Azure

Open the application that is configured for SAML in the Entra Id admin dashboard. Then select Provisioning on the left sub-nav

If this is the first time Provisioning is being configured, an informational screen will be presented. Select “Connect your application”. if this is not the first time configuring Provisioning, select "Connectivity".

On the Connectivity page, enter the following values:
- Select authentication method: Bearer authentication
- Tenant URL: https://<your-api-domain>/scim/v2
  - Your API domain is similar to your Alloy application domain, but uses api instead of app.
    
    For example:
    - Application domain: scim-demo.app.alloy.com
    - API domain: scim-demo.api.alloy.com
    - Tenant URL: https://scim-demo.api.alloy.com/scim/v2
- Secret Token: <base64_encode(alloy_api_token:alloy_api_secret)>
  - You can create your alloy_api_token and alloy_api_secret in the Alloy dashboard under Settings > API Keys.
  - To create the Secret Token, Base64-encode the API token and secret in the following format:
    
    alloy_api_token:alloy_api_secret
    
    For example, you can run the following command in your browser's developer console:
    
    btoa("alloy_api_token:alloy_api_secret")
    
    Enter only the resulting Base64-encoded value in the Secret Token field. Do not add a prefix such as Bearer.
    
    For more information, see the Alloy authentication guide. Alloy currently supports only Bearer authentication for SCIM.
- Select Test Connection. After Microsoft Entra ID successfully connects to Alloy, select Save.
Once the saving process is complete, scroll down as the toggle header Mappings should now be visible. Select Provisioning Microsoft Entra ID Users.

Modify the Users Attribute Mapping to mirror the below image then select Save. That’s it! SCIM Provisioning is now configured. (phoneNumbers[type eq "mobile"].valueis optional)

Open the application that is configured for SAML in the Entra Id admin dashboard and select Assign users and groups or select Users and Groups on the left sub nav.
The application may already contain assigned users. To assign a user, select “Add user/group”. A modal should display. Select “None Selected” to begin selecting users to assign.
Click “Select” then “Assign” to complete the process.
Navigate to “Provisioning” on the left sub-nav.
The user has been assigned to the application on Entra Id. Entra Id updates Alloy with these changes on a 40 mins fixed interval basis. Due to the secret token’s short lifespan (1hr), its recommended to use the “**Provision on demand “**option when attempting to synchronize a small number users or groups.
Provisioning on Demand. After clicking Provision, any changes made to the users active status, first name, last name, or phone number will propagate to Alloy.

Open the application that is configured for SAML in the Entra Id admin dashboard and select Assign users and groups or select Users and Groups on the left sub nav.
To assign a Group, select “Add user/group”. A modal should display. Select “None Selected” to begin selecting groups to assign.

Please note:💡: To assign a group to an existing role, make sure the group name exactly matches the role within Alloy. Any users assigned to that group will be provisioned into the corresponding Alloy role.
Click “Select” then “Assign” to complete the process.
Navigate to “Provisioning” on the left sub-nav.
The group has been assigned to the application on Entra Id. Entra Id updates Alloy with these changes on a 40-minute fixed interval basis. Due to the secret token’s short lifespan (1hr), it's recommended to use the “**Provision on demand “**option when attempting to synchronize a small number of users or groups.
Provisioning on Demand. After clicking Provision, any changes made to the group's name will propagate to Alloy.

Login to the Alloy app. go to the settings, nav to Agents and Groups page. verify the user and group are added to the Alloy app