Set up SCIM provisioning with Microsoft Entra ID
Set up SCIM provisioning so that Microsoft Entra ID adds users and groups to HP Insights and keeps their details up to date, which means you don't have to import or edit users by hand. For an overview of how provisioning works, see What is user and group provisioning with SCIM?
Users and groups you create in Microsoft Entra ID are added to HP Insights, and changes to user attributes are synced to it.
Before you begin
- Users sign in to HP Insights with OpenID Connect or SAML. SCIM with Microsoft Entra ID doesn't support other authentication types.
- The Account Settings > Settings and Secure > Settings pages are both unlocked. If either is locked, generating a token fails with an error that names the locked page. See Set up automatic user and group provisioning with SCIM.
- You can sign in to the Microsoft Entra admin center with permission to create enterprise applications.
Set up provisioning
Generate the SCIM credentials
In the web console, go to Account Settings > Settings, and in User and Group Sync, select Generate Token. If a token was generated before, the button is Regenerate Token, and you will need to update the new token anywhere the old one is used.
The SCIM Credentials dialog shows the Tenant URL and Token that Microsoft Entra ID needs to connect to HP Insights. Select Download to save them, rather than Copy, because if you open a new tab before you save them, a new token is generated and the values no longer match.
Create an enterprise application
Sign in to the Microsoft Entra admin center, go to Microsoft Entra ID > Enterprise applications, and select New application. Then select Create your own application.
Enter a name for the application, for example HP Insights SCIM, select Integrate any other application you don't find in the gallery, and select Create.
Connect the application to HP Insights
Open the application you created and select Provisioning. Set Provisioning Mode to Automatic.
- Enter the Tenant URL from step 1 in Tenant URL.
- Enter the Token from step 1 in Secret Token.
- Select Test Connection to check that Microsoft Entra ID can reach HP Insights.
- Select Save to save the admin credentials.
Map the user attributes
In Mappings, select Provision Azure Active Directory Users, and make sure Create, Update and Delete are selected.
Then change the matching attributes, so that users are matched by their object ID first and their user principal name second:
- Select userPrincipalName and change Matching precedence to 2.
- Select mailNickName, set Source attribute to objectId, and set Match objects using this attribute to Yes, which sets its matching precedence to 1. Select OK.
- Delete every other attribute mapping, so that your list matches the one below.
Turn on provisioning
In Settings, set Scope to Sync only assigned users and groups, set Provisioning Status to On, and save your changes.
Saving starts the Microsoft Entra ID provisioning service. After that, Microsoft Entra ID syncs with HP Insights every 40 minutes.
Assign users and groups
Because the scope is set to assigned users and groups, only the users and groups you assign to the application are synced. In the application, go to Users and groups and assign them.
Each user must have an email address in their Contact Information in Microsoft Entra ID.
The users and groups you assigned appear in HP Insights after the next sync.
Keep the connection working
The SCIM token is valid for one year. When it's about to expire, or has expired, a message appears in Account Settings > Settings > User and Group Sync. Regenerate the token and update it in your identity provider before it expires, because provisioning stops when the identity provider can no longer authenticate. See Set up automatic user and group provisioning with SCIM.