Skip to main content

Provisioning Overview

User provisioning is a critical component of modern IAM systems which allows organisations to manage and create user identities sourced from ITSM tools or a HR system. Manual user account creation can be time intensive and prone to errors. This is especially true as an organisation grows larger which increases the administrative burden of managing users account life cycles. Apporetum's provisioning functionality can be leveraged to manage creating, modifying, and deactivating user accounts across multiple systems.

Configure Environment Varaibles​

  1. Navigate to the Apporetum Managed Resource Group
  2. Select the Apporetum API App Service
  3. Select Settings -> Environment Variables from the menu blade
  4. Check if the following configurations are present in Application setting: General:ProvisioningServiceVersion and General:EnableProvisioningService
  5. If any of these settings do not exist, click on the +New application setting and manually add them. The names of these settings are case sensitive.
  6. Change the value of General:ProvisioningServiceVersion to 2
  7. Change the value of General:EnableProvisioningService to True Environment Variables
  8. Click Apply and Save
  9. This will restart the API Service and the environment variables will be set

Deploying Provisioning Agent​

Apporetum leverages Microsofts API-driven provisioning to Microsoft Entra ID via Enterprise Applications. For the deployment of the agent, you will need the following roles:

  • Application Administrator
  • Hybrid Identity Administrator
Provisioning Agent

There can only be a maximum of 2 automatic provisioning agents per tenant.

  1. Navigate to Enterprise Applications in the Microsoft Portal
  2. Select + New Application
  3. Search for API-driven provisioning to Microsoft Entra ID and select the application Enterprise Application
  4. Select Create
Application ID and Object ID

Take note of Application ID and the Object ID displayed. This information will be used in the provisioning set up

  1. Under the Manage blade, select Provisioning

  2. Click on Get Started to configure the provisioning agent provisioning-get-started

  3. Change the Provisioning Mode to Automatic

  4. Select Save

    provisioning-config

  5. Expand the Settings tab

  6. Enable Send an email notification when a failure occurs and set the value to an email that will receive notifications when failures occur

  7. Enable Prevent accidental deletion and set the value to 15

Prevent Accidental Deletion

This setting prevents users and groups from being accidentally disabled or deleted in your application

  1. Turn Provisioning Status to On
  2. Select Save

provisioning-config

Configuring Provisioning Agent​

  1. Navigate to the Enterprise App API Driven Provisioning Agent. Refer to Deploying Provisioning Agent
  2. Under the Manage blade, select Provisioning
  3. Select Start provisioning to turn on the provisioning agent

Start provisioning

  1. Select Edit attribute mappings

    Edit attribute mappings

  2. Expand the Edit attribute mappings tab

  3. Select Provision API urn:ietf:params:scim:schemas:extension:enterprise:2.0:Users

    Provisioning edit attribute mappings

  4. Ensure Enabled is set to Yes

  5. Enable Create under Target Object Actions.

Prevent Accidental Updates and Deletions

Ensure Target Object Actions only has Create enabled. Disabling Update and Delete ensures existing users will not be altered or deleted during the set-up and testing of Apporetum Provisioning. It is recommended to only select Update or Delete once provisioning has been set up and testing has been done to confirm the service is working.

Target object Actions

  1. Select Save

Attribute Mapping Overview​

Attribute Mapping is a configuration feature that defines how user data flows between a source feed (CSV extract from HR System) and Entra ID. Attribute Mapping allows organisations to map specific attributes from your source feed to corresponding attributes in Entra ID. This mapping allows customisation into which properties gets synchronised and how they get transformed to fit your orgnisations specific needs. The table below describes an example Attribute Mapping an organisation might use.

Microsoft Entra ID AttributeAPI Attribute
street Addressaddresses[type eq "work"].streetAddress
cityaddresses[type eq "work"].locality
stateaddresses[type eq "work"].region
postalCodeaddresses[type eq "work"].postalCode
countryaddresses[type eq "work"].country
departmenturn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
employeeidurn:ietf:params:scim:schemas:extension:apporetum:1.0:User:employeeId
extensionAttribute1urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute1

Configure Attribute Mappings​

After the provisioning agent is deployed further, configuration to the attribute mappings is required. Attribute mappings define how attributes are synchronised between the API and Microsoft Entra ID.

  1. Navigate to Attribute Mapping for the provisioning agent. Refer to step 1-6 of Configuring Provisioning Agent
  2. Enable Show advanced options. This is located under the Attribute Mappings table.
  3. Select Edit attribute list for API

Add New Mapping

  1. Manually add the following attributes in the table below into the attribute list. The values for Primary Key, Required, Multi-value, Exact case, API Expression, and Referenced Object Attribute are not required for the manual input.

    info

    Attribute Mappings are case sensitive. It is recommended to copy and paste the attributes to avoid errors.

    NameType
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:accountExpireDateDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:costCenterString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cityString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute1String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute10String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute11String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute12String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute13String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute14String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute15String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute16String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute17String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute18String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute19String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute2String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute20String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute3String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute4String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute5String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute6String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute7String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute8String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:cloudExtensionAttribute9String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:companyString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:countryString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:countryCodeString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:countryLetterCodeString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:dateOfBirthDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:descriptionString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:employeeIdString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:employeeLeaveDateTimeDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:employeeTypeString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:employeeNumberString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:endDateDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute1String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute10String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute11String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute12String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute13String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute14String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute15String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute2String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute3String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute4String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute5String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute6String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute7String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute8String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:extensionAttribute9String
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:externalOrganisationString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:faxNumberString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:hireDateDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:honorificPrefixString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:honorificSuffixString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:isSoftDeleteString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:infoString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:ipPhoneString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:jobDescriptionString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:jobidString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:jobTitleString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:leaveEndDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:leaveStartDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:leaveTypeString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:locationString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:officeLocationString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:onPremisesDistinguishedNameString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:onPremisesImmutableIdString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:onPremisesSamAccountNameString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:onPremisesSecurityIdString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:orgUnitIdString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:phoneExtensionString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:postalCodeString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:proxyAddressesString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:securityClearanceExpiryDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:securityClearanceIdString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:securityClearanceLevelString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:startDateDateTime
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:stateString
    urn:ietf:params:scim:schemas:extension:apporetum:1.0:User:streetAddressString

  2. Save the table

-->

Scoping Filters​

If your organisation requires granular rules to determine which users or groups are provisioned, you can set up scoping filters to define a set of attributes to be targeted. More information on scoping filters can be found here.

Assigning Permissions​

Apporetum requires a specific API Permission in order to provision users using the API-driven provisioning agent. The API permission SynchronizationData-User.Upload allows the application to upload bulk user data to the identity synchronisation service, without a signed-in user.

  1. Navigate to App Registrations

  2. Select the Apporetum app registration

  3. Select API Permissions under the Manage blade

  4. Select + Add a permission

  5. Select Microsoft Graph

  6. Select Application permissions

  7. Search and select SynchronizationData-User.Upload

  8. Select Add permissions to add the permission to the app registration

    Add Permission

Creating a Secret​

warning

This step is only required if the provisioning agent and the Entra ID tenant where users will be provisioned are in different tenancies. If they are in the same tenancy, you can skip this section.

  1. Navigate to App Registration in the Azure Portal

  2. Select the API-driven provisioning application that was created. Refer to Deploying Provisioning Agent to create a provisioning agent

  3. Select Certificates & Secrets under the Manage blade

    Generate Secret

  4. Select + New Client Secret to generate a new client secret. Give this secret a description and select the expiry time frame for the secret.

  5. Select Add to create the new client secret

  6. Note down the client secret value as this value cannot be viewed, except for immediately after creation.

Configure CSV for Apporetum​

Generate a CSV file from your ITSM or HR tool that contains user identities. This file can be imported into Apporetum which can then handle further insights and automate identity lifecycle management across your organisation. This section of the provisioning set up requires you to have either System Admin, Global Admin, or Lifecycle Admin role assigned.

Data Sources​

Apporetum supports CSV imports from various systems, including:

  • HR Systems - Employee records, organisational data, job titles, departments
  • Identity Providers - Existing user directories

Workforce Feeds​

Workforce Feeds are CSV data files from your organisations HR system that can be ingested into Apporetum. Workforce feeds require configuration in order for Apporetum to provide automatic provisioning.

Data Sources Overview

Further information regarding data sources can be found here.

  1. Navigate to Apporetum

  2. Navigate to Settings -> Connectivity -> Workforce Feeds

  3. Select Configure feed

  4. Fill out the basic information and configuration type:

    1. Name - Unique name for the workforce feed
    2. Description (optional) - A description to describe the workforce feed. (What data is it? Which HR system?)
    3. Upload Type - Manual

    Workforce feed info

  5. Select Save Changes

  6. Upload a CSV file by clicking on the upload box or dragging your CSV file into the upload area

    Configure data sync

  7. After a CSV file has been uploaded you will need to match an account identifier. Expand the Match Accounts tab and select a value that represents a persons identifier. This allows Apporetum to match identities from the CSV file to identity records within Apporetum.

Match Accounts

In most cases, the identifier used to match is Employee ID. If this is not the case for your organisation, select the identifier from the drop down boxes provided.

Match accounts using Employee ID

  1. Select Save and complete
  2. Open the Map tab. These settings allow you to map the columns from your CSV file to the relevant fields within Apporetum. These mappings may be different based on your organisations requirements. The screenshot below depicts an example CSV mapping.

CSV workforce feed mapping

  1. Select Save and complete
  2. Navigate to the Sync tab
  3. Select Start Sync

Workforce feed sync

Configure Provisioning Flow​

A Provisioning Flow is part of Apporetums Life Cycle Management toolkit that allows users to configure how Apporetum treats specific workforce feeds. The Provisioning Flow maps out the lifecycle starting from the workforce feed all the way to an account mapping in Apporetum.

Account Types

Further information regarding account types can be found here.

Add Workforce Feed​

  1. Navigate to Apporetum
  2. Select Identity -> Life Cycle Management -> Provisioning Flow
  3. Switch the view to Draft
  4. Select Add Workforce Feed

Default provisioning flow

  1. Select the workforce feed that has been configured in the previous steps. Refer to Workforce Feeds

  2. Select Add

    Default provisioning flow

Workforce to Identity Mapping​

  1. Select Workforce to Identity Mapping

    Workforce to identity mapping

  2. In the Person to Identity Mapping formula copy and paste the following code block:

using Apporetum.Domain.Entities;
using Apporetum.Domain.Entities.Workforce;
using Apporetum.Domain.Extensions;

using System;
using System.Collections;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;

namespace Transformations;

public static class PersonToIdentity {
    public static ManagedIdentity Transform(WorkforcePerson person) {
        IEnumerable<string?> names = [person.FirstName, person.Surname,];
        names = names.Where(x => !x.IsNullOrWhiteSpace()).ToList();

        IEnumerable<string?> preferredNames = [person.PreferredName ?? person.FirstName, person.Surname,];
        preferredNames = preferredNames.Where(x => !x.IsNullOrWhiteSpace()).ToList();

        return new ManagedIdentity() {
            AccountEnabled = person.Active ?? true,
            EmployeeNumber = person.EmployeeNumber,
            UserPrincipalName = person.SystemUsername,
            Email = person.Email,
            DisplayName = string.Join(" ", preferredNames),
            FirstName = person.FirstName,
            MiddleName = person.MiddleName,
            Surname = person.Surname,
            PreferredName = person.PreferredName,
            HonorificPrefix = person.HonorificPrefix,
            HonorificSuffix = person.HonorificSuffix,
            Mobile = person.Phone,
            TelephoneNumber = person.Mobile,
            PhoneExtension = person.PhoneExtension,
            StreetAddress = person.StreetAddress,
            City = person.City,
            State = person.State,
            Country = person.Country,
            PostalCode = person.PostalCode,
            HireDate = person.HireDate,
            StartDate = person.StartDate,
            EndDate = person.EndDate,
            Organisation = person.Organisation,
            Company = person.Company,
            Division = person.Division,
            Department = person.OrgUnitId,
            EmployeeId = person.EmployeeId,
            EmployeeType = person.EmployeeType,
            JobTitle = person.JobTitle,
            ManagerId = person.ManagerId,
            CostCenter = person.CostCentreId,
            JobId = person.JobId,
            JobDescription = person.JobDescription,
            OfficeLocation = person.OfficeLocation,
            SecurityClearanceId = person.SecurityClearanceId,
            SecurityClearanceLevel = person.SecurityClearanceLevel,
            SecurityClearanceExpiry = person.SecurityClearanceExpiry,
            CustomAttribute1 = person.CustomAttribute1,
            CustomAttribute2 = person.CustomAttribute2,
            CustomAttribute3 = person.CustomAttribute3,
            CustomAttribute4 = person.CustomAttribute4,
            CustomAttribute5 = person.CustomAttribute5,
            CustomAttribute6 = person.CustomAttribute6,
            CustomAttribute7 = person.CustomAttribute7,
            CustomAttribute8 = person.CustomAttribute8,
            CustomAttribute9 = person.CustomAttribute9,
            CustomAttribute10 = person.CustomAttribute10,
            CustomAttribute11 = person.CustomAttribute11,
            CustomAttribute12 = person.CustomAttribute12,
            CustomAttribute13 = person.CustomAttribute13,
            CustomAttribute14 = person.CustomAttribute14,
            CustomAttribute15 = person.CustomAttribute15,
        };
    }
}
  1. Select Save configuration Configure workforce person to identity mapping

Identity to Account Mapping​

  1. Navigate and select Identity to Account Global Mapping

    Identity to account global mapping

  2. In the Identity to Account Mapping formula copy and paste the following code block:

using Apporetum.Domain.Entities;
using Apporetum.Domain.Entities.Workforce;
using Apporetum.Domain.Extensions;

using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;

namespace Transformations;

public static class IdentityToAccount {
    public static ManagedAccount Transform(ManagedIdentity identity) {
        return new ManagedAccount() {
            
            DisplayName = identity.DisplayName,
            FirstName = identity.FirstName,
            Surname = identity.Surname,
            MiddleName = identity.MiddleName,
            PreferredName = identity.PreferredName,
            UserPrincipalName = identity.UserPrincipalName,
            Description = identity.Description,
            Info = identity.Info,
            Email = identity.Email,
            MailNickname = identity.MailNickname,
            Mobile = identity.Mobile,
            TelephoneNumber = identity.TelephoneNumber,
            HomePhone = identity.HomePhone,
            IpPhone = identity.IpPhone,
            FaxNumber = identity.FaxNumber,
            Country = identity.Country,
            CountryCode = identity.CountryCode,
            CountryLetterCode = identity.CountryLetterCode,
            City = identity.City,
            StreetAddress = identity.StreetAddress,
            Location = identity.Location,
            PostalCode = identity.PostalCode,
            State = identity.State,
            Company = identity.Company,
            EmployeeId = identity.EmployeeId,
            EmployeeType = identity.EmployeeType,
            EmployeeNumber = identity.EmployeeNumber,
            JobTitle = identity.JobTitle,
            Division = identity.Division,
            Department = identity.Department,
            ManagerId = identity.ManagerId,
            ManagerDisplayName = identity.ManagerDisplayName,
            OrgUnitId = identity.OrgUnitId,
            Organisation = identity.Organisation,
            CostCenter = identity.CostCenter,
            ConsistencyGuid = identity.ConsistencyGuid,
            OnPremisesDistinguishedName = identity.OnPremisesDistinguishedName,
            OnPremisesImmutableId = identity.OnPremisesImmutableId,
            OnPremisesSamAccountName = identity.OnPremisesSamAccountName,
            OnPremisesSecurityId = identity.OnPremisesSecurityId,
            AccountExpireDate = identity.AccountExpireDate,
            JobId = identity.JobId,
            JobDescription = identity.JobDescription,
            OfficeLocation = identity.OfficeLocation,
            SecurityClearanceId = identity.SecurityClearanceId,
            SecurityClearanceLevel = identity.SecurityClearanceLevel,
            SecurityClearanceExpiry = identity.SecurityClearanceExpiry,
            HireDate = identity.HireDate,
            StartDate = identity.StartDate,
            ExtensionAttribute1 = identity.CustomAttribute1,
            ExtensionAttribute2 = identity.CustomAttribute2,
            ExtensionAttribute3 = identity.CustomAttribute3,
            ExtensionAttribute4 = identity.CustomAttribute4,
            ExtensionAttribute5 = identity.CustomAttribute5,
            ExtensionAttribute6 = identity.CustomAttribute6,
            ExtensionAttribute7 = identity.CustomAttribute7,
            ExtensionAttribute8 = identity.CustomAttribute8,
            ExtensionAttribute9 = identity.CustomAttribute9,
            ExtensionAttribute10 = identity.CustomAttribute10,
            ExtensionAttribute11 = identity.CustomAttribute11,
            ExtensionAttribute12 = identity.CustomAttribute12,
            ExtensionAttribute13 = identity.CustomAttribute13,
            ExtensionAttribute14 = identity.CustomAttribute14,
            ExtensionAttribute15 = identity.CustomAttribute15,
        };
    }
}
  1. Select Save configuration

Account Type Mapping​

  1. Select Add account type mapping

    Add account type mapping

  2. Use the dropdown box to select an account type

    Select account type mapping

  3. Select Add

  4. Navigate to the newly created account type mapping in the Provisioning Flow

  5. Under the Schedule tab, select the Account Type to Identity Mapping formula that best suits your organisations needs.

Account Type to Identity Mapping Formula

This setting describes how the Account Type will sync with your identity.

  • Off = No sync will occur
  • Always on = Always syncs where there are changes
  • External = Trigger sync on external request
  • Filtered = Sync users based on a specific criteria

account type to identity mapping formula

  1. Select Save configuration

Configure Connected Data Source​

  1. Select the Connected Data Source in the Provisioning Flow. This is usually the name of your Entra ID Tenant where user provisioning will occur. In this example, the Connected Data Source is named "Modern IAM"

    Select connected data source

  2. This is where you will configure the Provisioning Agent to connect to Apporetum. Fill out the configuration as follows:

    1. Provisioning Service Configuration - Enabled (This enables the provisioning flow to connect to the Provisioning Agent)
    2. Tenant ID (optional) - Required when user provisioning is occurring in a separate tenant
    3. Client ID (optional) - Required when user provisioning is occurring in a separate tenant
    4. Secret (optional) - Required when user provisioning is occurring in a separate tenant
    5. Provisioning Service Principle ID - The Application ID of the Provisioning Agent
    6. Provisioning Job ID - The Job ID of the Provisioning Agent
tip

Information on how to find the Provisioning Service Principle ID and Provisioning Job ID can be found here.

Configure provisioning service

  1. Select Save configuration

  2. Select Publish

    Publish button

Finding the Provisioning Service Principle ID and Provisioning Job ID​

The Apporetum Provisioning Flow requires the provisioning Service Principle ID and Provisioning Job ID from the deployed Provisioning Agent. To find this information:

  1. In the Azure portal navigate to Enterprise Apps
  2. Select the API-driven Provisioning app
  3. Under Properties copy the Object ID - This is the "Provisioning Service Principle ID"
  4. Under the Manage blade, select Provisioning
  5. Expand the View technical information tab
  6. Copy the Job ID - This is the "Provisioning Job ID"

Testing Apporetum Provisioning​

In order to test if the Provisioning Flow is working as intended you can follow these steps:

  1. Create a new CSV file to import into Apporetum as a workforce feed

  2. Ensure there is data of at least one new user who does not exist in Entra ID Tenant

  3. Navigate to Apporetum

  4. Select Settings -> Connectivity -> Workforce Feeds

  5. Select the workforce feed that will be updated with the new CSV

  6. Navigate to the Import Feeds tab

  7. Upload the new CSV file

  8. Navigate to the Sync tab

  9. Select Start Sync to trigger a new sync

  10. In the Azure Portal search for Enterprise Apps

  11. Select the provisioning agent that was deployed

  12. Select Provisioning under the Manage blade

  13. Select View provisioning logs

    View provisioning logs

  14. The provisioning logs will show the status of current provisioning jobs. This may take a few minutes to populate. This can be used to confirm if the user was provisioned.

tip

You can search Entra ID for the newly provisioned user to confirm if provisioning is working.

Further issues and troubleshooting for API-driven provisioning can be found here.

Apporetum SCIM Mapping​

The following table defines the mapping between standard SCIM attributes and their corresponding properties in Apporetum.

SCIM KeyApporetum Managed Account Property
ExternalIdDSResourceId
DisplayNameDisplayName
ActiveAccountEnabled
UserNameUserPrincipalName
NickNamePreferredName
GivenNameFirstName
FamilyNameSurname
MiddleNameMiddleName
HonorificPrefixHonorificPrefix
HonorificSuffixHonorificSuffix
TitleJobTitle
UserTypeEmployeeType
MobilePhone
TelephoneNumberMobile
PhoneExtensionPhoneExtension
StreetAddressStreetAddress
CityCity
StateState
CountryCountry
PostalCodePostalCode
HireDateHireDate
StartDateStartDate
EndDateEndDate
OrganisationCompany
DivisionDivision
DepartmentOrgUnitId
ManagerIdManagerId
CostCenterCostCentreId
JobDescriptionJobDescription
OfficeLocationOfficeLocation
SecurityClearanceIdSecurityClearanceId
SecurityClearanceLevelSecurityClearanceLevel
SecurityClearanceExpirySecurityClearanceExpiry
CustomAttribute1CustomAttribute1
CustomAttribute2CustomAttribute2
CustomAttribute3CustomAttribute3
CustomAttribute4CustomAttribute4
CustomAttribute5CustomAttribute5
CustomAttribute6CustomAttribute6
CustomAttribute7CustomAttribute7
CustomAttribute8CustomAttribute8
CustomAttribute9CustomAttribute9
CustomAttribute10CustomAttribute10
CustomAttribute11CustomAttribute11
CustomAttribute12CustomAttribute12
CustomAttribute13CustomAttribute13
CustomAttribute14CustomAttribute14
CustomAttribute15CustomAttribute15