SCIM Provisioning

Configure SCIM 2.0 with Azure AD (Microsoft Entra ID) to automatically provision and deprovision users in Nirmata Control Hub.

Nirmata Control Hub supports SCIM 2.0 (System for Cross-domain Identity Management) for automatic user lifecycle management. Once configured, users are automatically provisioned and deprovisioned in NCH as they are added or removed in your Identity Provider — eliminating manual user management.

This guide covers configuration with Azure AD (Microsoft Entra ID).

Prerequisites

  • Admin access to Nirmata Control Hub
  • SAML SSO already configured for your Azure AD application
  • A Nirmata API key — see API Keys for how to generate one
  • Admin access to your Azure AD / Microsoft Entra ID tenant

Step 1: Configure Admin Credentials in Azure AD

  1. In the Azure portal, open your Azure AD enterprise application and click Provisioning in the left sidebar.

    Azure AD application sidebar with Provisioning highlighted

  2. Set Provisioning Mode to Automatic.

  3. Under Admin Credentials, fill in the following:

    FieldValue
    Tenant URLhttps://<your-nirmata-domain>/users/api/scim/v2
    Secret TokenYour Nirmata API key

    Provisioning settings showing Tenant URL, Secret Token, and Test Connection fields

  4. Click Test Connection. A green checkmark confirms the credentials are valid.

  5. Click Save.

Step 2: Configure App Roles (Optional — for Admin Access)

The default role assigned to auto-provisioned users in NCH is devops. To assign the admin role to a group, you must first create an admin app role in Azure AD.

Note: Users assigned the admin role will initially be provisioned with the devops role. The role automatically changes to admin the first time they log in to NCH.

Create the Admin App Role

  1. In the Azure portal, go to App registrations and open your application.

  2. Under Manage, click App roles.

    App roles page showing existing roles: admin, User, msiam_access

  3. Click + Create app role and fill in the fields:

    FieldValue
    Display nameadmin
    Allowed member typesBoth (Users/Groups + Applications)
    Valueadmin
    Descriptionadmin
    Enable this app roleChecked

    Create app role form filled with admin role details

  4. Click Apply.

Assign the Role to a Group

  1. Go back to your Azure AD enterprise application (not App registrations).
  2. Under Manage, click Users and groups.
  3. Click + Add user/group, select the group you want to grant admin access to, and assign the admin role created above.
  4. Click Assign.

Step 3: Start Provisioning

  1. In your Azure AD enterprise application, go to Provisioning.
  2. Click Start provisioning.

Azure AD will now synchronize users and groups automatically. The provisioning cycle runs every 40 minutes.