@@ -31,7 +31,7 @@ To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Click the `Connect Microsoft Entra ID` button to begin the configuration process. This action will trigger a pop-up window that will present you with a user-friendly wizard, guiding you through the synchronization process between NetBird and Entra ID. - +
## Configure SCIM Provisioning in Microsoft Entra ID
@@ -39,16 +39,16 @@ This action will trigger a pop-up window that will present you with a user-frien
Click on the `Get Started` button to initiate the integration process.
A new wizard screen will appear, offering step-by-step instructions for creating and configuring your Microsoft Entra ID application. To simplify the process, the wizard also provides quick-copy buttons for essential information:
-
+
In the [Azure portal](https://portal.azure.com), navigate to `Azure Active Directory` → `Enterprise applications`.
-
+
Click `New application` to create a new enterprise application.
-
+
Click `Create your own application`.
@@ -57,62 +57,100 @@ Fill out the application form with the following details:
* **What's the name of your app?**: `NetBird SCIM`
* **What are you looking to do with your application?**: Select `Integrate any other application you don't find in the gallery (Non-gallery)`
-
+
Click `Create`.
-
+
### Enable Provisioning
On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for enabling provisioning.
-
+
Once the application is created, you'll be redirected to a getting started page. Click `Get started` in the `Provision User Accounts` section.
-
+
Under the `Create configuration` section, click `connect your application`.
Fill out the `New provisioning configuration` form with the following details:
* **Select authentication method**: `Bearer authentication`
-* **Tenant URL**: `https://api.netbird.io/api/scim/v2` (paste the Base URL you copied from NetBird)
+* **Tenant URL**: `https://api.netbird.io/api/scim/v2?aadOptscim062020`
* **Secret token**: Paste the Token Key you copied from the Entra ID SCIM Setup process in the NetBird integration
-
+
Click `Test Connection` to verify the SCIM connection. If the connection is successful, click `Create` to save the configuration.
-
+
### Configure Attribute Mapping
On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for configuring attribute mapping.
-
+
-After creating the provisioning configuration, you need to configure the attribute mapping to ensure the `externalId` is mapped to the user's `objectId`.
+After creating the provisioning configuration, you need to configure the attribute mappings for both groups and users.
+Navigate to the `Attribute mapping` section.
-Navigate to the `Attribute mapping` section and click `Provision Microsoft Entra ID Users`.
+
+
+#### Group Attribute Mapping
+
+Click `Provision Microsoft Entra ID Groups` to configure the group attribute mapping.
+
+
+
+In the attribute mappings list, locate the `externalId` row and click `Delete`.
+
+Click `Save` to apply the updated group attribute mapping configuration.
+
+
+
+#### User Attribute Mapping
+
+Navigate back to the `Attribute mapping` section and click `Provision Microsoft Entra ID Users` to configure the user attribute mapping.
+
+
+
+Remove all attribute mappings except for the following:
+
+* `userName`
+* `active`
+* `displayName`
+* `emails[type eq "work"].value`
+* `name.givenName`
+* `name.familyName`
+* `externalId`
+
+Click `Save` to apply the updated user attribute mapping configuration.
+
+
-
In the attribute mappings list, locate the `externalId` row and click `Edit`.
Change the **Source attribute** from `mailNickname` to `objectId`.
-
+
-Click `Ok` to save the change, then click `Save` to apply the new attribute mapping configuration.
+Click `Ok` to save the change, then click `Save` to apply the final user attribute mapping configuration.
-
+
## Assign Users and Groups
On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for assigning users and groups.
-
+
To enable SCIM synchronization of users and groups to NetBird, you need to assign them to the NetBird enterprise application.
@@ -124,21 +162,26 @@ In the Azure portal, navigate to your NetBird enterprise application:
* Select the users and groups you want to synchronize to NetBird
* Click `Assign` to save the assignments
-
+
## Start Provisioning
On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for starting the provisioning.
-
+
After assigning users and groups, navigate back to the provisioning configuration and click the `Start provisioning` button to enable automatic synchronization. The first sync will begin shortly after provisioning is started.
-
+
Once started, Microsoft Entra ID will automatically synchronize the assigned users and groups to NetBird.
+
### Regenerate Auth Token
If your authentication token has expired or you need to update it, click **Regenerate Auth Token** in the configuration window to generate a new token.
-
+
### Groups to be synchronized
By default, all groups assigned to the NetBird application in Entra will be synchronized. If you want to synchronize only assigned groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive.
-
+
Click `Continue` to proceed to the next step.
@@ -180,4 +223,4 @@ Click `Continue` to proceed to the next step.
By default, all users from the groups assigned to the NetBird application in Entra will be synchronized. If you want to further filter and synchronize only users from specific assigned groups, you can specify those group names in the filter. The group name matching is case-sensitive.
-
+