Configure iGrafx for automatic user provisioning using Azure AD/Microsoft Entra ID

This tutorial describes how to enable automatic user provisioning and de-provisioning with Azure AD/Microsoft Entra ID. Automatic user provisioning via the SCIM protocol is only available in the iGrafx cloud offering with the Process Design module.

For more information on how this technology works see this Azure document. 

Prerequisites

The following items are required:

1. An Azure Active Directory/Microsoft Entra ID

2. iGrafx Process Design module

3. SCIM secret token

4. SCIM tenant URL (pattern: https://scim.igrafxcloud.com/scim/v2/<YourTenant>)
   

Create your SCIM directory and secret token in iGrafx Process Design

The user performing these steps requires Manage user directories server permission:

1. Log into iGrafx Process360 Live Process Design

2. Go to Administration → User Management → Directories

3. Click Add new directory

4. Enter a name for the directory

5. Select directory type: SCIM

6. Click Create directory

7. Write down your SCIM secret token for later use
   Note: To generate a new token, click edit on the SCIM directory and then generate new token

Configure Azure AD/Microsoft Entra ID for user account provisioning:

1. In the Azure portal, browse to the Azure Active Directory →  Enterprise Apps →  All applications section.

2. If you have a SAML/SSO Enterprise app navigate to it, continue with step 4
   or Click New Application at the top of the page. 

3. Click Create your own application → Enter a name in Input Name field → Select "Integrate any other application you don't find in the gallery"

4. Now click Provisioning Tab (You may have to click Get Started button to see the next step.)

5. Set the provisioning mode to Automatic
   

   

   
   

6. Enter the SCIM Tenant URL and Secret Token (see instructions here)

7. Click Test Connection to see if your connection was successful ( Not successful? Contact our support for further assistance)

8. Under Settings → Enter an email to receive any synchronization issues

9. Click Save

10. Open the Mappings accordion that appears after saving

Configuring Mappings

Enable User Mapping 

Now open the mappings dropdown located under the "Admin Credentials" section

1. Enable Provisioning of Users

2. Select Create, Update, and Delete under target object actions
   

   

   
   
   

3. By default, Microsoft Entra ID defines a large number of mappings. iGrafx only needs the following 5 attributes mapped which are listed below.

We suggest changing the defaults to the below, in particular the username must be adjusted to be a valid email address. The mail  attribute is commonly available for this.

You can delete all other extra Attribute Mappings. The remaining ones should look like this:

4. Click Save at the top

Enable Group Mapping

1. Enable Provisioning of Groups
   

   

   
   
   

2. Select Create, Update, and Delete under the Target object actions

3. Change the Group Attribute mappings as follows
   
   

   

   1. If objectId or members is missing in your mappings, click Add New Mapping and configure them as shown below

4. Click Save

5. Once both user and group mappings are configured, press Save at the top of the main window.

Configure Users and Groups to provision

To select which users and groups are synchronized, go to the Users and Groups blade on your Enterprise application, and choose the users and groups you would like to have provisioned:

Once you have selected the users and groups you would like to provision, the synchronization should run every 40 minutes and create your users and groups as configured.

For more information on how to read the Azure AD/Microsoft Entra ID provisioning logs, see Reporting on automatic user account provisioning.

Additional resources

• Managing user account provisioning for Enterprise Apps

• What is application access and single sign-on with Azure Active Directory?