How to configure SCIM provisioning

Overview

SCIM provisioning allows you to automatically manage users in your cloud environment. Once enabled, Incydr creates new users, removes deactivated users, and updates user roles and permissions based on syncs with your provisioning provider. This article explains how to configure SCIM provisioning. 

The steps in this article give an overview of how to configure a SCIM provider that supports the SCIM 2.0 protocol. For directions specific to our supported provisioning providers, see:

• How to provision users to Incydr from Azure AD
• How to provision users to Incydr from Okta
• How to provision users to Incydr from PingOne

To learn more about provisioning concepts, see Introduction to SCIM provisioning.

Incydr User Directory Sync
Incydr User Directory Sync is another option for automating user management, similar to SCIM provisioning. However, User Directory Sync has different requirements and a different setup process. For more information, see Configure Incydr User Directory Sync. 

Considerations

• To use this functionality, you must be assigned the Identity Management Administrator role. 

• The Incydr provisioning feature requires you to connect a third-party provisioning provider to Incydr. The following are the basic requirements that your provider and your environment need to meet to integrate correctly:
  • SCIM 2.0: Incydr requires a provisioning provider to use the SCIM 2.0 protocol.
  • SCIM groups: The custom SCIM mapping and role mapping require that your provider uses SCIM groups. Other provisioning features are available without SCIM groups.

Before you begin 

Determine how you want to map users from the provisioning provider to Incydr organizations. To learn more, see our introduction to provisioning article. There are several ways to map users to a Incydr organization: 

Create new users in an Incydr organization

Assigns all users to the same organization. New users are moved to this organization. Users that are subsequently moved outside of this organization remain in their new organization. 

Example use case
Use this option if you use a single organization to manage all users.

Map users to organizations based on the provider's "c42OrgName" attribute  

Creates new organizations or assigns users to existing organizations based on the value for the user attribute c42OrgName. This value becomes the name for the Incydr org. This attribute is managed on the provisioning provider. 

Example use case
Use this method if you wish to manage users in the provisioning provider (and not in the Incydr console). Whatever is the value for this attribute becomes the name for the Incydr org. Incydr creates new organizations or assigns users to existing organizations based on the value. 

Map users to organizations using SCIM groups

Assigns users to Incydr organizations based on their SCIM group. If you choose this option, create organizations in the Incydr console before you begin.

Example use case
Use this mapping if your users are already assigned to SCIM groups. For example, a user is part of two different SCIM groups: an executive group and a UK group. You want this user's backup policies to match the other executives in your company, so this user should be assigned to the same Incydr organization as the other executives. In the Incydr console, you can choose the executive group to take priority over the UK group. This way you can place all of the executives in your company in the same organization and ensure they have the same backup policies.

Compare methods

	Automatically creates organizations in Incydr	Requires you to create Incydr organizations before you begin	Requires your provider to send SCIM groups to Incydr
Create new users in a Incydr organization		x
Map all users to organizations based on the provider's "c42OrgName" attribute	x
Map users to organizations using SCIM groups		x	x

Step 1: Create Incydr organizations 

This step is only required if you choose to use the Single Organization or Custom SCIM mapping methods. The "c42OrgName" attribute and Custom attribute methods create Incydr organizations automatically.

1. Sign in to the Incydr console.
2. Select Administration > Environment > Organizations.
3. Click Create organization.
4. Enter a descriptive name for the organization.
   Names must contain at least 3 characters, to a maximum of 220 characters.
5. To automatically assign the new organization to a parent organization, select an existing organization from the Parent organization list.
   By default, new organizations are created as children of your top-level organization, but you can select a different parent organization if needed. When you add a child organization using the Actions menu on the organization detail screen, the new organization is automatically created as a child of that existing organization and this list is not available.
6. Click Create to add the new organization.
7. Repeat until you have added all of your organizations.

Organization inheritance
Child organizations inherit the settings of their parent organization by default. To edit the settings for a child organization, go to the organization details and change the Inherit settings from parent organization setting as needed.

Step 2: Add a provisioning provider in the Incydr console

1. In the Incydr console, navigate to Administration > Integrations > Identity Management.
2. Select the Provisioning tab.
   
3. Click Add Provisioning Provider and select Add SCIM Provider from the menu.
4. Enter a display name and select the Authentication Credential Type:
   • API credentials (default)
     Generates a password.
   • OAuth token
     Generates a token for use with SCIM providers who accept OAuth tokens for credentials.
5. Click Next.
6. The SCIM Provider Created message appears. Leave this message open. You need this information for the next step in the provisioning provider setup.
   After you have used the information here for provisioning provider setup, click Done.
   
   

Step 3: Configure your provisioning provider

The steps for configuration vary by provisioning provider. See your provider's documentation for more details. When finished obtaining the information from the Add SCIM Provisioning dialog, click Done. The provisioning provider details appear. 

(Optional) Step 4: Edit deactivation delay

In the Incydr console, view the provisioning provider details and select Deactivation Delay. 

The deactivation delay determines how long Incydr waits to deactivate a user after syncing with the provisioning provider. To learn more about user deactivation, see Deactivate and reactivate users and devices.

Backup agent only: Although Incydr may be configured to wait, Incydr does immediately block a user once they receive deactivation update from the provisioning provider. Blocking a user means they can no longer sign in to agents, but their devices continue to back up. The delay helps prevent accidentally deactivating a user and removing their backup archive. If you need to cancel a pending user deactivation during the delay period, unblock the user.

Deactivation of users on legal hold Backup agent only If users who are custodians under a legal hold are subsequently selected for deactivation (for example, from the Incydr console, a provisioning provider, or API), they are not deactivated immediately because their data must be retained for legal hold purposes. Instead, they are blocked. Once these blocked users are released from legal hold, they are deactivated automatically. 

Step 5: Push SCIM groups to Incydr

Groups pushed to Incydr are used to map users to organizations, roles, and watchlists. To push SCIM groups from the provisioning provider to Incydr, see your provider's documentation. If you are not using groups, continue to the next step.

For more information about pushing groups to Incydr, see our instructions for:

• Azure
• Okta

SCIM groups are not supported for PingOne.

Apply changes after mapping SCIM groups

If you want to map SCIM groups to Incydr organizations in Step 6 or roles in Step 7, you must first push or provision SCIM groups and their users to Incydr so they are available in the Incydr console. 

However, this means that initially the users are provisioned in the default organization and are assigned default roles rather than the ones you want to map them to. To move these users to the desired organizations and roles, ensure that you map SCIM groups to organizations (Step 6) and roles (Step 7) and then apply the mappings using the Apply Org and Role Settings action.  

Step 6: Choose an organization mapping method

The mapping method determines how Incydr assigns users to organizations. Organizations are used to set backup policies and permissions for users in your environment. To change the method, go to Organization Mapping, and click Add Organization Mapping or the edit icon. 

The Edit Organization Mapping Method dialog is displayed.

In the Edit Organization Mapping Method dialog, choose one of the following mapping methods:

Create new users in an organization

Assigns all users to the same Incydr organization.

1. In Edit Organization Mapping Method, choose Create new users in the organization below.
2. Select an existing organization to map all users to. 

Map users to organizations based on the provider's "c42OrgName" attribute

Creates new organizations or assigns users to existing organizations based on the value for the user attribute c42OrgName.

1. In Edit Organization Mapping Method, choose Map users to organization based on the provider's "c42OrgName" attribute.
2. Choose an organization where unmapped users will be assigned. Unmapped users are users who do not have the c42OrgName attribute.  

Map users to organizations using SCIM groups

Assigns users to Incydr organizations based on their SCIM group. You can also choose the priority of which organization a user is mapped to if they belong to two or more groups.

1. In Edit Organization Mapping Method, choose Map users to organizations using SCIM groups. 
2. Choose an organization where unmapped users will be assigned. Unmapped users are users who either do not belong to a group or their group is not mapped.
3. Click Save. 
   The group mapping appears. 
4. Click Add Mapping.
5. Select one or more SCIM groups.
   
6. From Select an organization, choose an organization from the menu.
7. Click Save. 
   The mapping appears on the Provisioning Provider details page. 
8. Repeat until all of your SCIM groups have been mapped to Incydr organizations. 
   The message All SCIM groups are mapped appears.
   
9. (Optional) Adjust the priority of each mapping. This is useful for users who belong to more than one SCIM group. 

There are no SCIM groups available

This message appears if SCIM groups have not been synced with the Incydr console. Push groups to the Incydr console to begin organization mapping. 

Wait to assign people or groups to the Incydr application in the provisioning provider
Do not assign people to the Incydr application in the provisioning provider yet. Wait until after you have completed the organization mapping and role mapping. If you assign people to the Incydr application before you configure mapping, the users are not automatically mapped to Incydr organizations and roles.  

Step 7: Configure role mapping

Role mapping allows you to automatically assign Incydr roles and permissions to provisioned users based on their SCIM group. Learn more about Incydr roles and permissions. Users who are not mapped inherit the default roles for their organization. 

SCIM Groups
Role Mapping is only available if you are using SCIM groups. 

1. Click Add Role Mapping.
2. Select a SCIM group from the dropdown. 
   Only groups that have not been mapped appear in the dropdown.
   
3. Choose one or more roles from the list to apply to this SCIM group. Learn more about Incydr roles and permissions.

Basic roles If the insider risk agent is deployed to users in this group, include the Agent User role. If the backup agent is deployed to users in this group, include the Desktop User and PROe User roles. These roles allow users to sign in to the agent and Incydr console to manage their backups and restore their files. If you are giving external groups access to your environment (for example, outside legal counsel) they do not need these roles.

4. Click Add. 
   The role mapping appears under the provisioning provider details. 
5. Repeat until all of your SCIM groups have been mapped to Incydr organizations. 
   The message All SCIM groups are mapped appears. 

There are no SCIM groups available

This message appears if SCIM groups have not been synced with the Incydr console. Push groups to the Incydr console to begin role mapping. 

Wait to assign people or groups to the Incydr application in the provisioning provider
Do not assign people to the Incydr application in the provisioning provider yet. Wait until after you have completed the organization mapping and role mapping. If you assign people to the Incydr application before you configure mapping, the users are not automatically mapped to Incydr organizations and roles.  

Step 8: Assign the Incydr app users or groups in the provisioning provider

Users will not appear in Incydr until you assign them to the Incydr application in your SCIM provisioning provider. Create a test user and assign the Incydr application to the test user before assigning the app to all of the groups. Once you assign the Incydr application to a group or user, the SCIM provisioning provider immediately syncs with Incydr and provisions the users.

See your SCIM provider's documentation for more information about assigning apps to users and groups. 

Configure directory sync email frequency (optional)

By default, Incydr emails a daily summary of recent directory sync activity to all users with the Customer Cloud Admin role. To change this frequency:

1. Go to Administration > Integrations > Identity Management.
2. Click Settings.
3. Choose how often to send emails:
   • Daily
   • Only when there are directory sync errors
   • Never
4. Click Save.

The selected frequency applies to all provisioning providers and Customer Cloud Admin users in your environment.

Troubleshooting

Tips for troubleshooting SCIM provisioning: 

• Once SCIM provisioning is configured in Incydr, you should make all user changes in the SCIM provisioning provider. Incydr does not make changes to the provisioning provider, so any changes made on the Incydr side causes the two apps to become out-of-sync.
• Updating the Incydr console does not start a sync between the SCIM provisioning provider and Incydr. Only changes made in the provisioning provider can start a sync.
• To view more information about provisioning changes and logs, see the Sync Log in the Incydr console. This gives details of all of the users that have been created, updated, or deleted due to provisioning. 

Need more help?
Contact our Technical Support Engineers​.

Related topics

• Introduction to SCIM provisioning
• How to provision users to Incydr from Azure AD
• How to provision users to Incydr from Okta
• How to provision users to Incydr from PingOne
• Identity management reference