HashiCorp Cloud Platform
Configure SCIM for Entra ID
This topic describes how to configure SCIM (System for Cross-domain Identity Management) provisioning on HashiCorp Cloud Platform (HCP) for Microsoft Entra ID. Refer to the SCIM overview to learn about SCIM in HCP.
Prerequisites
- You must configure SAML SSO in your organization for Entra ID. Refer to Set up SAML SSO for instructions.
- You must have a Microsoft Entra tenant
- You must have a custom application with SAML SSO enabled for your HCP organization
Enable SCIM provisioning on HCP
First, enable SCIM provisioning on HCP to obtain the credentials needed for configuration with Entra ID. Enabling SCIM disables the SSO default roles assignments.
- Log in to HCP and go to your organization.
- Click Organization settings and then SCIM provisioning.
- Click Enable SCIM provisioning.
- Click Generate SCIM token.
- Copy and save the token value. You need this token to configure your identity provider.
- Copy the Base URL. You need this URL to configure your identity provider. HCP generates a URL for Entra ID and non-Entra ID IdPs. Verify that you copy the URL for Entra ID.
You can keep this page open so that you can return to it after configuring Entra ID.
Configure Microsoft Entra ID
After you enable SCIM on HCP, configure your identity provider to sync users and groups to HCP.
Sign into the Microsoft Entra admin center and select Enterprise applications from the Application side navigation.
Click All Applications and navigate to your custom application for HCP.
Click Provisioning, then select Get started or New configuration.
Configure the following fields in the Admin credentials section:
- In the Tenant URL field, enter the value from the Base URL field you copied from HCP. Append the URL with
?aadOptscim062020. Refer to the Entra Id documentation to learn more about this Azure feature flag. - In the Secret token field, enter the SCIM token you copied from HCP.
- In the Tenant URL field, enter the value from the Base URL field you copied from HCP. Append the URL with
To verify the configuration, select Test Connection.
If the conncetion is successful, click Create. Otherwise, refer to Troubleshoot SCIM provisioning for guidance.
Click Start provisioning.
Assign users and groups
To assign users and groups, click on Manage, then select Users and groups. After assigning users and groups, Entra ID creates and updates users in HCP automatically. You can also select Provision on demand. Refer to the Entra ID documentation for more information.
Map Entra ID attributes to HCP users
Configure the following Microsoft Entra ID attributes for users in HCP. Remove any default mappings that are not listed in this table. Refer to the Entra ID documentation for information about mapping Entra ID attributes.
| Microsoft Entra ID attribute | SCIM attribute | Required |
|---|---|---|
userPrincipalName | userName | Yes |
mail | emails[type eq 'work'].value | Yes |
givenName | name.givenName | Yes |
surname | name.familyName | Yes |
displayName | displayName | No |
Switch([IsSoftDeleted], , 'False', 'True', 'True', 'False') | active | No |
Join(' ', [givenName], [surname]) | name.formatted | No |
mailNickname | externalId | No |
The email identifier for each user is derived from the Email field under Contact information in Microsoft Entra ID. Updates to the User principal name field are not reflected in HCP.
Map Entra ID attributes to HCP groups
Configure the following Microsoft Entra ID attributes for groups in HCP
| Microsoft Entra ID attribute | SCIM attribute | Required |
|---|---|---|
displayName | displayName | Yes |
members | members | No |
externalId | externalId | No |
Assign roles
It is optional, but after configuring Entra ID, return to the SCIM provisioning page as described in Enable SCIM provisioning on HCP. Click View role assignments to view and manage roles in your account. The role-based access control (RBAC) system in HCP define which actions members of your organizations and projects can perform. Refer to Access Management for more information about RBAC in HCP and instructions on how to manage and assign roles.
Disable SCIM provisioning
You can disable SCIM provisioning at any time. When you disable SCIM provisioning, users and groups remain in HCP, but their lifecycle management transfers from your identity provider to HCP:
- Log in to HCP and go to your organization.
- Click Organization settings and then SCIM provisioning.
- Click Manage and then Disable SCIM provisioning.
- Type
DISABLEto confirm the action. - Click Disable.
After you disable SCIM provisioning, you can manage users and groups directly in HCP or through your SSO provider.