Fivetran SCIM Configuration Guide for Azure Active Directory

IMPORTANT: You must have an Enterprise or Business Critical plan to use Fivetran SCIM for Azure Active Directory.

---

Overview

If your organization uses Azure Active Directory (Azure AD) to manage your employees' access to tools and services, you can leverage Microsoft Azure's user provisioning support to automatically grant access to your users. This document explains how to configure Azure AD to work with Fivetran to provide user provisioning through the System for Cross-domain Identity Management (SCIM) protocol. SCIM is designed to make the user identity management in cloud-based applications and services easier.

---

Supported features

Once you set up the SCIM integration between Azure AD and Fivetran, Administrators can perform the following Fivetran actions within Azure AD:

• Create users
• Update user attributes
• Deactivate users
• Create groups
• Update groups
• Delete groups

---

Prerequisites

To connect Fivetran SCIM service with a new Azure AD application, you need:

• A Fivetran account on an Enterprise or Business critical plan
• A Fivetran user with the Account Administrator role
• An active Azure AD subscription
• An Azure AD user with one of the following roles:
  • Application Administrator
  • Cloud Application Administrator
  • Global Administrator

---

Setup Guide

Configure Fivetran and obtain your API token

1. In your Fivetran dashboard, click the account name in the top-left corner of your dashboard and select Manage Account in the drop-down menu displayed.

2. In the account management page, select the Settings tab and scroll down to the SCIM Config section to access your SCIM provisioning settings.

   NOTE: The section is only visible if you are on an Enterprise or Business Critical plan.

   

3. Switch the Enable SCIM Provisioning toggle to ON.

4. Click Generate to generate a new API token.

5. Copy your API token. You will need to provide it in your Azure AD Application.

6. Click Save Config.

Create an enterprise application

1. Log in to the .

2. Go to Azure Active Directory , click Enterprise Applications in the left panel, and then click + New application to create a new enterprise application.

3. Click + Create your own application.

   

   

4. Enter a descriptive name for your app, and then select Integrate any other application you don't find in the gallery (Non-gallery) because you'll be creating your own application instead of using a published gallery app.

Set up provisioning

1. After the app has been created, go to the app's Provisioning section.

   

2. Click Get Started.

3. In the provisioning properties, set the following values:

   • Provisioning Mode: set to Automatic
   • Tenant URL:
   • Secret token: specify the token you copied in the .

4. Click Test Connection to make sure that the credentials you provided are valid. If you see any error messages, make sure your tenant URL and secret token are correct and try again. If the connection test keeps failing, contact the .

5. Click Save.

   

Add roles to the application

1. Return to the main Azure Active Directory page and click App registrations in the left panel.

2. Click All applications.

3. Open your application and click App roles in the left panel.

   

4. Add the roles that you want to assign to provisioned users. To add a new role, do the following:

5. Click + Create app role.

6. In the Display name field, enter the name of the new role. The name must exactly match the name of the relevant standard or an existing custom user role in your account.

   NOTE: Destination-level or connector-level roles are not supported in the Fivetran SCIM API.

   If you want to use standard account-level roles, fill in the attribute fields as listed below:

   Display Name	Value
   Account Administrator	account_administrator
   Account Analyst	account_analyst
   Account Billing	account_billing
   Account Reviewer	account_reviewer
   Destination Creator	destination_creator

7. Set Allowed member type to Users/Groups.

8. In the Value field, enter the same value as in the Display name field, but using lowercase letters and underscores. For example, if you specified Account Billing as the display name, specify account_billing as the value.

9. Add a description for your new role.

10. Check the Do you want to enable this app role? checkbox.

11. Click Apply.

Customize user provisioning attribute mappings

1. Return to the main Azure Active Directory page and click Enterprise Applications in the left panel.

2. Open your app and click Provisioning in the left panel.

3. Click Edit provisioning.

4. Expand the Mappings section and confirm that provisioning is enabled for both users and groups.

   

5. Click Provision Azure Active Directory Groups. Edit the Group Mappings one by one by deleting all attributes except the following ones:

   • displayName – displayName
   • members – members

   

6. Click Save and then Yes in the Save Changes pop-up window.

7. Close the Attribute Mapping screen.

8. Click Provision Azure Active Directory Users. Edit the User Mappings one by one by deleting all attributes except for the following ones:

   • userPrincipalName – userName
   • Switch([IsSoftDeleted], , "False","True", "True", "False") – active
   • mail – emails[type eg "work"].value
   • givenName – name.givenName
   • surname – name.familyAdded Name

   

9. Configure mapping for user roles. Click Add New Mapping.

10. Set the following parameters:

    

    • Mapping type : Expression

    • Expression: SingleAppRoleAssignment([appRoleAssignments])

    • Target attribute: roles[primary eq "True"].value

11. Click Ok to add the new mapping.

12. Click Save and then Yes in the Save Changes pop-up window.

13. Set Provisioning Status to On and click Save on the Provisioning tab. The manual SCIM provisioning setup is now complete.

Assign users and groups to your application in Azure AD

1. Return to the main Azure Active Directory page and click Enterprise Applications in the left panel.

2. Open your Fivetran application and click Users and groups.

3. Click + Add user/group.

   

4. Select users and, optionally, groups that you want to assign to your Fivetran app.

5. Select the role you want to assign to the selected users.

   NOTE: Group roles are not synced to Fivetran.

6. Click Assign. The selected users and groups will be automatically provisioned in your Fivetran account.