SCIM Directory Integration

By Rob Nellist

Learn how to configure a SCIM user directory integration

Overview

To configure a SCIM integration between your Identity Provider (IdP) and Kandji, you will need to:

  • Create a new SCIM Directory Integration in Kandji
  • Obtain the SCIM API URL and API token from Kandji to use with your IdP.
  • Access your IdP to create an app integration, map SCIM attributes, and push desired user groups.
After completing the steps in this article, refer to the IdP-specific article for information on how to configure SCIM within your IdP. Below are the currently available IdP support articles. After completing the steps in this article, refer to the IdP-specific article for information on how to configure SCIM within your IdP. Below are the currently available IdP support articles. Kandji's SCIM implementation follows the SCIMv2 specification.

Okta
Entra ID (Azure Active Directory)
OneLogin

Create a New SCIM Directory Integration

  1. Navigate to Integrations in the left-hand navigation bar.
  2. Click Discover integrations in the upper-right of the Integrations page. 
  3. On the SCIM protocol tile, click Add and configure.cR2a2LzQK-T-4SAjEUwAbZE1qjK9VGCTEw
  4. Click Get started. qikoScDAkueWToPti4z0Hy1JCWra5rUxbQ
  5. Enter a unique name for the SCIM integration.
  6. Click Generate token. The SCIM user directory integration uses an HTTP authorization header with a Bearer Token as the authentication method. z4S8DtfEeWwMYzKioL4OCbc_TVmdk9r-gA
  7. Click Copy token.
  8. Confirm that you have copied the token and that you know you will need to change it if you want to see the token details again.
  9. Click Done. You will return to the Integrations page. X_t81brzyBNcsgrI-IQnIiDpFR5EvhgSZw

Obtain the SCIM API URL 

Your SCIM API URL will be in the format of https://subdomain.api.kandji.io/api/v1/scim

  1. Click the ellipse on the SCIM directory integration you just created.
  2. Select View Details.
  3. Copy the SCIM API URL; your identity provider will require this.
  4. Click Close.
    Veib5GkQyIKAIM7AB6hE9fTW5z-NS2eDqQ

SCIM schema and supported attributes

Kandji supports the following SCIM attributes. Refer to these attributes when mapping your SCIM application in your IdP. 

Kandji does not use any attributes that are not in the list below. To limit the attributes sent, please modify the attributes configured in the SCIM app in your IdP.

User attributes

AttributeDescription
Required
userNameUnique identifier for the user, used to authenticate to the service provider
Yes
name.formattedThe user's full name (for example, "John Doe"). This attribute or the displayName attribute is requiredNo
displayName
The user's full name (for example, "John Doe"). This attribute or the name.formatted attribute is requiredYes
title
The user's title, such as "Vice President."No
activeThe user's status within the identity provider. Kandji moves soft-deleted and inactive users to the Archived Users section of Kandji. This attribute is automatically added by the Identity Provider.
Yes
emails.valueThe user's email address as a subattribute of emails. Kandji only stores the first email in the list.
Yes
department
Identifies the name of a department.
No

Group attributes

AttributeDescription
Required
displayNameA human-readable name for the Group.
Yes
membersA list of members in the Group.Yes
When using SCIM to sync users from a directory, the SCIM app automatically sends new information to Kandji, so there is no need for a Sync Now button that you would see when using the native Entra ID (Formerly Azure Active Directory or Google Workspace directory integrations. Each cloud IdP has their own standard for syncing SCIM data. 

Please check with your identity provider's documentation to understand how SCIM sync is configured.