SCIM Setup for Azure

If your organization uses Azure to manage user identify information, Fleetio offers an integration to set up the System for Cross-domain Identity Management, or SCIM. This article covers how to successfully set up SCIM to start managing user lifecycles.

Add the Integration

In order to set up SCIM, you need to have already set up SAML in Fleetio.

Set Up the Connection

1. Before going to Azure, go to your Fleetio Account Menu and select Settings.

2. In the Settings sidebar, click SAML Connectors in the Integrations section.
3. Hover over your SAML connector, click the More Actions Button, then select Edit.
4. Scroll down to the SCIM Settings section and copy the SCIM Base URL and SCIM Token values.

5. Now, in Azure, click on Provisioning, and you’ll be taken to a welcome screen. Click Get Started.

6. Select Automatic in the Provisioning Mode drop-down menu then fill in Tenant URL with Fleetio’s SCIM Base URL and Secret Token with Fleetio’s SCIM Token. These are the values you copied in step 3.

7. Click Test Connection to verify that you’ve entered the information correctly.

Add the Custom Attributes

1. Go to Provisioning and click Edit Attribute Mappings.
2. Under the Mappings drop-down, click on Provision Azure Active Directory Users.

3. Click the Show advanced options checkbox, and then click Edit attribute list for customappsso.

4. Add the following new attributes (all are String types):

5. If you would like to customize the record sets of your users, add the following attributes:

6. If you are utilizing our Shop Network, you can provision Auto Integrate Users using the following namespaces:

• urn:ietf:params:scim:schemas:extension:fleetio:2.0:User:auto_integrate_roles is a String that accepts the following values. If assigning multiple roles to a user, combine them with a string. E.g. client_admin, client_view_ro, client_manual_ro_approval
  • client_admin
  • client_user_admin
  • client_view_ro
  • client_manual_ro_approval
  • no_access
• urn:ietf:params:scim:schemas:extension:fleetio:2.0:User:auto_integrate_max_auth_limit is a Number value. If you wanted an authorization limit of $1,000, you would supply 1000, not 1,000

7. Click Save after adding these custom attributes.

Set Up the Attribute Mappings

After saving the attribute list, you will be taken back to the Attribute Mapping screen. Here, you will set up what values Azure will send Fleetio when provisioning the user. Below is a description of what the attribute means in Fleetio and what values are accepted:

(All attributes are prefixed with urn:ietf:params:scim:schemas:extension:fleetio:2.0:User:)

All regular users are created using the default record sets on your account. If you would like each user to have a different record set, Fleetio accepts the following attributes:

To map an attribute in Azure to Fleetio:

1. Click Add New Mapping to bring up the form.
2. Select the appropriate Mapping type. In this document, we will be hard coding a value for demonstration purposes. You can read more about this in Microsoft’s Azure docs.
3. In this example, we will map the user_type attribute to the value regular. This means all users provisioned from Azure will be regular users. Select urn:ietf:params:scim:schemas:extension:fleetio:2.0:User:user_type as the Target attribute.
4. When complete, click OK.

5. Now we will create a mapping for role_name. Click Add New Mapping again, and select urn:ietf:params:scim:schemas:extension:fleetio:2.0:User:role_name as the Target attribute. When regular users are provisioned in Fleetio, we need to assign them a role. The role name can be obtained from your Fleetio Account Settings. Note that these values are case-sensitive.

6. Finally, we’ll assign our users to a group in Fleetio. Click Add New Mapping once more, and select urn:ietf:params:scim:schemas:extension:fleetio:2.0:User:group_name as the Target attribute. Here, we’re telling Fleetio that all users provisioned will be under the Birmingham group.

7. Click Save at the top of the page to save the attribute mappings.

If you would like to customize the user’s record sets, then repeat the same process for all the record set attributes. If you don’t provide a record set name, Fleetio will use the default record sets under your account settings.

Testing Your Setup

1. To make sure everything is working properly, click Provision on demand and select a user in your directory to sync over to Fleetio.
2. If everything is working properly, you should see the screenshot below. You may need to assign the user to your application first.

3. Now that you’ve verified that everything is properly setup, you can start provisioning your AD users into Fleetio.

For more information or for advanced configuration, reference Microsoft’s Azure/SCIM website.