SCIM provisioning with Azure AD
On this page
Automatic provisioning through SCIM is available starting in Enterprise Edition.
You can enable SCIM to automate user and group provisioning from Azure AD to SonarQube. For an overall understanding of the feature, read the SCIM Overview page.
Prerequisites
You have a working SAML configuration.
Configuring SonarQube
1. Within SonarQube, go to Administration > Authentication > SAML.
2. Under Provisioning, click Automatic user and group provisioning with SCIM.
3. Click Save and validate the pop-up window if you are sure you want to enable SCIM.
SCIM is now enabled in SonarQube, it will handle all the queries coming from Azure AD about users and groups.
Configuring Azure AD
Step 1: In Azure AD, go to Your SonarQube application > Provisioning.
![](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/ddaed361-26df-4a75-afab-ab0cbf87b508/azure-scim-provisioning-menu.png?w=282&h=476&auto=format&fit=crop)
Step 2: On the Provisioning page, click Get started.
Step 3: Under Provisioning Mode, select Automatic.
![](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/66d61755-d819-4fac-97d1-ca3b0c32f48a/azure-scim-provisioning-mode.png?w=1106&h=247&auto=format&fit=crop)
Step 4: Configure the Admin Credentials section as follows:
- Tenant Url:
<Your SonarQube URL>/api/scim/v2
- Secret token: Paste a SonarQube user token for an admin account in this field. For safety reasons, we recommend using a token from a local admin account (not managed through SCIM).
![](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/24dddd53-bb87-4c5f-8e18-b8b12e9d67d4/azure-scim-admin-credentials.png?w=926&h=254&auto=format&fit=crop)
Click Test Connection to check that your credentials are valid, then click Save.
Step 5.a: Under Mappings, click on Provision Azure Active Directory Groups. This opens the Attribute Mapping dialog for groups.
Step 5.b: Under Target Object Actions, make sure that Create, Update, and Delete are enabled.
![](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/e9c5fe30-a56d-4672-9e54-d3a6004b6302/attribute-mapping-groups.png?w=743&h=574&auto=format&fit=crop)
Step 5.c: In Attribute Mappings, make sure displayName
appears in both columns of the mapping. This ensures groups are mapped based on their names.
![How to set up attribute mappings for groups in Azure AD](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/b4dfe6a9-55ab-47f9-a08d-310f7d02585e/scim-attribute-mappings-azure.png?w=1119&h=202&auto=format&fit=crop)
Step 5.d: Click Save. This takes you back to the Provisioning page. If this was the default configuration, go back to the previous page.
Step 6.a: Under Mappings, click on Provision Azure Active Directory Users. This opens the Attribute Mapping dialog for users.
Step 6.b: Under Target Object Actions, make sure that Create, Update, and Delete are enabled.
Step 6.c: In Attribute Mappings, map the userName
customappsso Attribute (target) to the Azure Active Directory Attribute (source) used as SAML user login attribute in your SAML configuration. If you use the email address in your SAML configuration, use mail
here.
![How to set up attribute mapping for users in Azure AD](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/3618af9f-a4aa-4e35-897f-41f2fa489ebd/azure-scim-attribute-mappings.png?w=1091&h=196&auto=format&fit=crop)
This attribute mapping must match your SAML configuration to prevent the creation of duplicate accounts. To check which Azure AD attribute is used as SAML user login attribute, in SonarQube, go to Administration > Authentication > SAML user login attribute.
Step 6.d: Click Save. This takes you back to the Provisioning page.
Step 7: In the Settings > Scope section, select Sync only assigned users and groups.
![](https://assets-eu-01.kc-usercontent.com:443/5e986e54-339c-01a9-7c7c-26cbc5a344d5/e74681b1-54f8-4830-bf84-752fec184392/azure-scim-settings.png?w=1097&h=333&auto=format&fit=crop)
Step 8: Set the provisioning status to On and click Save. The Azure AD users and groups will be synchronized with SonarQube.
Azure AD runs a SCIM synchronization every 40 minutes. Changes in Azure AD are not reflected immediately in SonarQube.
Was this page helpful?