---
title: "SCIM Directory Integration with Microsoft Entra ID"
slug: "scim-directory-integration-with-microsoft-entra-id-formerly-azure-ad"
updated: 2025-08-13T12:35:42Z
published: 2025-08-13T12:35:42Z
canonical: "support.kandji.io/scim-directory-integration-with-microsoft-entra-id-formerly-azure-ad"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Directory Integration with Microsoft Entra ID

### Prerequisites

- Complete the steps outlined in the [SCIM Directory Integration](/v1/docs/scim-directory-integration) support article to set up a new SCIM user directory in your Kandji tenant. You will need to obtain the SCIM access token and API URL.
- Copy and store the token provided outlined in the [SCIM Directory Integration](/v1/docs/scim-directory-integration) article. Once you click Done, the token will not be visible and will be required in a later step.
- Be sure to review the supported user and group attributes listed in the [SCIM Directory Integration](/v1/docs/scim-directory-integration).
- Ensure that nested groups are not included with SCIM as Microsoft does not support this functionality.

### Create the SCIM Integration in Microsoft Entra ID

1. Sign in to the [Microsoft Entra admin center](http://entra.microsoft.com).
2. Open the portal menu and then select **Entra ID**.
3. On the **Entra ID** menu, under select **Enterprise apps**.
4. In the Manage section, select **All applications**.
5. Select **New application.** If you have already created a SAML single sign-on application, you can select that application and add SCIM. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0926AM@2x(1).png)
6. Select **Create your own application**.
7. Give the application a name.
8. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
9. Click **Create**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0931AM@2x(1).png)
10. You will be taken to the Overview page for the newly created app.
11. Under **Manage**, select **Provisioning**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1018AM@2x.png)
12. Click **New Configuration**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1035AM@2x(1).png)
13. Paste the Kandji SCIM API URL that you copied earlier into the **Tenant URL** field.
14. Paste the API token that you copied earlier into the **Secret token** field.
15. Click **Test connection**. You should see a successful test notification.
16. Click **Create**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1124AM.png)
17. Click on the **Provisioning** in the Manage section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1151AM@2x(1).png)
18. Expand the **Mappings** reveal triangle and ensure that both Groups and Users are enabled. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1200PM@2x(1).png)
19. Expand the **Settings** reveal triangle.
20. For **Scope**, choose **Sync only assigned users and groups**.
21. Set the **Provisioning Status** to On.
22. Click **Save**.
23. Click the **X** in the upper-right corner to close the settings.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1204PM@2png.png)

### Assign Users and Groups

1. Under **Manage**, select **Users and groups**.
2. On the menu, select **Add user/group**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1226PM@2x(1).png)
3. On the **Add Assignment** dialog, select the link under **Users and groups**.
4. A list of users and security groups is displayed. You can search for a specific user or group or select multiple users and groups that appear in the list.
5. Select the user(s) and group(s) you would like to be assigned.
6. Click **Select**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1230PM@2x.png)If you see the message below, it means that a free tier is being used, which means you can only add users (not groups) to the SCIM Enterprise App.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/19ss6wpy6dzkplhrwhgu5uwaoukin_pxmw.png)
7. Select **Assign** to finish assigning users and groups to the app.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1235PM@2x(1).png)
8. Confirm that the users and groups you added appear in the **Users and groups** list.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1243PM@2x.png)

### Considerations

#### AD CS Strong Certificate Mapping

When using Active Directory Certificate Services (AD CS), authentication will fail if a certificate can't be strongly mapped to an Active Directory account. Follow the steps below to enable Strong Certificate Mapping for your directory integration.

**Access Your SCIM App**

1. Go to the [Microsoft Entra ID Admin Portal](https://entra.microsoft.com)
2. Navigate to **Applications** > **Enterprise Applications**
3. Find and open the SCIM app you're using with Kandji

**Configure Provisioning**

1. Under **Manage**, click **Provisioning**
2. Under **Manage**, click **Attribute Mapping (Preview)**
3. Select **Provision Microsoft Entra ID Users**

**Add the Security Identifier Attribute**

1. Scroll to the bottom of the page
2. Check the box to show advanced options
3. Click **Edit attribute list for <customappsso>**
4. Add a new field called `onPremisesSecurityIdentifier`, leaving the default type as String.
5. Click **Save**

**Map the Attribute**

1. Go back to the **Attribute Mapping** section
2. Scroll down and click **Add New Mapping**
3. Keep **Mapping type** set to **Direct**
4. Set **Source attribute** to `onPremisesSecurityIdentifier`
5. Set **Target attribute** to `onPremisesSecurityIdentifier`
6. Click **OK**, then **Save**

The `onPremisesSecurityIdentifier` will show up in your user attributes in Kandji after the next [Entra SCIM sync (every 20-40 minutes)](https://learn.microsoft.com/en-us/azure/databricks/admin/users-groups/scim/aad).

#### Syncing

User syncing is one-way, meaning the Microsoft Entra ID SCIM app will send user information to Kandji only when new information is needed.If a user or group is added to the SCIM app in Microsoft Entra ID after the app was created, a sync will happen every 40 minutes (set by Microsoft Entra ID). If you want the sync to happen sooner, you can stop/start the provisioning in the SCIM app on the Microsoft Entra ID. This will not impact existing users/groups in Kandji.

#### Removing Users

- If Entra ID sends sets a use to inactive, the user will be set as inactive in your Kandji tenant.
- If Entra ID deletes a user, the user will be deleted from your Kandji tenant.

#### Blueprint Conditional Logic

If you use [Assignment Map](/v1/docs/advanced-assignment-maps-configuration) conditional logic with groups, you must explicitly add each group you want to have provisioned in Kandji to the SCIM app. Groups will not sync automatically by adding users that happen to be members of the group.

#### Microsoft Device Compliance

If you are using an Entra ID SCIM user directory integration and the Microsoft Device Compliance integration ensure that the user and group attribute mappings for the **externalId** attribute in your SCIM application map to objectId as listed below. The **objectId** is used by Kandji to map user and group resources in Intune.

| User Attribute | User Value |
| --- | --- |
| externalId | objectId |

| **Group Attribute** | **Group Value** |
| --- | --- |
| externalId | objectId |

**Updating user mappings and group mappings**

1. Navigate to the SCIM enterprise application in the [Microsoft Entra admin center](http://entra.microsoft.com).
2. Select **Provisioning**.
3. Select the **Attribute mapping (Preview)** section.
4. If you are updating user attributes, click on **Provision Microsoft Entra ID Users.**
5. If you are updating group attributes, click on **Provision Microsoft Entra ID Groups**.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1250PM@2x.png)
6. Verify that externalId is mapped to objectId.
7. If it is not, click the **Edit** button to the right of the attribute and select objectId from the list.
8. Click **Save**.
9. Click the **X** to go back.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1252PM@2x.png)
10. Once back on the Provisioning overview page, if any values were changed, you need to push the updated values to Kandji immediately by stopping and then starting the provisioning service.
11. Click the **Pause provisioning** button.
12. Click the **Start provisioning** button. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1258PM@x.png)