SCIM and Microsoft Entra for employee sync

With SCIM you sync employees from your identity platform, such as Microsoft Entra ID, to Epassi. This article covers SCIM and the setup in Microsoft Entra.

SCIM Integration

With the SCIM integration, changes in your identity provider: such as Microsoft Entra or Okta: are automatically synced to Epassi. This means new employees are onboarded, updates are applied, and leavers are offboarded without any manual action in Epassi.

Epassi supports SCIM 2.0. Official SCIM documentation from Microsoft can be found here (https://learn.microsoft.com/en-us/entra/architecture/sync-scim) .

Before you start

You will need the following from Epassi. Request these via manager-support@epassi.nl: they will be shared with you securely:

• Tenant URL: the SCIM endpoint for your Epassi environment
• Client Identifier
• Client Secret

Setup in Microsoft Entra

Step 1: Create a new enterprise application:

1. Sign in to the Microsoft Entra admin center as at least an Application Administrator.
2. Go to Entra ID → Enterprise applications.
3. Select + New application → + Create your own application.
4. Enter a name for the application and select Integrate any other application you don't find in the gallery.
5. Click Add. The new app opens in its management screen.

Step 2: Configure provisioning

1. In the app management screen, select Provisioning in the left panel.
2. Select + New configuration.
3. Select OAuth2 client credentials grant as Authentication method
4. In the Tenant URL field, enter the SCIM endpoint URL provided by Epassi.
5. For the OAuth token endpoint use https://api.yourcampus.co/customer_api/v1/oauth/token
6. Enter the Client Identifier and Client Secret provided by Epassi.
7. Click Save. You should see a success confirmation.

ex

Step 3: Start provisioning

Go to the Provisioning section and start the provisioning process.

Microsoft Entra for Employee Sync

Note: In order to allow the Alleo Login application, you will need to have administrative rights.

Step 1

Request an authentication URL from your customer success representative.

Step 2

Allow the following app client id 891a955d-8d0a-4b83-99b8-eed0f31c77ca in your Entra App otherwise follow the URL given by the customer success representative.

You can view and manage your authorized applications in https://entra.microsoft.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview

Step 3

Authorize the app in the authorization screen after following the previously provided URL

• The following scopes are required User.Read.All Group.Read.All openid profile offline_access

After completing these steps the integration will be enabled and users will be on and offboarded daily, in Epassi.