System for Cross-domain Identity Management (also known as "SCIM") is a protocol for user management across multiple applications. It allows an IT or Operations team to easily provision (add), de-provision (deactivate), and update user data across multiple applications at once. 

To set up SCIM provisioning in Entra ID (previously known as Azure AD) you will need to have the involvement of both the monday.com admin and the manager of your Entra ID account. 

 

SCIM capabilities supported in monday.com

• Provisioning of Users
• De-provisioning of Users
• Provisioning of Teams
• De-provisioning of Teams
• Team Renaming
• Updating User Details
• Assigning Users to Teams
• Un-assigning Users from Teams

 

Configuration

• Step 1 - Add monday.com to Entra ID

Go to your Entra ID homepage and click "Enterprise Applications" on the left pane.

Then, click the New application button:

Search for the monday.com application and select it from the search results:

 

Give the app a name and click on the "Create" button at the bottom:

 

• Step 2 - Go to Provisioning

Go to the Provisioning section and click "Get Started".

On the following page, select the "Automatic" Provisioning Mode:

 

In the "Admin Credentials" section, enter the following:

• Tenant URL:
  This should be taken from your monday.com account (see instructions below)
• Secret Token:
  This should be taken from your monday.com account (see instructions below)

 

Go to monday.com Admin section to retrieve the provisioning token

• Open up your monday.com account
• Click on your avatar > Admin
• Go to the Security section
• Click on SCIM

Here you can generate and copy the provisioning URL and token and then copy and paste into Entra ID.

 

Click Test Connection button to verify the credentials that are authorized for provisioning:

 

Click "Save" on the left-hand side of the page to save the configuration.

 

Under Settings, make sure to set the scope to "Sync only assigned users and groups":

 

To start provisioning, set Provisioning Status to "On":

 

Click "Save" on the left-hand side of the page to save the Provisioning Status.

 

Set Up User Provisioning

Go back to the application main page, and then go to "Users and groups":

Click "Add user":

Then, click "Users and groups":

Search for users and select them from the list, and then click the "Select" button at the bottom of the screen.

 

Click the "Assign" button at the bottom-left side:

  

User Attributes

These fields are supported for mapping user attributes:

• Name (can’t contain special characters)
• Email (must be lowercase)
• Title (user’s position in the company)
• Active (whether or not a user is enabled or disabled)
• User type (we'll discuss this in the section below!)

 

Do note, when using Entra ID for both SCIM provisioning and SSO login:

• When a user is created via SCIM provisioning, their email in monday.com will always match the 'UserPrincipalName' parameter in Entra ID
• When connecting SSO, you need to ensure the email field sent to monday.com is mapped to 'UserPrincipalName' or a field that holds an equivalent value

 

Provisioning user types

In case you choose not to provision the user type attribute, you can remove it from the attribute mapping by following the steps below: 

 

Go to the Provisioning section. Under Mappings, click Provision Azure Active Directory Users:

 

Scroll down to the Attribute Mapping table and make sure to delete the roles attribute by clicking the Delete button:

 

Click "Save" on the left-hand side of the page to save the configuration.

 

To configure account custom roles as user type:

1. Configure the relevant custom role on monday.com as described in this article.
2. Go to Entra ID and click on "App registrations" and search for the monday.com application.
3. After selecting the monday.com app, navigate to "App roles" where you can view all roles and then click on "Create app role":
4. From the resulting screen, you can configure a new role. To learn more about creating new roles within Entra ID, check out this article. Here, you'll copy the custom role ID from monday.com to use as the "Display name" (instructions for this are outlined in number 5 below.)
5. The new role named under “Display name” will be the custom role ID from the monday.com platform. This can be taken from the account permissions center by clicking on the three-dot menu right next to the role name and then "Copy ID", as shown below.

   

 

Set-Up Team Provisioning

You can provision Groups from Entra ID to monday.com by assigning a Group to the monday.com application. Doing this will create a new Team in your monday.com account with all the users that are assigned to that group in Entra ID.

 

To do this, go to the application main page, and then go to "Users and groups":

Click "Add user":

 

Then, click "Users and groups":

Search for a group and select it from the list, and then click the "Select" button at the bottom.

 

Click the "Assign" button at the bottom-left side:

 

Error Handling

Please find the below table that contains error codes and their possible reason. Check out the third column for resolution suggestions:

 

FAQs

We've outlined a list of SCIM-related frequently asked questions for you. Click on this link here to check them out!

 

 

 

If you have any questions, please reach out to our team right here. We’re available 24/7 and happy to help.