---
title: "SCIM Provisioning"
description: "Configure SCIM 2.0 with Azure AD (Microsoft Entra ID) to automatically provision and deprovision users in Nirmata Control Hub."
diataxis: how-to
applies_to:
  product: "nirmata-control-hub"
audience: ["admin"]
last_updated: 2026-06-03
url: https://docs.nirmata.io/docs/control-hub/settings/scim/
---


Nirmata Control Hub supports **SCIM 2.0** (System for Cross-domain Identity Management) for automatic user lifecycle management. Once configured, users are automatically provisioned and deprovisioned in NCH as they are added or removed in your Identity Provider — eliminating manual user management.

This guide covers configuration with **Azure AD (Microsoft Entra ID)**.

---

## Prerequisites

- Admin access to Nirmata Control Hub
- SAML SSO already configured for your Azure AD application
- A Nirmata API key — see [API Keys](/docs/nctl/api-keys/) for how to generate one
- Admin access to your Azure AD / Microsoft Entra ID tenant

---

## Step 1: Configure Admin Credentials in Azure AD

1. In the Azure portal, open your Azure AD enterprise application and click **Provisioning** in the left sidebar.

   ![Azure AD application sidebar with Provisioning highlighted](/images/azure-ad-provisioning-nav.png)

2. Set **Provisioning Mode** to **Automatic**.

3. Under **Admin Credentials**, fill in the following:

   | Field | Value |
   |---|---|
   | **Tenant URL** | `https://<your-nirmata-domain>/users/api/scim/v2` |
   | **Secret Token** | Your Nirmata API key |

   ![Provisioning settings showing Tenant URL, Secret Token, and Test Connection fields](/images/azure-ad-admin-credentials.png)

4. Click **Test Connection**. A green checkmark confirms the credentials are valid.

5. Click **Save**.

---

## Step 2: Configure App Roles (Optional — for Admin Access)

The default role assigned to auto-provisioned users in NCH is **devops**. To assign the **admin** role to a group, you must first create an `admin` app role in Azure AD.

> **Note:** Users assigned the admin role will initially be provisioned with the devops role. The role automatically changes to admin the first time they log in to NCH.

### Create the Admin App Role

1. In the Azure portal, go to **App registrations** and open your application.
2. Under **Manage**, click **App roles**.

   ![App roles page showing existing roles: admin, User, msiam_access](/images/azure-ad-app-roles.png)

3. Click **+ Create app role** and fill in the fields:

   | Field | Value |
   |---|---|
   | **Display name** | `admin` |
   | **Allowed member types** | Both (Users/Groups + Applications) |
   | **Value** | `admin` |
   | **Description** | `admin` |
   | **Enable this app role** | Checked |

   ![Create app role form filled with admin role details](/images/azure-ad-create-app-role.png)

4. Click **Apply**.

### Assign the Role to a Group

1. Go back to your Azure AD **enterprise application** (not App registrations).
2. Under **Manage**, click **Users and groups**.
3. Click **+ Add user/group**, select the group you want to grant admin access to, and assign the **admin** role created above.
4. Click **Assign**.

---

## Step 3: Start Provisioning

1. In your Azure AD enterprise application, go to **Provisioning**.
2. Click **Start provisioning**.

Azure AD will now synchronize users and groups automatically. The provisioning cycle runs **every 40 minutes**.

---

## Related

- [Single Sign-On (SAML) with Azure AD](/docs/control-hub/Settings/Account)
- [MFA for Operations](/docs/control-hub/Settings/MFA%20for%20Operations)
- [API Keys](/docs/nctl/api-keys/)