Sync Users and Groups from Entra ID with SCIM
For the complete documentation index, see llms.txt. For a full content snapshot, see llms-full.txt. Append .md to any kestra.io/docs/* URL for plain Markdown.

Sync users and groups from Microsoft Entra ID to Kestra using SCIM.

Prerequisites

  • Microsoft Entra ID Account: An account with administrative privileges is required to configure SCIM provisioning.
  • Enable multi-tenancy in Kestra: Tenants must be enabled in Kestra to support SCIM provisioning. You can enable tenants by setting the kestra.ee.tenants.enabled configuration property to true:
kestra:
  ee:
    tenants:
      enabled: true

Kestra SCIM setup: create a new provisioning integration

  1. Go to Instance Owner, select your tenant from the sidebar, open IAM, and click the SCIM Provisioning tab.
  2. Click + Create.
  3. Fill in the following fields:
    • Name: Enter a name for the provisioning integration.
    • Description: Provide a brief description of the integration.
    • Provisioning Type: Only SCIM 2.0 is supported — leave the default selection and click Save.

These steps generate a SCIM endpoint URL and a Secret Token. Save both — you will need them in the next steps.

scim2

The endpoint should look as follows:

https://<your_kestra_host>/api/v1/<your_tenant>/integrations/integration_id/scim/v2

The Secret Token is a long string (approx. 200 characters) used to authenticate requests from Microsoft Entra ID to Kestra.

Enable or disable SCIM integration

You can disable or remove the SCIM integration at any time. When disabled, all incoming requests to that endpoint are rejected.

IAM role and service account

When creating a new Provisioning Integration, Kestra will automatically create two additional objects:

  1. Role SCIMProvisioner with the following permissions:

    • GROUPS: CREATE, READ UPDATE, DELETE
    • USERS: CREATE, READ, UPDATE
    • BINDINGS: CREATE, READ, UPDATE, DELETE scim4

  2. Service Account with an API Token which was previously displayed as the Secret Token for the integration: scim5

Microsoft Entra ID SCIM setup

1. Register Kestra as an enterprise application

  • Navigate to Microsoft Entra ID → Enterprise Applications.

  • Click + New application to create a custom application. Name it “KestraSCIM” or any relevant name.

    scim6

2. Configure SCIM provisioning

  • Go to the newly created Kestra application.

  • Select Provisioning and set the Provisioning Mode to Automatic.

  • Enter the SCIM endpoint URL and Secret Token from Kestra: paste the SCIM endpoint into the Tenant URL field and the token into the Secret Token field.

  • Click Test Connection, then Save.

    scim7

3. Map user and group attributes

After entering and saving the Admin Credentials for the SCIM provisioning connection in Microsoft Entra ID — the Tenant URL and Secret Token — Azure will enable the Mappings section under the Provisioning settings.

The Mappings section allows you to define how user and group attributes should flow between Microsoft Entra ID and Kestra.

SCIM schema support in Kestra

Kestra adheres to the SCIM 2.0 specification (RFC 7643), specifically supporting the following resource types:

  • User Resource:
    • Example attributes: userName, name.givenName, name.familyName, emails, active
  • Group Resource:
    • Example attributes: displayName, members

Retrieve supported schemas

Kestra exposes SCIM resource schemas via its /Schemas endpoint at the SCIM URL. This allows Microsoft Entra ID to discover the required attributes automatically.

GET /api/v1/<tenant>/integrations/<integration_id>/scim/v2/Schemas

This endpoint returns a list of supported schemas and their attributes. Use it as a reference when configuring attribute mappings in Entra ID.

Configure user and group mappings

To configure mappings:

  1. Go to: Microsoft Entra Admin Center → Enterprise Applications → Your Kestra App → Provisioning → Mappings

  2. Configure attribute mappings:

  • For Users:
    • Map source attributes such as userPrincipalName, mail to their SCIM equivalents.
  • For Groups:
    • Map attributes such as displayName
    • Ensure group members are synchronized properly.
  1. Refer to the /Schemas endpoint response from Kestra to guide accurate mapping.
  2. Use attribute expressions or transformations in Entra ID if needed (e.g., to format names or emails).

Test the configuration

After mappings are configured:

  • Trigger a manual provisioning cycle from the Provisioning tab.
  • Verify that users and groups are correctly created or updated in Kestra.
  • Review provisioning logs in Entra ID for any errors or warnings.

4. Enable provisioning

Enable the provisioning integration toggle in the Kestra UI to start syncing users and groups from Microsoft Entra ID.

Additional resources

Was this page helpful?