{"pageModel":{"attributes":{"id":"","name":"119465.dita","viewName":"DitaDetail"},"elements":{"ditaContent":{"name":"DITAContent","value":"
\r\n

Provision Users and Groups from Microsoft Entra ID

\r\n
\r\n

Secure Access supports the provisioning of users and groups from Microsoft Entra ID (formerly Azure Active Directory).

\r\n

With your Secure Access System for Cross-domain Identity Management (SCIM) token, configure the Cisco User Management for Secure Access app on the Microsoft Enter ID portal. When you configure and provision users and groups through the app, Microsoft Entra ID exchanges user and group information with Secure Access.

\r\n

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n
 		\r\n
You do not need to deploy an on-premises Cisco Active Directory (AD) Connector.
\r\n
\r\n

\r\n
\r\n

Limitations

\r\n
    \r\n
  • You can provision a maximum of 1000 groups from Microsoft Entra ID to Secure Access. Secure Access supports the provisioning of an unlimited number of users from Microsoft Entra ID. For more information, see Limitations and Range Limits.
    • \r\n
  • Concurrent synchronization of the same users and groups from the Cisco AD Connector and the Cisco User Management for Secure Access app is not supported and leads to inconsistent access rule enforcement.
    • \r\n
  • To ensure that all users are provisioned, create a dynamic All Users group and assign this group to the Cisco User Management for Secure Access app. For more information, see Dynamic Membership Rules for Groups in Azure Active Directory. You can assign additional groups as required for group-based access rule enforcement.
    • \r\n
  • Guest users invited to your Microsoft Entra ID tenant are provisioned to the same Secure Access user group as all other users provisioned by Microsoft Entra ID. Since members of the same user group inherit the same access rules in Secure Access, this may result in your Entra ID guest users gaining access to resources intended only for your Entra ID member users.
    • \r\n
  • Provisioning large numbers of users and groups to Secure Access may take several hours.
    • \r\n
  • Microsoft Entra ID does not support nested group memberships for group-based assignment to any SaaS application.
    • \r\n
  • After the initial provisioning of users and groups, Microsoft Entra ID synchronizes changes to Secure Access once every 40 minutes. Synchronization of updates to identities from Microsoft Entra ID to Secure Access may take up to one hour.
    • \r\n
\r\n
\r\n
\r\n

Refresh SCIM Token

\r\n

We recommend that you refresh the SCIM token at least once every 90 days. Secure Access requires a valid SCIM token to provision the users and groups from Microsoft Entra ID to Secure Access.

\r\n

After you generate a new SCIM token, immediately copy the token to the Cisco User Management for Secure Access app in Microsoft Entra ID.

\r\n

For information about refreshing the SCIM token, see Add a Cloud Identity Provider.\r\n

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n
 		\r\n
The administrators in the Secure Access organization are responsible for refreshing the SCIM token. Secure Access does not perform this action.
\r\n
\r\n
\r\n
\r\n

Supported Attributes for Users

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Cisco Attributes for UsersMicrosoft Entra ID Attributes
userNameuserPrincipalName
activeNot([IsSoftDeleted])
displayNamedisplayName
name.givenNamegivenName
name.familyNamesurname
name.formattedJoin(\" \", [givenName], [surname])
externalIdobjectId
\r\n
\r\n
\r\n

Supported Attributes for Groups

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Cisco Attributes for GroupsMicrosoft Entra ID Attributes
displayNamedisplayName
externalIdobjectId
membersmembers
\r\n
\r\n
\r\n
\r\n","ditaVal":"","format":"html"},"bookTitle":{"value":""},"shortDescription":{"value":""}}},"parameters":{"appId":"SecureAccess","topicAlias":"provision-users-and-groups-from-azure-ad"}}