Configuring SCIM with Azure AD

If you are configuring SCIM with Azure AD, this article is for you. The below guide provides the steps required to configure provisioning for 15Five, and includes the following sections:

• Features
• Prerequisites
• Configuration Steps
• Troubleshooting Tips

Features

Automatic User Provisioning is supported for the 15Five application.

This enables Azure AD to:

• Add new users to 15Five
• Update select fields in users’ profile information in 15Five
• Deactivate users in 15Five
• Push groups and membership to 15Five

The following provisioning features are supported:

• Push New Users - Creating a new user in Azure AD and assigning them to the 15Five application will create a new user in 15Five.
• Push Profile Updates - Updates to a user in Azure AD will be pushed to 15Five.
• Push User Deactivation - Deactivating the user or disabling the user's access to 15Five within Azure AD will deactivate the user in 15Five.
• Push Groups - Groups created in Azure AD can be pushed to 15Five. Attributes pushed include name and group members.
• Delete Groups - Groups deleted or removed from the 15Five application within Azure AD will be deleted within 15Five.

Currently, a non-gallery app within Azure AD is required for use of 15Five's SCIM provisioning features. The application found here is deprecated.

Prerequisites

Before you configure provisioning for 15Five: 

1. Make sure you have configured the General Settings and any Sign-On Options for the 15Five app.
2. Enable SCIM in your 15Five account and generate an Access Token.

Configuration Steps

• Navigate to the following URL and start with the "Getting Started" section https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/use-scim-to-provision-users-and-groups#provisioning-users-and-groups-to-applications-that-support-scim
• Please note that you will need to use a tenant URL of the form below:
  • https://<subdomain>.15five.com/scim/v1.9/
• Important Notes
  • Do not include "/scim/v2" as the Azure documentation suggests
  • The SCIM key is 30 characters long and should be placed in the "Secret Token" field. Make sure to use a SCIM key rather than a 15Five Public API key. A 15Five Public API key is 32 characters long.
  • It may take 40 minutes before the first users are pushed from Azure AD to 15Five after the Admin Credentials (tenant URL and secret token) have been tested and the non-gallery app has been saved. After that, pushes occur about every 20 minutes.

Syncing Passwords

Azure AD can be configured to sync passwords with 15Five. This sync direction is from Azure AD to 15Five. That is, passwords are only ever sent from Azure AD to 15Five for a user; never from 15Five to Azure AD.

If your company uses SSO with 15Five, do not send the "passwordProfile.password" as an attribute via SCIM. User authentication will be determined from the SAML setup associated with 15Five.

Emails

After assigning 15Five to an Azure AD user for the first time, a new user in 15Five will be created. If SSO is enabled for that user’s company in 15Five, that user will be sent a welcome email with a link to the SSO page at 15Five. If SSO is not enabled, that user will be sent a link to sign in and set their password.

When updating an Azure AD user’s password, that user’s 15Five password may be updated (depending on whether the"passwordProfile.password" attribute is being sent by Azure AD). If SSO is enabled for the user’s company in 15Five, no password changes will occur for the user within 15Five. If SSO is not enabled in 15Five and the"passwordProfile.password" attribute is being sent by Azure AD to 15Five, then a user will receive an email with a link to reset their password in 15Five.

Troubleshooting + Support

Manager/Reviewer not syncing? 

Make sure that the manager exists within 15Five prior to provisioning. 15Five will ignore any manager assignments that include managers not present in 15Five. 

Azure AD sends the manager information present in the manager attribute for a given user. The information in the attribute can be an email address for the manager or a 15Five ID for the user. Make sure this field is populated.

Finally, ensure that Sync Managers is enabled within 15Five's SCIM settings:
https://my.15five.com/scim/settings/

Changing a username?

15Five depends on the uniqueness of a user’s email address. Therefore, provisioning will fail if a user’s userPricipleName is updated but their email address is not. Ensure these two source attributes (userPricipleName and mail) send the same value and retry the provision if has failed. 

Updates or de-provisioning not working for some users? 

Users added to 15Five before SCIM was enabled for the 15Five account may not be tracked by Azure AD. To make Azure AD aware of these users' membership in 15Five, select "Clear current state and restart synchronization" and save the non-gallery app. NOTE: This could remove users from 15Five if they are not assigned to the non-gallery app in Azure AD. 

This integration is built and supported by 15Five and our Support Team. Contact the 15Five Support Team at support@15five.com if any issues arise. Thanks!