Configure iGrafx for automatic user provisioning using Azure AD / Microsoft Entra ID
Enable automatic user provisioning and de-provisioning from Azure AD / Microsoft Entra ID via the System for Cross-domain Identity Management (SCIM). SCIM provisioning is available in the iGrafx Cloud offering with the Process DesignProcess Design The discipline of explicitly modeling business processes to document, analyze, and optimize them. In Process360 Live, process design is the authoring side that complements mining's data-driven view. module only.
Prerequisites
- An Azure Active Directory / Microsoft Entra ID tenant.
- Admin access to the iGrafx Process DesignProcess Design The discipline of explicitly modeling business processes to document, analyze, and optimize them. In Process360 Live, process design is the authoring side that complements mining's data-driven view. module, with the Manage user directories server permission.
Steps
Create the SCIM directory in iGrafx Process Design
- Sign in to iGrafx Process360 LiveProcess360 Live iGrafx's cloud platform for end-to-end process management — combining process design, mining, simulation, and automation in a single environment. Process DesignProcess Design The discipline of explicitly modeling business processes to document, analyze, and optimize them. In Process360 Live, process design is the authoring side that complements mining's data-driven view..
- Go to Administration → User Management → Directories.
- Click Add new directory.
- Enter a name and select directory type SCIM.
- Click Create directory.
- Record your SCIM secret token and SCIM Tenant URL for later. (To view the URL or generate a new token, click Edit on the SCIM directory, then Generate new token.)
Connect the Azure enterprise application
- In the Azure portal, go to Azure Active Directory → Enterprise applications → All applications.
- Open your existing SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO./SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials. enterprise app (then go to step 4), or click New application.
- Click Create your own application, enter a name, and select Integrate any other application you don't find in the gallery.
- Open the Provisioning tab (select Get started if shown).
- Set the provisioning mode to Automatic.
- Enter the SCIM Tenant URL and Secret Token from the directory step.
- Click Test Connection (if it fails, contact support).
- Under Settings, enter an email for synchronization issues, then Save.
Configure the user mappings
Open the Mappings section, then Provision Microsoft Entra ID Users. Enable provisioning, and under target object actions select Create, Update, and Delete. iGrafx needs only these five attributes:
| iGrafx user attribute | Mapping type | Source attribute / expression | Target attribute |
|---|---|---|---|
| Username | Direct | mail | userName |
| Enabled | Expression | Not([IsSoftDeleted]) | active |
| Direct | mail | emails[type eq "work"].value | |
| First name | Direct | givenName | name.givenName |
| Last name | Direct | surname | name.familyName |
The username must be a valid email address — the mail attribute is commonly available for this.
Delete all other default mappings, then Save.
Configure the group mappings
Open Provision Microsoft Entra ID Groups, enable provisioning, and select Create, Update, and Delete. Set:
| Mapping type | Source attribute / expression | Target attribute |
|---|---|---|
| Direct | members | members |
| Direct | objectId | externalId |
If objectId or members is missing, click Add New Mapping to add it. Save, then Save at the top of the main window.
Choose users and groups to provision
On the enterprise application's Users and groups blade, select the users and groups to provision. Synchronization then runs about every 40 minutes. To read the logs, see Microsoft's provisioning report.