Skip to content
  • There are no suggestions because the search field is empty.

SCIM Integration with Entra

Configure SCIM (System for Cross-domain Identity Management) provisioning between Entra ID (Microsoft Azure) and EasyLlama to automatically create, update, and deactivate learner accounts.

Before You Start

What You'll Need

  • Administrative access to the EasyLlama dashboard
  • Administrative access to Entra ID (Microsoft Azure) portal
  • Your EasyLlama Company ID (found in SCIM endpoint URL)
  • Understanding of your organization's user attributes and mappings
  • Test user accounts for validation

Quick Reference

  • SCIM Tenant URL: https://api.easyllama.com/scim/v2/[YOUR_COMPANY_ID]
  • Authentication: Bearer token (generated in EasyLlama)
  • Supported features: Create, Update, Delete users
  • Groups: Disabled by default (can be enabled if needed)

Configure SCIM Provisioning

Step 1: Generate SCIM Access Token in EasyLlama

  1. Log in to the EasyLlama dashboard.
  2. From the left navigation menu, click Settings > Integrations.
  3. Click the API tile, then click the three dots (⋮).
  4. Select Access Tokens.
  5. From the top right corner, click Create Access Token.
  6. Copy and save the generated token securely—this is the Secret Token and will not be shown again.

Step 2: Note the SCIM Tenant URL

The SCIM Tenant URL is:

https://api.easyllama.com/scim/v2/[YOUR_COMPANY_ID]

Find your Company ID:

  • From your EasyLlama dashboard, go to Settings > Integrations > API tile
  • The Company ID is the number at the end of the SCIM endpoint shown
  • Example: If URL shows https://api.easyllama.com/scim/v2/23456, the Company ID is 23456

Step 3: Create an Enterprise Application in Entra ID

  1. Log in to the Entra ID (Microsoft Azure) portal.
  2. Navigate to Enterprise applications > New application.
  3. Select Create your own application.
  4. Enter a name for the app (e.g., "EasyLlama SCIM Integration").
  5. Choose Integrate any other application you don't find in the gallery (Non-gallery).
  6. Click Create.

Step 4: Configure Provisioning

  1. In the new enterprise application, from the left menu, select Provisioning.

  2. Set Provisioning Mode to Automatic.

  3. Enter connection details:

    • Tenant URL: The SCIM Tenant URL from Step 2
    • Authentication Method: Bearer Token
    • Secret Token: The access token you generated in Step

  4. Click Test Connection.

    • You should see a green check mark in the upper right corner, confirming a successful connection.

  5. Store the connection settings by clicking Save.

 

Step 5: Configure Attribute Mappings

Disable Group Provisioning

Group provisioning is not currently supported.

  1. Expand the Mappings field.
  2. Click on Provision Microsoft Entra ID Groups.
  3. Set Enabled to No.
  4. Click Save.
  5. Verify the changes by clicking Yes. A green check mark appears in the upper right corner, confirming the action.
  6. Once back on the Provisioning page, refresh the screen to see changes take effect.
Configure User Attribute Mappings
  1. Expand Mappings, and click Provision Microsoft Entra ID Users.
  2. On the Attribute Mappings screen, under Target Object Actions, ensure Create, Update, and Delete actions are checked.
  3. Remove the default mappings that are not supported by clicking the Delete button. (see below for the list to keep.)

Create Custom Extension Attributes

Create the custom SCIM attributes for EasyLlama-specific fields:

  1. Click Show advanced options > Edit attribute list for customappsso.
  2. Remove the User Attributes that are not needed by clicking the Trash Can icon.
  3. Scroll to the bottom to add custom attributes, such as:
Name Type
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber String
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department OR urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:department String
urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:location String
urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:learnerRole String
name.middleName String
mobilePhone String
urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:training_tags String
urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:state String
urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:country String
       4. Once all unnecessary attributes have been removed and the desired ones are created,                 click Save.
      5. Verify you’d like to make the changes by clicking Yes.
Add New Mapping
  1. Back on the Attributes Mapping screen, click Add New Mapping.
Add Active Mapping
  1. Edit the Attribute for active in the following way:
    • For Mapping type, choose Expression
    • For Expression Value, enter this: Not([IsSoftDeleted])
    • For Target Attribute, select active
  2. When finished, click OK.
Add User Type
  1. Edit the Attribute for User Type in the following way:
    • For Mapping type, choose Constant,** or the option that best fits your use case.
    • For Constant Value, use learner, or what best fits your use case.
    • For Target Attribute, select userType
  2. When finished, click OK.
Add Location Mapping
  1. Edit the Attribute for Location in the following way:
    • For Mapping type, choose Constant or the option that best fits your use case.
    • For Constant Value, use “Location from SCIM” or what best fits your use case.
    • For Target Attribute, select urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:location.
  2. Click OK.
Add Learner Role Mapping
  1. Edit the Attribute for Learner in the following way:
    • For Mapping type, choose Constant or the option that best fits your use case.
    • For Constant Value, use “non-supervisor” or what best fits your use case.
    • For Target Attribute, select urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:learnerRole.
  2. Click OK.
Add Middle Name
  1. Edit the Attribute for Learner in the following way:
    • For Mapping type, choose Constant or the option that best fits your use case.
    • For Constant Value, use “Middle Name from SCIM” or another value that best fits your use case.
    • For Target Attribute, select name.middleName.
  2. Click OK.
Add Mobile Phone
  1. Edit the Attribute for Mobile Phone in the following way:
    • For Mapping type, choose Constant or the option that best fits your use case.
    • For Constant Value, use “11111111111” or the value that best fits your use case.
    • For Target Attribute, select mobilePhone.
  2. Click OK.
Add Training Tags
  1. Edit the Attribute for Training Tags in the following way:
    1. For Mapping type, choose Constant or the option that best fits your use case.
    2. For Constant Value, use the Training tag (found in EasyLlama) or the option that best fits your use case.
    3. For Target Attribute, select urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:training_tags.
  2. Click OK.
Save Mappings

Once all mappings have been created, click Save, then click Yes to verify.

Step 6: Create a Test User [Optional]

NOTE: You can also use an existing user if you do not wish to create a Test User.

  1. From the left navigation menu, click Users.
  2. Click + New User.
  3. Click Create New User.
  4. Complete the Basic information as required, then click Next: Properties to proceed.
  5. Complete the Identity, Job Information, Contact Information, and Parental Controls as desired, and click Next: Assignments to proceed.
  6. If desired, create Assignments, and click Next: Review + Create to proceed.
  7. Click Create to finish creating the new test user.

Step 7: Add Assignments to Users to Test

  1. Return to the Provisioning Page.
  2. Click Users and Groups
  3. Click + Add user/group.
  4. Under Users, click None Selected, and select a user.
  5. Click Select to confirm.
  6. Click Assign.

Step 8: Start Provisioning

NOTE: For more detailed information and instructions, please review Microsoft’s article on Provisioning on Demand.

  1. Return to the Provisioning page.
  2. Set Provisioning Status to ON.
  3. Click Save.
  4. To trigger the initial sync, click Provision on Demand.
  5. Type a user name into the text box, and select the user you’d like to test with.
  6. Click Provision.
  7. You will see the following logs. Ensure the attributes are pulling from the user as expected. You can also navigate to EasyLlama to ensure the user data has been imported successfully.

Step 9: Monitor and Verify

  1. Monitor Provisioning logs in Entra ID for errors.
  2. Check the EasyLlama Learners tab for newly provisioned users.
  3. Verify that:
    • Users are created with the correct attributes
    • Updates are syncing properly
    • Deleted users are deactivated in EasyLlama

Attribute Mapping Reference

EasyLlama Field SCIM Attribute Notes
First Name name.givenName Standard mapping
Last Name name.familyName Standard mapping
Email emails[type eq "work"].value Standard mapping
Location urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:location OR urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User: Custom attribute
Role urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:learnerRole Custom attribute (values: supervisor/non-supervisor)
Training Tags urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:training_tags Custom attribute (values: Training Codes from EasyLlama)
State urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:state Custom attribute
Country urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:country Custom attribute

Helpful Tips

Verify the Company ID in Tenant URL

Double-check your Company ID. Incorrect URL results in connection failures.

Save the Access Token once it’s generated

The token is only shown once. Save it securely immediately after generation.

Be sure to add custom attributes

EasyLlama’s Smart Assign requires state, country and role attributes. Standard SCIM attributes alone won't work.

Disable Group Provisioning

Group sync is not currently supported.

Quick Questions

What happens when I delete a user in Entra ID?

The user is deactivated in EasyLlama (not permanently deleted), preserving training history.

How often does provisioning sync?

Provisioning runs on a schedule you configure in Entra ID (typically every 40 minutes).

Why is my test connection failing?

Common causes include an incorrect Tenant URL, an expired/invalid access token, or network restrictions.

Llama Fact: Llamas are social animals that thrive in structured herds—similar to how SCIM provisioning creates structured, automated user management across your identity systems!