SCIM 2.0 User & Group Provisioning

PostQode Enterprise supports System for Cross-domain Identity Management (SCIM 2.0) to automate user provisioning, de-provisioning, and group synchronization across your organization.

By integrating SCIM with your Identity Provider (IdP) such as Okta, Microsoft Entra ID (Azure AD), or PingFederate, user accounts and team memberships are automatically synced in real time.

---

Key Features

• Automated User Lifecycle: Creating, updating, or deactivating a user in your IdP immediately syncs to PostQode.
• Group & Team Synchronization: IdP groups map directly to PostQode teams and organization roles.
• Single Sign-On (SSO) Integration: Works alongside OAuth2/OIDC SSO for seamless authentication.
• Token-Based Bearer Security: SCIM API endpoints are protected using high-entropy SCIM bearer tokens generated in the PostQode Admin Portal.

---

Enabling SCIM in PostQode

To set up SCIM provisioning, an organization administrator must generate a SCIM endpoint and access token:

1. Log in to the PostQode Web Console (app.postqode.ai) as an Organization Administrator.
2. Navigate to Organization Settings → Settings tab.
3. Scroll down to the SCIM User Provisioning section.
4. Toggle the Enable SCIM 2.0 Provisioning switch to Enabled.
5. Note the SCIM Endpoint URL displayed on the screen (e.g., https://api.postqode.ai/scim/v2).
6. Click Generate Token.
7. Copy the generated Secret Token immediately and store it securely (it will not be displayed again).
8. (Optional) Add comma-separated IP address ranges in the Allowed IP Addresses field to restrict synchronization calls to your IdP's known IP ranges.

[!IMPORTANT] Keep your SCIM secret token secure. It provides admin-level authority to provision, update, and de-provision users within your organization.

---

Identity Provider Configuration Guides

1. Microsoft Entra ID (Formerly Azure Active Directory)

Follow these steps to configure automatic provisioning in Microsoft Entra ID:

Step 1: Create Enterprise Application

1. Log in to the Microsoft Entra Admin Center.
2. Go to Identity → Applications → Enterprise applications → New application.
3. Select Create your own application, enter a name (e.g., PostQode SCIM Provisioning), and choose Integrate any other application you don't find in the gallery (Non-gallery). Click Create.

Step 2: Configure Admin Credentials

1. Once created, go to the Provisioning tab from the left sidebar and click Get started.
2. Set Provisioning Mode to Automatic.
3. Expand the Admin Credentials section:
   • Tenant URL: Paste the SCIM Endpoint URL copied from PostQode (e.g., https://api.postqode.ai/scim/v2).
   • Secret Token: Paste the Secret Token generated in PostQode.
4. Click Test Connection. Once successful, click Save.

Step 3: Configure Attribute Mappings

1. Expand Mappings and click Provision Microsoft Entra ID Users (or Synchronize Azure Active Directory Users to...).
2. Verify and configure the following attribute mappings:

Microsoft Entra ID Attribute	Target PostQode SCIM Attribute	Mapping Type	Required
objectId	externalId	Direct	Yes
userPrincipalName	userName	Direct	Yes
mail	emails[type eq "work"].value	Direct	Optional
givenName	name.givenName	Direct	Optional
surname	name.familyName	Direct	Optional
displayName	displayName	Direct	Optional
telephoneNumber	phoneNumbers[type eq "work"].value	Direct	Optional
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active	Expression	Yes

3. Save the mappings.
4. (Optional) If you also wish to sync groups/teams, expand Mappings → Provision Microsoft Entra ID Groups and map:
   • displayName → displayName
   • members → members

Step 4: Assign Users and Start Syncing

1. Navigate to the enterprise application's Users and groups tab.
2. Click Add user/group and assign the users or groups you want to sync into PostQode.
3. Return to the Provisioning tab and click Start provisioning.
4. Entra ID will sync changes automatically every 40 minutes. You can also click Provision on demand to sync individual test users immediately.

---

2. Okta Configuration

1. In your Okta Admin Console, go to Applications → PostQode.
2. Navigate to Provisioning → Integration.
3. Check Enable SCIM Integration.
4. Set SCIM connector base URL to your PostQode SCIM Base URL (https://api.postqode.ai/scim/v2).
5. Set Unique identifier field for users to email.
6. Select Bearer Token authentication and paste your PostQode SCIM Secret Token.
7. Save and enable Create Users, Update User Attributes, and Deactivate Users.

---

Troubleshooting & Verification

• 401 Unauthorized: Ensure the Secret Token has not expired and matches exactly. Regenerate the token in the PostQode Console if necessary.
• 403 Forbidden (IP Address Blocked): If you configured IP Whitelisting, verify that the Microsoft Entra sync agent IPs are included. Microsoft publishes Entra ID IP ranges here.
• Audit Logs: Administrators can check sync actions and failure details in the backend scim_audit_logs table or the PostQode Web Console Audit Trail.