the Azure portal and open Microsoft Entra ID (Azure AD).

  2. Navigate to Enterprise Applications.

  3. If you don't already have one for wxrks: click + New Application, select Create your own application, give it a name (for example, "wxrks SCIM"), and choose Integrate any other application you don't find in the gallery (non-gallery).

  4. Click Create.

Configure the Provisioning tab

  1. In the Enterprise Application, go to the Provisioning tab and set Provisioning Mode to Automatic.

  2. Paste the SCIM Base URL and Secret Token you copied from wxrks above.

wxrks sidebar with Settings > Account Settings and Identity & Security highlighted, the User Provisioning tab highlighted, and the expanded SCIM Provisioning section header highlighted, showing where the SCIM Base URL and Secret Token are found

  1. Click Test Connection to confirm Azure AD can reach wxrks.

  2. Configure the attribute mapping:

    • Turn off Provision Microsoft Entra ID Groups — wxrks provisions users, not Azure AD groups directly.

    • Map the externalId attribute to the user's mail field. This mapping is optional: wxrks matches users by their primary email and accepts but ignores externalId.

    • Add a mapping with Mapping Type: Expression, value AssertiveAppRoleAssignmentsComplex([appRoleAssignments]), and target attribute roles[primary eq "True"].value — this is what feeds the value your Role Mapping rows in wxrks match against.

  3. Click Save.

Assign users and groups in Azure AD

  1. In the Enterprise Application, go to the Users and groups tab.

  2. Click Add user/group and select the users or groups you want to sync to wxrks.

  3. Click Assign.

Map Azure AD roles to wxrks roles

  1. In Azure AD, open App registrations > App roles and create a role value for each wxrks role you want to assign automatically (for example, "admin", "vendor").

  2. Assign users or groups to each role in Azure AD.

  3. Back in wxrks, add a matching row under Role Mapping (Settings > Account Settings > Identity & Security > User Provisioning, SCIM Provisioning section): the Azure AD role value on the left, the corresponding wxrks role on the right, then click Save SCIM Settings.

When a role is assigned to a group in Azure AD, every member of that group receives the mapped wxrks role automatically.
​

SCIM Provisioning Role Mapping with two rows: identity provider role values ADMIN and VENDOR (highlighted) mapped to the wxrks Account Admin and Vendor roles, plus the Default Organizational Unit selector and the Save SCIM Settings button

Turn on auto-provisioning

  1. In the Enterprise Application's Provisioning tab, set Provisioning Status to On.

  2. Click Save.

Note: The first sync starts immediately. After that, Azure AD checks for changes roughly every 20–40 minutes, depending on how much data it's syncing.

Use one Azure application for both SSO and SCIM

It's possible — and recommended — to use a single Azure AD Enterprise Application for both provisioning (SCIM) and login (SSO) with wxrks. This keeps user access and permissions in sync and gives you one application to manage in Azure instead of two.
​

This article only covers provisioning. For the SSO login setup itself, see wxrks Single Sign-On (SSO).

Other identity providers

wxrks's SCIM endpoint (the SCIM Base URL and Secret Token pair) follows the standard SCIM 2.0 protocol, so it isn't inherently tied to Azure AD. wxrks supports SSO with SAML 2.0 and OIDC (Okta, OneLogin and Microsoft Entra ID) — see Set up SAML 2.0 single sign-on and wxrks Single Sign-On (SSO). This article's step-by-step instructions are specific to Azure AD. For Okta and OneLogin, follow Set up SCIM provisioning with Okta or Set up SCIM provisioning with OneLogin. For another identity provider, reach out to support if you need help adapting these steps.

For every supported attribute and operation, see SCIM user provisioning reference.

Related articles

Related Articles
Did this answer your question?