Configuring SCIM for Microsoft Entra ID

In this article, you'll learn how to configure SCIM with Microsoft Entra ID (formerly Azure Active Directory). Configuring SCIM for Microsoft Entra ID will allow you to add and manage users and groups in your KMSAT console using Microsoft Entra ID.

The instructions in this article are for third-party software. If you experience issues with user provisioning in Microsoft Entra ID, we recommend reaching out to Microsoft Entra for specific instructions. You can also contact our support team and we will be happy to assist you.  

Jump to:

Configuring SCIM

Defining Which Users and Groups to Sync from Microsoft Entra

Starting Your Sync

Advanced Configuration Options

• Default Mappings
• Changing Default Mappings
• Adding Attribute Mapping for Custom User Fields

Frequently Asked Questions (FAQ)

Configuring SCIM

In this section, you'll learn how to configure your SCIM settings with Microsoft Entra. Please note that you should configure these steps after you've configured your settings in your KMSAT console. For more information about configuring SCIM in your KMSAT console, see our SCIM Configuration Guide.

To configure your SCIM settings with Microsoft Entra, follow the steps below:

1. Log in to your Microsoft Entra portal and navigate to Microsoft Entra ID.
   
2. From the Applications drop-down menu, click Enterprise applications.
   
3. Click + New application.
   
4. In the search bar, enter "KnowBe4" to filter your results. 
5. Click the KnowBe4 Security Awareness Training tile.  
   
6. Then, click Create. After you click Create, you'll be redirected to the Overview page for the application that you created. If you are not directed to the Overview page, you'll need to open the application from the list of Enterprise applications.
7. Select the Provisioning tab from the menu on the left side of the page.
8. Click Get started.
   
9. Click the Provisioning Mode drop-down menu, and then select Automatic.
   
10. Next, you'll need to enter the information from your Account Settings page. For more information about where you can find this information, see our SCIM Configuration Guide. In the Tenant URL field, enter the Tenant URL, and in the Secret Token field, enter the SCIM Token. 
    

    Note: This feature does not currently work with on-demand provisioning.

11. After you’ve entered your information, click the Test Connection button. Clicking this button will allow you to ensure that you entered the correct information. If the connection is successful, a success banner will display at the top-right corner of your screen.
    
12. Click the Save button at the top of the screen.

Next, you'll need to define which users and groups you would like Microsoft Entra ID to sync with your KMSAT console.

Back to top

Defining Which Users and Groups to Sync from Microsoft Entra

After completing the steps in the Configuring SCIM section above, you can decide which users and groups you would like to sync. This configuration is required in order to sync users and groups from your identity provider (IdP).

To define which users and groups you would like to sync from Microsoft Entra ID, follow the steps below:

1. From your Microsoft Entra ID, navigate to Enterprise applications.
2. Select the application you created for your KnowBe4 connection.
3. Click Users and groups from the menu on the left side of the page.
   
4. Click Add user/group to select the users or groups that you would like to sync.
5. Click Users and groups to search for users or groups that you would like to include in your sync. To add a user or group, click on the name of the user or group. They will now show in the Selected items category.
   

   Note: We recommend that you only include a few users when you first configure your settings. Starting with a few users allows you to ensure that the connection works properly before you add all the users and groups that you want to include.

   
   
6. After you’ve added the users and groups you want to include to the Selected items category, click Select.
7. Click Assign.

The users and groups that you selected will now display in the table.

Back to top

Starting Your Sync

After you have configured SCIM and have added the users and groups that you want to sync, you'll need to start the sync. Once you start the sync, the system will automatically check for changes to your users and groups in Microsoft Entra ID every 40 minutes and will initiate a sync if changes were made.

To start your sync, follow the steps below:

1. From your Microsoft Entra ID, navigate to Enterprise applications.
2. Select the application that you created for your KnowBe4 connection.
3. From the menu on the left side of the page, select Provisioning.
4. Click Start provisioning.
   

The sync will be initiated immediately. After your initial sync, the system will check for changes to your Microsoft Entra ID every 40 minutes and will initiate a sync if changes were made.

To see the status of these syncs as well as any errors and additional information about your syncs, navigate to Users > Provisioning in your KMSAT console.

Back to top

Advanced Configuration Options

By enabling SCIM, the fields in your identity provider are automatically connected to the corresponding fields in your KMSAT console. If you want to change the default mapping or add custom fields, you have the option to update these fields in Microsoft Entra.

To learn more about advanced configuration options for Microsoft Entra, see the subsections below:

Default Mappings

The default field mappings are shown below:

Back to top

Changing the Default Mappings

You can change the default mappings to customize the user information that syncs between Microsoft Entra and your KMSAT console.

To change the default mappings, follow the steps below:

1. From your Microsoft Entra ID, navigate to Enterprise applications.
2. Select the application you created for your KnowBe4 connection.
3. From the menu on the left side of the page, select Provisioning.
   
4. From the Provisioning window, click Edit attribute mappings under Manage provisioning.
   
5. Click the Mappings drop-down arrow to expand the Mappings tab.
6. Click Provision Azure Active Directory Users.
7. Scroll down to the Attribute Mappings section. From this section, you'll see a list of all the attributes that have been mapped. The Azure Active Directory Attribute column displays the name of the attribute in Microsoft Entra. The KnowBe4 Attribute column displays the SCIM standard name for this attribute. 
   
8. Select the attribute you would like to edit.

9. In the Edit Attribute side pane, customize the attribute. For details about the customization options, see the list below:

   
   
   1. Mapping type: Select Direct from the drop-down menu.
   2. Source attribute: Select the Azure field that you want to map to this custom field.
      Note: If you're using SSO for Microsoft Entra ID, this attribute should be the same as the SSO Source attribute. By default, the SSO Source attribute is user.userprincipalname. For more information, see Add the KnowBe4 Application to Azure AD section of our How Do I Configure SSO/SAML with Azure Active Directory (AD)? article.
   3. Default value if null: This field is optional, and we recommend that you leave it blank.
   4. Target attribute: Select the custom field that you want to map to the Azure field you selected.
   5. Match objects using this attribute: We recommend you select No.
   6. Apply this mapping: We recommend you select Always.
      
      Note: If there is an attribute you don’t want to sync, you can click the Delete button next to that attribute to disable syncing. This action will only remove the connection between this attribute and the corresponding field in your KMSAT console. No data will be deleted from Azure.
10. Once you have made the changes you would like to make, click Ok.
    

    Note: We recommend that you only change the Source attribute field. Changing the other settings on the attribute may break the connection between Microsoft Entra and your KMSAT console.

Back to top

Adding Attribute Mapping for Custom User Fields

You also have the option to add six custom fields. These fields are not mapped by default, but you can add them to Microsoft Entra by following the steps below:

1. From your Microsoft Entra ID, navigate to Enterprise applications.
2. Select the application you created for your KnowBe4 connection.
3. From the menu on the left side of the page, select Provisioning.
   
4. From the Provisioning window, select Edit attribute mappings under Manage provisioning.
   
5. Click the Mappings drop-down arrow to expand the Mappings tab.
   
6. Click Provision Azure Active Directory Users.
7. Click Add New Mapping at the bottom of the table.
8. From the Edit Attribute window, select the Source attribute you would like to use.
9. Then, select the Target Attribute that you would like to use. We offer the following custom fields:

   KMSAT Field	Target Attribute
   Custom Field 1	urn:ietf:params:scim:schemas:extension:knowbe4:kmsat:2.0:User:customField1
   Custom Field 2	urn:ietf:params:scim:schemas:extension:knowbe4:kmsat:2.0:User:customField2
   Custom Field 3	urn:ietf:params:scim:schemas:extension:knowbe4:kmsat:2.0:User:customField3
   Custom Field 4	urn:ietf:params:scim:schemas:extension:knowbe4:kmsat:2.0:User:customField4
   Custom Date 1	urn:ietf:params:scim:schemas:extension:knowbe4:kmsat:2.0:User:customDate1
   Custom Date 2	urn:ietf:params:scim:schemas:extension:knowbe4:kmsat:2.0:User:customDate2
   Division	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:division
   Organization	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization

10. We recommend leaving the rest of the settings at their default settings.
11. Repeat step 9 for all of the custom fields you added in step 8.
12. Click Save at the top of the screen to save your changes.

These custom fields will now sync to your KMSAT console.

Back to top

Frequently Asked Questions (FAQs)

Below is a list of frequently asked questions about using SCIM with Microsoft Entra ID.

Question: How often do syncs occur?

Answer: The system will check for updates to the users and groups in your Microsoft Entra ID every 40 minutes. If changes are found, a sync will begin automatically. However, you can force a sync at any time by clicking the Force Sync Now button in the SCIM Settings section of your KMSAT Account Settings.

Question: How do you restore the default mappings?

Answer: You can restore the default mapping at any time by following the steps below:

1. Navigate to Enterprise applications.
2. Select the application you created for your KnowBe4 connection.
3. From the menu on the left side of the page, select Provisioning.
4. Click Edit attribute mapping under Manage provisioning.
5. Click the Mappings drop-down arrow to expand the Mappings drop-down menu.
6. Select Restore default mappings.
7. Click Save at the top of the screen.

Question: How do I sync all my users and groups?

Answer: If you would like to sync all users and groups from your Microsoft Entra ID, follow the steps below:

1. Navigate to the application you set up for your SCIM connection.
2. Navigate to Provisioning.
3. Select Edit provisioning at the top of the screen or select Add scoping filters under Manage provisioning.
4. Click the Settings drop-down menu.
5. From the Scope drop-down menu, select Sync all users and groups.
6. Click Save at the top of the page.

Question: I don’t have the ability to assign users to an application by group. How can I limit the users being synced to my KMSAT console?

Answer: To limit the users being synced to your KMSAT console, you can set up a scoping filter. For more information about making a scoping filter, see Microsofts Attribute-based application provisioning with scoping filters article.

Back to top