# Entra ID synchronization

> Synchronize users and groups from Microsoft Entra ID with Ironchip using SCIM: enterprise application, provisioning, attribute mapping, and assignment.

URL: https://docs.ironchip.com/en/identidad/administracion/sincronizacion/entra-id/

Synchronize the users and groups of Microsoft Entra ID (formerly Azure AD) with Ironchip using SCIM, with an enterprise application that provisions automatically.

## Requirements

- A single Entra ID P1 or P2 license.
- A user with permissions in [portal.azure.com](https://portal.azure.com).
- The SCIM synchronization information of your Ironchip company. To get the **Tenant URL** and the **Secret Token**, see [SCIM in the console](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/#scim-in-the-console).

## Create the enterprise application

1. Sign in to the Azure portal with a user that has permissions.

   [Image: Azure portal]

2. Search for **Enterprise applications** and open it.

   [Image: Access to Enterprise applications]

3. Click **New application**.

   [Image: New application button]

4. Click **Create your own application**.

   [Image: Create your own application button]

5. Give it a descriptive name, select the last of the three options, **Integrate any other application you don't find in the gallery (Non-gallery)**, and create the application.

   [Image: Application name and selected option]

## Configure provisioning

1. Inside the application, in the left side menu, select **Provisioning**.

   [Image: Provisioning menu of the application]

2. Select **Provisioning** again and set the mode to **Automatic**.

   [Image: Automatic provisioning mode]

3. Expand **Admin Credentials** and enter the **Tenant URL** and the **Secret Token** of your Ironchip company.

   [Image: Provisioning admin credentials]

4. Click **Test Connection**. If a notification says the connection is successful, save the configuration.

## Configure attribute mapping

1. In the application's provisioning, open **Edit attribute mappings**.

   [Image: Edit attribute mappings option]

2. Expand the **Mappings** section and click **Provision Microsoft Entra ID Users**.

   [Image: Provision Microsoft Entra ID Users mapping]

3. Set only the required attributes, or the recommended ones as well.

   Required attributes:

   [Image: Required attributes of the mapping]

   Recommended attributes:

   [Image: Recommended attributes of the mapping]

### Immutable ID attribute

We recommend that you also map the immutable ID attribute (`immutableId`). Some services require it. To add it:

1. In the attribute mapping panel, select **Show advanced options** and open **Edit attribute list**.

   [Image: Advanced options and Edit attribute list]

2. Scroll to the end of the list and add an attribute of type `String` named `urn:ietf:params:scim:schemas:extension:2.0:User:immutableId`. Save the changes.

   [Image: New immutableId attribute of type String]

3. Back on the attribute mapping tab, click **Add New Mapping**.

   [Image: Button to add a new mapping]

4. Keep **Mapping type** as **Direct**, select `immutableId` as the **Source attribute** and `urn:ietf:params:scim:schemas:extension:2.0:User:immutableId` as the **Target attribute**, and save.

   [Image: Values of the immutable ID mapping]

## Assign users

To choose which users are synchronized:

1. In the enterprise application, open **Users and groups**.

   [Image: Users and groups menu of the application]

2. Click **Add user/group** and select the users and groups you want to synchronize.

   [Image: Selecting the users and groups to synchronize]

## Start the synchronization

With this, the basic configuration is complete. If needed, adjust the parameters for your case, then restart or turn on the enterprise application so it starts synchronizing.