How to Upgrade from Legacy SCIM

KnowBe4 currently has two versions of SCIM: a supported version and a legacy version that is no longer supported. This guide will show you how to update your KnowBe4 account from the legacy version of SCIM to the new version of SCIM.

Jump to:

Updating to the Newest Version

Syncing Location, Phone Number, and Cell Phone Fields

Updating to the Newest Version

Updating your account to the newest version of SCIM will provide your organization with important security and feature updates. See the steps below to update your account to the new version of SCIM.

1. Log in to your KnowBe4 account.
2. Click on your email address in the top-right corner of the page and click Account Settings.
3. Navigate to User Management > User Provisioning and click SCIM.
4. Note: You can toggle between the two SCIM options in your Account Settings. Your KnowBe4 account will only process SCIM syncs from the selected SCIM option in your Account Settings. If you have SCIM selected, any Legacy SCIM syncs received from your Okta identity provider to your KnowBe4 account will display as Skipped in your Sync Reports page.
5. Expand your SCIM settings by clicking + SCIM Settings.
6. Generate SCIM Token. This button will open a new window with your token ID. Copy this ID and save it to a place that you can easily access later. It is important that you save this token because once you close this window, you cannot view the token again. Once you’ve saved the token, click OK to close the window.
   Note: Once your SCIM token is generated, the Generate SCIM Token button will change to the Regenerate SCIM Token button. See our SCIM Configuration Guide for more information about the button.
7. Copy the Tenant URL and save it to a place that you can easily access later.
8. Make sure that the Test Mode option is enabled.

   Note: We recommend keeping Test Mode enabled until you’ve configured the connection between KnowBe4 and your identity provider and have run a successful sync. Test Mode is used to generate a report of what will happen when SCIM is enabled. This means that no changes are made to your console, so you can configure your setup without worrying about changes to your console. When you're ready, you can disable Test Mode from your Account Settings to enable syncing.

   If you're switching from ADI to SCIM or from Legacy SCIM to SCIM, Test Mode will be enabled automatically after you click Save Changes.

9. Scroll down to the bottom of the Account Settings page and click Save Changes.

Now that you've enabled the newest SCIM version in your KnowBe4 account, you're ready to finalize the connection with your identity provider. To learn how to configure SCIM for the identity provider that you're using, see the articles listed below:

• How to Configure SCIM for Okta
• How to Configure SCIM for Azure
• How to Configure SCIM for OneLogin

For further assistance with this feature, please contact our support team and they will be happy to help.

Back to top

Syncing Location, Phone Number, and Cell Phone Fields

For the Azure version of SCIM, the Mobile Phone, Telephone, and Location fields won't sync automatically once you update to the latest version. To sync these fields, you'll need to map them to the KMSAT application in Azure.

To map the fields to your KMSAT application, follow the steps below:

1. Log in to your Microsoft 365 admin portal and select Azure Active Directory.
2. Navigate to Applications > Enterprise applications.
3. Select the KnowBe4 Security Awareness Training application.
4. Select the Provisioning tab.
5. Click Edit Provisioning.
6. Click the Mappings drop-down menu.
7. Click Provision Azure Active Directory Users.
8. At the bottom of this page, click the Show advanced options check box.
9. Click Edit attribute list for KnowBe4.
10. Add the attributes you would like to sync. For more information, see the table below:

    Default Azure Active Directory Attribute	KMSAT Attribute	KMSAT Field
    physicalDeliveryOfficeName	addresses[type eq "work"].formatted	Location
    telephoneNumber	phoneNumbers[type eq "work"].value	Phone Number
    mobile	phoneNumbers[type eq "mobile"].value	Mobile Phone Number

11. Once you’ve added the attributes, you'll need to map them to an Azure field. For more information, see the Adding Attribute Mapping for Custom User Fields section of our How to Configure SCIM for Azure article.
    
    Note: Make sure to select the KnowBe4 Security Awareness application instead of the application you used for SCIM Legacy.

Back to top