Unit 12: Explore Automatic User Creation (SCIM)

What is SCIM?

System for Cross-Domain Identity Management (SCIM) is an open standard (RFC 7643 & 7644) for automating identity provisioning between systems.

Goal: Automatically create, update, and deactivate user accounts across platforms (e.g., HR → Entra → SaaS).

SCIM Components

Component	Description
HCM System	HR or Human Capital Management software (e.g., Workday, SAP SuccessFactors).
Microsoft Entra Provisioning Service	Uses SCIM 2.0 protocol to synchronize users/groups to target systems.
Microsoft Entra ID	Identity repository — central user store.
Target System	App with a SCIM endpoint (e.g., ServiceNow, Salesforce).

Why Use SCIM

Eliminates manual account creation and removal.
Synchronizes user attributes across systems.
Ensures timely deprovisioning when employees leave.
Reduces insider threat by automating offboarding.

Example: When a new hire is added to Workday, SCIM automatically creates the user in Entra ID and assigns licenses. When HR terminates the employee, SCIM removes access from all connected apps instantly.

Security and Exam Notes

SCIM uses REST APIs + JSON payloads.
Entra’s provisioning agent polls every 40 minutes by default.
Deprovisioning is critical for compliance and data protection.
Expect exam questions on SCIM integration with HCM systems and how automatic provisioning reduces breach risks.

✅ Module 2 Summary: Create, Configure, and Manage Identities

Area	Key Concepts
Users	Cloud, synced, and guest accounts. Managed via Entra admin center or PowerShell.
Groups	Simplify access and licensing; supports dynamic rules.
Devices	Entra registered (BYOD), joined (cloud), and hybrid joined (on-prem + cloud).
Licenses	Group-based licensing automates provisioning; track error states and usage location.
Custom Attributes	Extend directory schema for business-specific classification and access control.
SCIM Automation	Automates user provisioning between HR, Entra, and SaaS apps.

Real-World Summary: Contoso implements full identity lifecycle automation:

HR adds new hires → SCIM creates Entra accounts automatically.
Users join appropriate groups → group-based licensing assigns E3 + EMS licenses.
Devices are registered or joined to Entra for SSO and Conditional Access.
Attributes like Department and ClearanceLevel drive dynamic group rules.
Departing users are auto-deprovisioned, ensuring zero residual access.

SC‑300 Study Portal Dark

Unit 12: Explore Automatic User Creation (SCIM)