SCIM provisioning using Entra ID (Azure AD)

Account owners and admins can use System for Cross-Domain Identity Management (SCIM) to provision users and groups from Entra ID (formerly Azure Active Directory) to applications automatically. For the Entra ID side, follow Microsoft's guide to provisioning users and groups with SCIM.

Generate a SCIM token in Robin

1. Sign in to your Robin account dashboard: https://dashboard.robinpowered.com/login

2. Go to Manage > Integrations > SCIM Provisioning > Manage.

   

3. Select Generate Token for SCIM.

   

4. Copy the token into the Secret Token field in Entra ID.

If you lose the token, select Revoke Token, then generate a new one and enter it in Entra ID. Provisioning stops until you do. People already in Robin stay in Robin.

Set up provisioning in Entra ID

1. Go to Microsoft Entra admin center > Enterprise Applications, and select New application > Create your own application > Non-gallery application.

2. Enter a name for your application, and select Add to create an app object.

3. Select Provisioning in the left column.

4. In the Provisioning Mode menu, select Automatic.

   

5. In the Tenant URL field, enter the URL of the application's SCIM endpoint:

   https://api.robinpowered.com/v1.0/scim-2

6. In the Secret Token field, enter the token you generated in Robin.

7. Under "Settings", set the Scope to Sync only assigned users and groups.

8. In the left menu, under "Manage", select Users and Groups. Add the users and groups you want to provision to Robin.

9. In the Provisioning tab, select Start Provisioning.

Users should appear in your Robin account within a few minutes.

User attribute mapping

The preconfigured app does not support the department attribute.

Robin requests these User attributes:

These Optional user attributes are also available:

• department
• costCenter
• division
• employeeNumber
• locale
• title
• manager
• preferredLanguage

To sync optional attributes, create a new attribute mapping, choose the fields and set the correct schema. For example, to sync department, add a new attribute and set the mapping as the example shows. Use these schemas:

• For title, locale or preferredLanguage, use the core user schema, urn:ietf:params:scim:schemas:core:2.0:User.
• For department, costCenter, division, employeeNumber or manager, use the enterprise user schema, urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.

Group attribute mapping

Set up the group attribute mapping in Entra ID.

Robin requests these Group attributes:

Sync managers

To sync managers into Robin, add the manager attribute to the mappings. Its value should match the manager's externalId in Entra ID.

For example, UserA has the Entra ID 3cd19cd0-ba07-4171-86db-50d8d7694e19, and UserB has the Entra ID 01972a50-2801-4f06-a403-b41f9f04206e. To make UserA the manager of UserB, set the manager field of UserB to 3cd19cd0-ba07-4171-86db-50d8d7694e19. This value is UserA’s Entra ID.

You find the Entra ID in the user’s profile in Entra ID, under Overview → Object ID.

Entra ID must send each user’s Entra ID as externalId. The manager must also be provisioned to Robin through SCIM, in the same Robin organization.

Robin links managers every 3 hours. It links only people whose record changed since the previous evening. If you add the manager later, change any attribute on the employee so your identity provider sends an update. Robin then links the manager.