Skip to main content
This guide walks you through configuring SCIM provisioning for the Brellium application using Microsoft Entra ID (formerly Azure Active Directory). SCIM provisioning enables you to manage user lifecycle operations from Microsoft Entra ID.

​
Prerequisites

Before you configure SCIM provisioning, ensure you have:
  • Administrator access to your Microsoft Entra ID tenant
  • A Brellium admin account with permissions to authorize integrations
  • The Brellium application registered in your Microsoft Entra ID tenant
  • SSO configured for Brellium (see the SSO Configuration for Microsoft Entra ID guide)
  • SCIM Tenant URL and Secret Token from Brellium (contact your customer success manager or Brellium support)

​
Supported features

The Brellium SCIM integration supports the following provisioning features:

​
Supported profile attributes

The following SCIM attributes are supported for user provisioning between Microsoft Entra ID and Brellium:

​
Core attributes

​
Enterprise User extension attributes

The following attributes use the urn:ietf:params:scim:schemas:extension:enterprise:2.0:User schema namespace.
The SCIM userName attribute in Brellium follows an email address format. Ensure the userName attribute is mapped to a UPN or email field in Microsoft Entra ID that uses an email address format.

​
Configuration steps

1

Verify the SSO application

Before creating the SCIM application, verify that the enterprise application you created for Single Sign-On is configured correctly.
  1. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications.
  2. Select the application you created for Single Sign-On.
  3. Go to Manage > Properties.
  4. Confirm that Assignment required? is set to Yes.
Enterprise application Properties page showing Assignment required set to Yes

Enterprise application Properties — verify Assignment required is set to Yes

2

Create a SCIM application

SCIM provisioning requires a separate non-gallery enterprise application in Microsoft Entra ID.
  1. Go back to Enterprise applications and click New application.
Enterprise applications page showing the New application button

Enterprise applications — click New application

  1. Click Create your own application.
  2. Enter a name for the application (e.g., Brellium SCIM).
  3. Select Integrate any other application you don’t find in the gallery (Non-gallery).
  4. Click Create.
Create your own application dialog with Non-gallery option selected

Create your own application — select Non-gallery

3

Assign users and groups

Assign the same users and groups to the SCIM application as those assigned to the SSO application.
  1. In the newly created SCIM application, go to Users and groups under Manage.
  2. Click Add user/group.
  3. Select the users or groups to assign and click Assign.
SCIM application Users and groups page with Add user/group button

Users and groups — assign the same users as the SSO application

You must assign the same users and groups to the SCIM application as those in the SSO application. If users are not assigned to both applications, provisioning will not work correctly.
4

Configure provisioning

  1. In the SCIM application, go to Provisioning under Manage.
  2. Set Provisioning Mode to Automatic.
  3. In the Admin Credentials section, enter the following:
    • Tenant URL: Provided by Brellium
    • Secret Token: Provided by Brellium
  4. Click Test Connection to verify the credentials.
  5. Click Save.
Contact your Brellium customer success manager or Brellium support to obtain the SCIM Tenant URL and Secret Token for your organization.
5

Configure attribute mappings

  1. In the Provisioning section, expand Mappings.
  2. Click Provision Microsoft Entra ID Users.
  3. Review the attribute mappings and ensure the following are configured:
    • userPrincipalName → userName
    • mail → emails[type eq "work"].value
    • givenName → name.givenName
    • surname → name.familyName
    • jobTitle → title
  4. Click Save.
Microsoft Entra ID provides default attribute mappings for standard SCIM attributes. Review the mappings to ensure they match your organization’s directory structure.
6

Configure scope and start provisioning

  1. In the Provisioning section, go to Settings.
  2. Set the Scope to one of the following:
    • Sync only assigned users and groups — Only users and groups assigned to the Brellium SCIM app are provisioned.
    • Sync all users and groups — All users in the directory are provisioned.
  3. Set Provisioning Status to On.
  4. Click Save.
Microsoft Entra ID begins the initial provisioning cycle. The initial cycle may take longer than subsequent cycles.
For most organizations, Sync only assigned users and groups is recommended to maintain control over which users have access to Brellium.
7

Verify provisioning

  1. In the Provisioning section, check the Provisioning logs for the status of provisioned users.
  2. In Brellium, verify that the provisioned user accounts were created with the correct profile attributes.
  3. Update a test user’s profile in Microsoft Entra ID (for example, change the job title or department).
  4. Verify that the profile update is synced to Brellium.
  5. Unassign a test user from the Brellium app in Microsoft Entra ID.
  6. Verify that the user is deactivated in Brellium.

​
Troubleshoot

​
Support

If you have questions or encounter issues not covered in this guide, contact the Brellium support team: