})
Search Job
diff --git a/docs/api/scim-user.md b/docs/api/scim-user.md
new file mode 100644
index 0000000000..295f9f5931
--- /dev/null
+++ b/docs/api/scim-user.md
@@ -0,0 +1,40 @@
+---
+id: scim-user
+title: SCIM User Management APIs
+sidebar_label: SCIM User
+description: Use HTTP endpoints to manage your SCIM configuration.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+import ApiIntro from '../reuse/api-intro.md';
+import ApiRoles from '../reuse/api-roles.md';
+
+
})
+
+The SCIM User Management API allows you to provision users to Sumo Logic from [SCIM provisioning providers](/docs/manage/security/scim/).
+
+## Documentation
+
+
+
+| Deployment | Documentation URL |
+|:------------|:---------------------------------------------------------------------|
+| AU | https://api.au.sumologic.com/docs/#tag/scimUserManagement |
+| CA | https://api.ca.sumologic.com/docs/#tag/scimUserManagement |
+| DE | https://api.de.sumologic.com/docs/#tag/scimUserManagement |
+| EU | https://api.eu.sumologic.com/docs/#tag/scimUserManagement |
+| FED | https://api.fed.sumologic.com/docs/#tag/scimUserManagement |
+| IN | https://api.in.sumologic.com/docs/#tag/scimUserManagement |
+| JP | https://api.jp.sumologic.com/docs/#tag/scimUserManagement |
+| KR | https://api.kr.sumologic.com/docs/#tag/scimUserManagement |
+| US1 | https://api.sumologic.com/docs/#tag/scimUserManagement |
+| US2 | https://api.us2.sumologic.com/docs/#tag/scimUserManagement |
+
+## Required role capabilities
+
+
+
+* Security
+ * Manage SAML
+* User Management (all role capabilities)
+
diff --git a/docs/manage/security/saml/set-up-saml.md b/docs/manage/security/saml/set-up-saml.md
index c792b2f219..00ff2030db 100644
--- a/docs/manage/security/saml/set-up-saml.md
+++ b/docs/manage/security/saml/set-up-saml.md
@@ -36,15 +36,15 @@ The provisioning process works as follows:
This section has key information about SAML in Sumo.
-## Access keys are not controlled by SAML
+### Access keys are not controlled by SAML
This means that if a user has been turned off on the SSO side, their access keys would still be valid. For this reason, administrators should audit users regularly and disable access keys when necessary.
-## SAML does not provide a deprovisioning mechanism
+### SAML does not provide a deprovisioning mechanism
This means that if a user is deleted or disabled in the SSO database, it will not be reflected in Sumo Logic. However, these users would no longer be able to login to Sumo Logic via SSO. Administrators can delete these users from the **Administration > Users and Roles > Users** page in Sumo Logic. For information about what happens when a user is deleted, and transferring a deleted user's content to another user, see [Delete a User](../../users-roles/users/delete-user.md).
-## Only one certificate for each SAML configuration is currently supported
+### Only one certificate for each SAML configuration is currently supported
Only one token-signing ADFS X.509 for each SAML configuration is currently supported. When you need to do a certificate refresh on the ADFS server, you must update the Sumo certificate afterwards.
diff --git a/docs/manage/security/scim/about-scim-provisioning.md b/docs/manage/security/scim/about-scim-provisioning.md
new file mode 100644
index 0000000000..355e62ade9
--- /dev/null
+++ b/docs/manage/security/scim/about-scim-provisioning.md
@@ -0,0 +1,69 @@
+---
+id: about-scim-provisioning
+title: About SCIM Provisioning
+sidebar_label: About
+description: Learn about provisioning users into Sumo Logic using SCIM.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+You can utilize Sumo Logic [SCIM User Management APIs](/docs/api/scim-user/) to automatically provision and deprovision users in Sumo Logic when users are created or removed within your identity provider. Sumo Logic can be integrated with any identity provider that is [SCIM 2](https://scim.cloud/) compliant.
+
+## Directions for specific providers
+
+This article contains general guidance on setting up identity providers to provision with Sumo Logic.
+
+See the following articles for directions to configure specific providers:
+* [Provision with Microsoft Entra ID](/docs/manage/security/scim/provision-with-microsoft-entra-id/)
+* [Provision with Okta](/docs/manage/security/scim/provision-with-okta/)
+* [Provision with OneLogin](/docs/manage/security/scim/provision-with-onelogin/)
+
+## General process to configure provisioning for Sumo Logic
+
+Although the process will differ depending on your provider, following are the general steps to configure your provider to provision with Sumo Logic.
+
+### Prerequisites
+
+#### Create an access key
+
+Before configuring a provider, create an [access key](/docs/manage/security/access-keys/). (We recommend using a service account to create the access key.) This access key will provide authorization to provision users from the provider into Sumo Logic.
+
+When you create the access key, copy its access ID and access key values. You will enter these when you set up provisioning to use one of the following authorization methods:
+* Basic authentication
+ * Username: Access ID
+ * Password: Access key
+* Bearer token
Use [Base64 encoding](https://www.base64encode.org/) to Base64 encode `
:`.
+
+#### Set up SAML
+
+[Set up SAML for single sign-on](/docs/manage/security/saml/set-up-saml/) in the Sumo Logic instance where you will provision users. This will allow connection to Sumo Logic for provisioning. Copy the single sign-on URL (Assertion Consumer URL) and entity ID from your Sumo Logic SAML configuration to set up single sign-on in your provider.
+
+})
+
+### Step 1: Create an app
+
+Create an application in your provider. You will configure this app in the following steps.
+
+### Step 2: Set up single sign-on
+
+Set up single sign-on for the app to connect to Sumo Logic. Copy the Assertion Consumer URL and entity ID from the SAML configuration in Sumo Logic to use in the configuration. (See [Set up SAML](#set-up-saml) above.)
+
+### Step 3: Set up roles
+
+Set up roles in your app to match roles in Sumo Logic (for example, Administrator and Analyst). When users assigned these roles in your app are provisioned, the roles are automatically assigned to the provisioned users in Sumo Logic.
+
+### Step 4: Assign users to your app
+
+Assign users to your app. All users assigned to the app will be provisioned.
+
+### Step 5: Set up provisioning
+
+When you set up provisioning for the app, provide a Sumo Logic access key to authorize access to Sumo Logic. (See [Create an access key](#create-an-access-key) above.)
+
+For the SCIM base URL, provide the Sumo Logic [API endpoint for your deployment](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for the [SCIM User Management APIs](/docs/api/scim-user/) using the format `/v1/scim/`. For example, `https://api.sumologic.com/api/v1/scim/`.
+
+### Step 6: Verify provisioning
+
+Test provisioning to ensure that users assigned to the app are provisioned correctly into Sumo Logic. Verify in your provider's logs and in the Sumo Logic UI.
+
+
diff --git a/docs/manage/security/scim/index.md b/docs/manage/security/scim/index.md
new file mode 100644
index 0000000000..ffb74afb72
--- /dev/null
+++ b/docs/manage/security/scim/index.md
@@ -0,0 +1,38 @@
+---
+slug: /manage/security/scim
+title: SCIM Provisioning
+description: Learn how to provision users in Sumo Logic using SCIM.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+Learn how to provision and deprovision users in Sumo Logic using SCIM (System for Cross-domain Identity Management).
+
+This section contains the following articles:
+
+
\ No newline at end of file
diff --git a/docs/manage/security/scim/provision-with-microsoft-entra-id.md b/docs/manage/security/scim/provision-with-microsoft-entra-id.md
new file mode 100644
index 0000000000..f1ba0c232f
--- /dev/null
+++ b/docs/manage/security/scim/provision-with-microsoft-entra-id.md
@@ -0,0 +1,118 @@
+---
+id: provision-with-microsoft-entra-id
+title: Provision with Microsoft Entra ID
+sidebar_label: Provision with Microsoft Entra ID
+description: Learn how to provision users in Sumo Logic with Microsoft Entra ID (formerly Azure Active Directory).
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+This article describes how to provision users in Sumo Logic with Microsoft Entra ID (formerly Azure Active Directory).
+
+## Prerequisites
+
+### Create an access key
+
+Create an [access key](/docs/manage/security/access-keys/). (We recommend using a service account to create the access key.) This access key will provide authorization to provision users from Microsoft Entra ID into Sumo Logic.
+
+When you create the access key, copy its access ID and access key values. You will enter these when you use [Base64 encoding](https://www.base64encode.org/) to Base64 encode `:` to generate a token.
+
+## Configure provisioning with Microsoft Entra ID
+
+### Step 1: Create the app
+
+1. Log in to [Microsoft Azure](http://portal.azure.com/) as an administrator.
+1. Navigate to Microsoft Entra ID. (You can use the search bar to locate it.)
+1. Navigate to **Manage > Enterprise Applications**.
+1. Click **New application**.
})
+1. Click **Create your own application**.
})
+1. Enter a name for the app, select **Integrate any other application you don't find in the gallery (Non-gallery)**.
})
+1. Click **Create**. The app displays in Entra ID.
})
+
+### Step 2: Set up single sign-on
+
+Follow the directions in [Configure Sumo as an Enterprise App in Azure AD](/docs/manage/security/saml/integrate-sumo-with-azure-ad/#configure-saml-in-sumo-logic) beginning with the step where you select **Set up single sign on**.
+
+})
+
+When you [configure SAML in Sumo Logic](/docs/manage/security/saml/integrate-sumo-with-azure-ad/#configure-saml-in-sumo-logic):
+* Select **Disable Requested Authentication Context**.
+* Do not select the **On Demand Provisioning** checkbox. You will set up provisioning later.
+
+### Step 3: Add roles
+
+Create roles that the users will have in Sumo Logic (for example, `Analyst` and `Administrator`).
+
+1. In the app, select **Manage > Users and groups**.
+1. Select **application registration**.
})
+1. Click **Create app role**.
})
+1. Create the role:
+ 1. In **Display name**, enter the name to be displayed in the UI (for example, `Analyst`).
+ 1. For **Allowed member types** select **Both**.
+ 1. For **Value** enter the value of the role in Sumo Logic (for example, `Analyst`).
+ 1. For **Description** enter a description of the role.
+ 1. Click **Apply**.
})
+
+### Step 4: Assign users to the app
+
+1. In the app, select **Manage > Users and groups**.
+1. Select **Add user/group**.
})
+1. Under **Users**, click **None Selected**.
})
+1. From the list of available users, select users to add to the app and click **Select**.
+1. Under **Select a role** click **None Selected**.
+1. From the list of available roles, select a role (for example, **Analyst**).
+1. Click **Assign**.
+
+### Step 5: Set up provisioning
+
+1. In the app select **Manage > Provisioning**.
})
+1. For **Provisioning Mode**, select **Automatic**.
+1. Enter **Admin Credentials**:
+ 1. In **Tenant URL**, enter the [API endpoint for your deployment](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for the [SCIM User Management APIs](/docs/api/scim-user/) using the format `/v1/scim/`. For example, `https://api.sumologic.com/api/v1/scim/`.
+ 1. For **Secret Token**, use [Base64 encoding](https://www.base64encode.org/) to encode `:` (see [Prerequisites](#prerequisites)). Enter the resulting value into the **Secret Token** field.
+ 1. Click **Test Connection**. If successful, a message like this appears: **Testing connection to ``. The supplied credentials are authorized to enable provisioning**.
+1. Set up mappings:
+ 1. Select **Mappings** and **Provision Microsoft Entra Users**.
})
+ 1. At the bottom of the **Attribute Mapping** dialog, select **Add New Mapping**.
+ 1. Fill out the **Edit Attribute** dialog:
+ 1. For **Mapping type** select **Expression**.
+ 1. For **Expression** enter `AppRoleAssignments([appRoleAssignments])`.
+ 1. For **Target attribute** select `roles[primary eq "True"].value`.
+ 1. Click **OK**.
})
+ 1. On the **Attribute Mapping** dialog, delete all the attributes except:
+ * userName
+ * active
+ * emails[type eq "work"].value
+ * name.givenName
+ * name.familyName
+ * roles[primary eq "True"].value
+ 1. Click **Save**.
})
+1. Click the **Home > `` | Provisioning** link in the top left corner of the screen. This returns you to the **Provisioning** tab.
+1. Test provisioning:
+ 1. In the app, select **Manage > Provisioning**.
+ 1. For **Provisioning Status** select **On** to enable provisioning.
+ 1. Click **Save**.
})
+ 1. Select **Overview**.
+ 1. Select **Provision on demand**.
})
+ 1. Users assigned the app will be provisioned into Sumo Logic.
+
+As long as the app's provisioning status is on, the app runs auto provisioning every 40 minutes.
+
+### Step 6: Verify provisioning
+
+Users assigned to the app are provisioned into Sumo Logic.
+
+1. Verify in Microsoft Entra ID:
+ 1. In the app, select **Provisioning** and then select the **Monitoring** tab.
+ 1. The tab should show provisioning status. Click **View Provisioning Logs** for details.
+1. Verify in Sumo Logic:
+ 1. Log in to the Sumo Logic instance that you linked to the provisioning app in Step 2 when you provided the Assertion Consumer URL and entity ID.
+ 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Users and Roles > Users**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Administration**, and then under **Users and Roles** select **Users**. You can also click the **Go To...** menu at the top of the screen and select **Users**.
+ 1. Search for the users provisioned from Microsoft Entra ID.
+ 1. You should see the users listed, and with the role given to them when you assigned them to the app in Microsoft Entra ID.
+
+## Syncing between Microsoft Entra ID and Sumo Logic
+
+When you modify the name, email, or role of a user assigned the app in Microsoft Entra ID, the changes will be synced to the corresponding user in Sumo Logic.
+
+If you unassign a user from the app in Microsoft Entra ID, the corresponding user is deactivated in Sumo Logic. (If you later try to reassign that same user to the app, it will result in an error in Sumo Logic. You must delete the old user from Sumo Logic first so that the user can be provisioned once again from Microsoft Entra ID.)
\ No newline at end of file
diff --git a/docs/manage/security/scim/provision-with-okta.md b/docs/manage/security/scim/provision-with-okta.md
new file mode 100644
index 0000000000..82e5db561d
--- /dev/null
+++ b/docs/manage/security/scim/provision-with-okta.md
@@ -0,0 +1,164 @@
+---
+id: provision-with-okta
+title: Provision with Okta
+sidebar_label: Provision with Okta
+description: Learn how to provision users in Sumo Logic with Okta.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+This article describes how to provision users in Sumo Logic with Okta.
+
+## Prerequisites
+
+### Create an access key
+
+Create an [access key](/docs/manage/security/access-keys/). (We recommend using a service account to create the access key.) This access key will provide authorization to provision users from Okta into Sumo Logic.
+
+When you create the access key, copy its access ID and access key values. You will enter these when you set up provisioning to use one of the following authorization methods:
+* Basic authentication
+ * Username: Access ID
+ * Password: Access key
+* Bearer token
Use [Base64 encoding](https://www.base64encode.org/) to Base64 encode `:`.
+
+### Set up SAML
+
+If it is not already set up, [set up SAML for single sign-on with Okta](/docs/manage/security/saml/integrate-sumo-logic-with-okta/) in the Sumo Logic instance where you will provision users. This will allow connection to Sumo Logic for provisioning. Copy the single sign-on URL (Assertion Consumer URL) and entity ID from your Sumo Logic SAML configuration. You will use them when you set up provisioning.
+
+
+
+## Configure provisioning with Okta
+
+### Step 1: Create the app
+
+1. [Login to Okta](https://login.okta.com/) as an administrator.
+1. Navigate to **Applications > Applications** and click **Create App Integration**.
})
+1. Select **SAML 2.0** and click **Next**.
})
+1. Provide a name in the **App Name** field and click **Next**.
})
+1. Enter the **Single sign-on URL** and **Audience URI (SP Entity ID)** for your Sumo Logic instance:
})
Obtain the single sign-on URL (Assertion Consumer URL) and entity ID from the SAML configuration of the Sumo Logic tenant where you will provision users (see [Prerequisites](#prerequisites)).
+1. Click **Next** and click **Finish**. The app displays in Okta.
})
+
+### Step 2: Set up provisioning
+
+1. Configure the general settings for the app:
+ 1. Click the **General** tab.
+ 1. Click **Edit** in the upper-right corner of the **App Settings** dialog for the app.
+ 1. For **Provisioning**, select **SCIM**.
})
+ 1. Click **Save**. A **Provisioning** tab appears for the app.
+1. Configure provisioning integration settings:
+ 1. Click the **Provisioning** tab.
+ 1. Click **Integration** in the left menu, and then click **Edit**.
+ 1. **SCIM connector base URL**. Enter the [API endpoint for your deployment](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for the [SCIM User Management APIs](/docs/api/scim-user/) using the format `/v1/scim/`. For example, `https://api.sumologic.com/api/v1/scim/`.
+ 1. **Unique identifier field for users**. Enter `userName`.
+ 1. **Supported provisioning actions**. Select:
+ * **Import New Users and Profile Updates**
+ * **Push New Users**
+ * **Push Profile Updates**
+ 1. **Authentication Mode**. Select one of these authentication methods and enter your Sumo Logic access key credentials (see [Prerequisites](#prerequisites)):
+ * **Basic Auth**. Basic authentication method. If you choose this method, enter your access key credentials in the fields that appear:
+ * **Username**. Enter your access ID.
+ * **Password**. Enter your access key.
+ * **HTTP Header**. HTTP authorization header method. If you choose this option, use [Base64 encoding](https://www.base64encode.org/) to encode `:` and enter the resulting value into the **Authorization | Bearer Token** field that appears.
})
+ 1. Click **Test Connector Configuration**. The results display:
})
+ 1. Click **Close** on the **Test Connector Configuration** dialog.
+ 1. Click **Save** to save the app provisioning integration settings.
+1. Configure provisioning **To App** settings:
+ 1. Click the **Provisioning** tab.
+ 1. Click **To App** in the left menu, and then click **Edit**.
+ 1. Select **Enable** on:
+ * **Create Users**
+ * **Update User Attributes**
+ * **Deactivate Users**
+ 1. Click **Save**.
})
+
+### Step 3: Set up roles
+
+1. Add the **Roles** attribute to the default Okta user profile:
+ 1. Navigate to **Directory > Profile Editor** and select **Okta User (default)**.
})
+ 1. In the **Profile Editor**, click **Add Attribute**.
})
+ 1. Fill out the **Add Attribute** dialog:
+ 1. **Data type**. Select **string**.
+ 1. **Display name**. Enter `Roles`.
+ 1. **Variable name**. Enter `roles`.
+ 1. For **Enum** select **Define enumerated list of values** and enter the following:
+ | Display name | Value |
+ | :-- | :-- |
+ | `User` | `user` |
+ | `Administrator` | `administrator` |
+ | `Analyst` | `analyst` |
+ 1. **User permission**. Select **Read-Write**.
+ 1. Click **Save**.
})
+1. Add the **Roles** attribute to the provisioning app user profile:
+ 1. Navigate to **Directory > Profile Editor** and select the user for the app you created in Step 1.
})
+ 1. In the **Profile Editor**, click **Add Attribute**.
})
+1. Fill out the **Add Attribute** dialog:
+ 1. **Data type**. Select **string**.
+ 1. **Display name**. Enter `Roles`.
+ 1. **Variable name**. Enter `roles`.
+ 1. **External name**. Enter `roles.^[primary==true].value`.
+ 1. **External namespace**. Enter `urn:ietf:params:scim:schemas:core:2.0:User`.
+ 1. For **Enum** select **Define enumerated list of values** and enter the same roles you added to the Okta user above:
+ | Display name | Value |
+ | :-- | :-- |
+ | `User` | `user` |
+ | `Administrator` | `administrator` |
+ | `Analyst` | `analyst` |
+ 1. **Attribute type**. Select **Group**.
+ 1. Click **Save**.
})
+
+### Step 4: Set up attribute mappings
+
+1. Navigate to **Applications > Applications** and select the app you created in Step 1.
+1. Edit the attributes pushed from Okta to the provisioning app.
+ 1. Select **To App**.
+ 1. Select the **Provisioning** tab and scroll down to the **`` Attribute Mappings** section.
+ 1. Delete all the attributes except:
+ * Username
+ * Given name
+ * Family name
+ * Email
})
+1. Edit attributes that will be pushed from the provisioning app to Okta.
+ 1. Select **To Okta**.
+ 1. Select the **Provisioning** tab and scroll down to the **Okta Attribute Mappings** section.
+ 1. Delete all the attributes except:
+ * User name
+ * First name
+ * Last name
+ * Primary email
})
+1. Edit the attributes in the app profile.
+ 1. Navigate to **Directory > Profile Editor** and select the user for the app you created in Step 1.
+ 1. Delete all the attributes except:
+ * User name
+ * Given name
+ * Family name
+ * Primary email
+ * Roles
})
+
+### Step 5: Assign the app to people
+
+1. Select the app's **Assignments** tab.
+1. Select **Assign > Assign to people**.
})
+1. Select a user and click **Assign**.
})
+1. Select a role for the user.
})
+1. Click **Save and go back**.
+1. Continue to assign users. When finished, click click **Done**.
+1. The assigned users are displayed in the **Assignments** tab.
+
+### Step 6: Verify provisioning
+
+As soon as users are assigned to the app, they are provisioned into Sumo Logic.
+
+1. Verify in Okta:
+ 1. Navigate to **Reports > System Log** to see the log.
+ 1. The log should show that users you added to the app are pushed to Sumo Logic with an event info message like **Push new user to external application SUCCESS**.
+1. Verify in Sumo Logic:
+ 1. Log in to the Sumo Logic instance that you linked to the provisioning app in Step 2 when you provided the Assertion Consumer URL and entity ID.
+ 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Users and Roles > Users**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Administration**, and then under **Users and Roles** select **Users**. You can also click the **Go To...** menu at the top of the screen and select **Users**.
+ 1. Search for the users provisioned from Okta.
+ 1. You should see the users listed, and with the role given to when you assigned them to the app in Okta.
+
+## Syncing between Okta and Sumo Logic
+
+When you modify the name, email, or role of a user assigned the app in Okta, the changes will be synced to the corresponding user in Sumo Logic.
+
+If you unassign a user from the app in Okta, the corresponding user is deactivated in Sumo Logic. (If you later try to reassign that same user to the app, it will result in an error in Sumo Logic. You must delete the old user from Sumo Logic first so that the user can be provisioned once again from Okta.)
diff --git a/docs/manage/security/scim/provision-with-onelogin.md b/docs/manage/security/scim/provision-with-onelogin.md
new file mode 100644
index 0000000000..60f32a7bdd
--- /dev/null
+++ b/docs/manage/security/scim/provision-with-onelogin.md
@@ -0,0 +1,143 @@
+---
+id: provision-with-onelogin
+title: Provision with OneLogin
+sidebar_label: Provision with OneLogin
+description: Learn how to provision users in Sumo Logic with OneLogin.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+This article describes how to provision users in Sumo Logic with OneLogin.
+
+## Prerequisites
+
+### Create an access key
+
+Create an [access key](/docs/manage/security/access-keys/). (We recommend using a service account to create the access key.) This access key will provide authorization to provision users from OneLogin into Sumo Logic.
+
+When you create the access key, copy its access ID and access key values. You will enter these when you use [Base64 encoding](https://www.base64encode.org/) to Base64 encode `:` to generate a token.
+
+## Configure provisioning with OneLogin
+
+### Step 1: Create the app
+
+1. Log in to your [OneLogin](https://www.onelogin.com/) account as an administrator.
+1. Select **Applications > Applications**.
+1. Click **Add App**.
})
+1. Select **SCIM Provisioner with SAML (SCIM v2 Enterprise)**.
+1. Change the **Display Name** to the name you want to use for your app.
+1. Click **Save**.
})
+
+### Step 2: Set up single sign-on
+
+Follow the directions in [Configure a SAML app in OneLogin](/docs/manage/security/saml/integrate-onelogin/#configure-a-saml-app-in-onelogin) beginning with the step where you configure the **SSO** tab.
+
+})
+
+When you follow these instructions, on the **Configuration** tab you'll add the **SAML Audience URL** and **SAML Consumer URL**. Obtain these values from the assertion consumer URL and entity ID on the [SAML configuration](/docs/manage/security/saml/integrate-onelogin/#configure-saml-in-sumo) of the Sumo Logic tenant where you will provision users.
})
+
+:::note
+Also on the **Configuration** tab, for **SCIM Base URL** enter the [API endpoint for your deployment](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for the [SCIM User Management APIs](/docs/api/scim-user/) using the format `/v1/scim/`. For example, `https://api.sumologic.com/api/v1/scim/`. You will perform additional configuration of the app later.
+:::
+
+### Step 3: Set up roles
+
+1. Add a custom role field:
+ 1. From the main menu, select **Users > Custom User Fields**.
+ 1. Click **New User Field**.
+ 1. For **Name** enter `roles`.
+ 1. For **Short name** enter `roles`.
+ 1. Click **Save**.
})
+1. Navigate to **Applications > Applications**.
+1. Select the application you created in Step 1.
})
+1. Select **Parameters**.
})
+1. Add the `role` parameter:
+ 1. Click **+**.
+ 1. In **Name** enter `roles`.
+ 1. Select **Include in SAML Assertion**.
+ 1. Click **Save**.
+ 1. In **Value** select **roles (Custom)**.
+ 1. Click **Save**.
})
+1. Add the rest of the parameters as shown. When you add the custom parameters, select **Include in SAML assertion**.
})
+
+### Step 4: Set up provisioning
+
+1. In the app, select **Configuration**.
+1. Configure the app:
+ 1. Enter the **SAML Audience URL** (entity ID) and **SAML Consumer URL** (assertion consumer URL) for your Sumo Logic instance:
})
Obtain the assertion consumer URL and entity ID from the SAML configuration of the Sumo Logic tenant where you will provision users. You set up this [SAML configuration](/docs/manage/security/saml/integrate-onelogin/#configure-saml-in-sumo) in Step 2.
+ 1. For **API Status**, click **Enable**.
+ 1. For **SCIM Base URL**, ensure that you have entered the [API endpoint for your deployment](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for the [SCIM User Management APIs](/docs/api/scim-user/) using the format `/v1/scim/`. For example, `https://api.sumologic.com/api/v1/scim/`.
+ 1. For **SCIM JSON Template**, enter the following:
+ ```json
+ {
+ "schemas": [
+ "urn:ietf:params:scim:schemas:core:2.0:User"
+ ],
+ "userName": "{$parameters.scimusername}",
+ "name": {
+ "familyName": "{$user.lastname}",
+ "givenName": "{$user.firstname}"
+ },
+ "emails": [{
+ "value": "{$user.email}",
+ "type": "work",
+ "primary": true
+ }],
+ "roles": [{
+ "value": "{$user.custom_fields.roles}",
+ "primary": true
+ }]
+ }
+ ```
+ 1. For **Custom Headers**, enter:
+ ```
+ Accept: application/scim+json
+ Content-Type: application/scim+json
+ ```
+ 1. For **SCIM Bearer Token**, use [Base64 encoding](https://www.base64encode.org/) to encode `:` (see [Prerequisites](#prerequisites)). Enter the resulting value into the **SCIM Bearer Token** field.
+ 1. Click **Save**.
+1. Enable provisioning:
+ 1. In the app, select **Provisioning**.
+ 1. Select **Enable Provisioning**.
+ 1. Click **Save**.
})
+
+### Step 5: Assign users to the app
+
+1. Create a new user:
+ 1. From the main menu, select **Users > Users**.
+ 1. Click **New User**.
+ 1. Enter **First Name**, **Last Name**, and **Email**.
+ 1. Under **Custom Fields**, for **roles** enter `Administrator`.
+ 1. Click **Save User**.
})
+1. Assign the app to the user:
+ 1. While viewing the user, click **Applications**.
+ 1. Click **+**.
+ 1. Select the app you created in Step 1.
+ 1. Click **Continue**.
+ 1. Click **Save**.
})
+1. Approve the user for provisioning:
+ 1. From the main menu, select **Applications > Applications**.
+ 1. Select the application you created in Step 1.
+ 1. Select **Users**.
+ 1. Click **Pending** on the user you want to approve for provisioning.
})
+ 1. Click **Approve**.
})
+ 1. The user is provisioned to Sumo Logic.
+
+### Step 6: Verify provisioning
+
+Users assigned to the app are provisioned into Sumo Logic.
+
+1. Verify in OneLogin:
+ 1. In the main menu, select **Provisioning** and then select the **Monitoring** tab.
+ 1. The events for provisioned users should appear. Click an event for details.
+1. Verify in Sumo Logic:
+ 1. Log in to the Sumo Logic instance that you linked to the provisioning app in Step 2 when you provided the Assertion Consumer URL and entity ID.
+ 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Users and Roles > Users**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Administration**, and then under **Users and Roles** select **Users**. You can also click the **Go To...** menu at the top of the screen and select **Users**.
+ 1. Search for the users provisioned from OneLogin.
+ 1. You should see the users listed, and with the role given to when you assigned them to the app in OneLogin.
+
+## Syncing between OneLogin and Sumo Logic
+
+When you modify the name, email, or role of a user assigned the app in OneLogin, the changes will be synced to the corresponding user in Sumo Logic.
+
+If you unassign a user from the app in OneLogin, the corresponding user is deactivated in Sumo Logic. (If you later try to reassign that same user to the app, it will result in an error in Sumo Logic. You must delete the old user from Sumo Logic first so that the user can be provisioned once again from OneLogin.)
\ No newline at end of file
diff --git a/sidebars.ts b/sidebars.ts
index 277c8c48ee..b7d65342b4 100644
--- a/sidebars.ts
+++ b/sidebars.ts
@@ -1096,6 +1096,19 @@ module.exports = {
'manage/security/saml/view-saml-debug-information',
]
},
+ {
+ type: 'category',
+ label: 'SCIM Provisioning',
+ collapsible: true,
+ collapsed: true,
+ link: {type: 'doc', id: 'manage/security/scim/index'},
+ items: [
+ 'manage/security/scim/about-scim-provisioning',
+ 'manage/security/scim/provision-with-microsoft-entra-id',
+ 'manage/security/scim/provision-with-okta',
+ 'manage/security/scim/provision-with-onelogin',
+ ]
+ },
'manage/security/set-password-policy',
'manage/security/set-limit-user-concurrent-sessions',
'manage/security/set-max-web-session-timeout',
@@ -3096,6 +3109,7 @@ integrations: [
'api/saml-configuration',
'api/scan-budget',
'api/scheduled-views',
+ 'api/scim-user',
'api/search-job',
'api/service-accounts',
'api/service-allowlist',
diff --git a/static/img/security/provision-azure-add-assignment.png b/static/img/security/provision-azure-add-assignment.png
new file mode 100644
index 0000000000..90ae98c09b
Binary files /dev/null and b/static/img/security/provision-azure-add-assignment.png differ
diff --git a/static/img/security/provision-azure-add-users.png b/static/img/security/provision-azure-add-users.png
new file mode 100644
index 0000000000..c41a08150e
Binary files /dev/null and b/static/img/security/provision-azure-add-users.png differ
diff --git a/static/img/security/provision-azure-app-registration.png b/static/img/security/provision-azure-app-registration.png
new file mode 100644
index 0000000000..54f762a86c
Binary files /dev/null and b/static/img/security/provision-azure-app-registration.png differ
diff --git a/static/img/security/provision-azure-app.png b/static/img/security/provision-azure-app.png
new file mode 100644
index 0000000000..81c866f461
Binary files /dev/null and b/static/img/security/provision-azure-app.png differ
diff --git a/static/img/security/provision-azure-assertion-consumer-url.png b/static/img/security/provision-azure-assertion-consumer-url.png
new file mode 100644
index 0000000000..b2e839e28a
Binary files /dev/null and b/static/img/security/provision-azure-assertion-consumer-url.png differ
diff --git a/static/img/security/provision-azure-attribute-mappings.png b/static/img/security/provision-azure-attribute-mappings.png
new file mode 100644
index 0000000000..6564add3b9
Binary files /dev/null and b/static/img/security/provision-azure-attribute-mappings.png differ
diff --git a/static/img/security/provision-azure-basic-saml-configuration.png b/static/img/security/provision-azure-basic-saml-configuration.png
new file mode 100644
index 0000000000..93c7314ae9
Binary files /dev/null and b/static/img/security/provision-azure-basic-saml-configuration.png differ
diff --git a/static/img/security/provision-azure-create-app-role-dialog.png b/static/img/security/provision-azure-create-app-role-dialog.png
new file mode 100644
index 0000000000..5acc6d13fb
Binary files /dev/null and b/static/img/security/provision-azure-create-app-role-dialog.png differ
diff --git a/static/img/security/provision-azure-create-app-role.png b/static/img/security/provision-azure-create-app-role.png
new file mode 100644
index 0000000000..3f899c4a53
Binary files /dev/null and b/static/img/security/provision-azure-create-app-role.png differ
diff --git a/static/img/security/provision-azure-create-your-own-app.png b/static/img/security/provision-azure-create-your-own-app.png
new file mode 100644
index 0000000000..4f6f9cc3e9
Binary files /dev/null and b/static/img/security/provision-azure-create-your-own-app.png differ
diff --git a/static/img/security/provision-azure-edit-basic-saml-config.png b/static/img/security/provision-azure-edit-basic-saml-config.png
new file mode 100644
index 0000000000..fe5d66ebf3
Binary files /dev/null and b/static/img/security/provision-azure-edit-basic-saml-config.png differ
diff --git a/static/img/security/provision-azure-mappings.png b/static/img/security/provision-azure-mappings.png
new file mode 100644
index 0000000000..dc4721bca9
Binary files /dev/null and b/static/img/security/provision-azure-mappings.png differ
diff --git a/static/img/security/provision-azure-name-app.png b/static/img/security/provision-azure-name-app.png
new file mode 100644
index 0000000000..94a8c43a7e
Binary files /dev/null and b/static/img/security/provision-azure-name-app.png differ
diff --git a/static/img/security/provision-azure-new-app.png b/static/img/security/provision-azure-new-app.png
new file mode 100644
index 0000000000..f22a911d22
Binary files /dev/null and b/static/img/security/provision-azure-new-app.png differ
diff --git a/static/img/security/provision-azure-provision-on-demand.png b/static/img/security/provision-azure-provision-on-demand.png
new file mode 100644
index 0000000000..7da64017bf
Binary files /dev/null and b/static/img/security/provision-azure-provision-on-demand.png differ
diff --git a/static/img/security/provision-azure-provisioning-status.png b/static/img/security/provision-azure-provisioning-status.png
new file mode 100644
index 0000000000..f11c980afa
Binary files /dev/null and b/static/img/security/provision-azure-provisioning-status.png differ
diff --git a/static/img/security/provision-azure-provisioning.png b/static/img/security/provision-azure-provisioning.png
new file mode 100644
index 0000000000..121ae32e92
Binary files /dev/null and b/static/img/security/provision-azure-provisioning.png differ
diff --git a/static/img/security/provision-azure-role-attribute.png b/static/img/security/provision-azure-role-attribute.png
new file mode 100644
index 0000000000..16b3cdafd6
Binary files /dev/null and b/static/img/security/provision-azure-role-attribute.png differ
diff --git a/static/img/security/provision-azure-select-saml.png b/static/img/security/provision-azure-select-saml.png
new file mode 100644
index 0000000000..272c8435cf
Binary files /dev/null and b/static/img/security/provision-azure-select-saml.png differ
diff --git a/static/img/security/provision-azure-set-up-sso.png b/static/img/security/provision-azure-set-up-sso.png
new file mode 100644
index 0000000000..970cf90b09
Binary files /dev/null and b/static/img/security/provision-azure-set-up-sso.png differ
diff --git a/static/img/security/provision-okta-add-attribute-to-provisioning-user.png b/static/img/security/provision-okta-add-attribute-to-provisioning-user.png
new file mode 100644
index 0000000000..1cb12d76dc
Binary files /dev/null and b/static/img/security/provision-okta-add-attribute-to-provisioning-user.png differ
diff --git a/static/img/security/provision-okta-add-attribute.png b/static/img/security/provision-okta-add-attribute.png
new file mode 100644
index 0000000000..7fa7921b82
Binary files /dev/null and b/static/img/security/provision-okta-add-attribute.png differ
diff --git a/static/img/security/provision-okta-add-role-attribute-to-provisioning-user.png b/static/img/security/provision-okta-add-role-attribute-to-provisioning-user.png
new file mode 100644
index 0000000000..1e77670bbe
Binary files /dev/null and b/static/img/security/provision-okta-add-role-attribute-to-provisioning-user.png differ
diff --git a/static/img/security/provision-okta-add-roles-attribute.png b/static/img/security/provision-okta-add-roles-attribute.png
new file mode 100644
index 0000000000..274885206f
Binary files /dev/null and b/static/img/security/provision-okta-add-roles-attribute.png differ
diff --git a/static/img/security/provision-okta-app-name.png b/static/img/security/provision-okta-app-name.png
new file mode 100644
index 0000000000..a65e89529b
Binary files /dev/null and b/static/img/security/provision-okta-app-name.png differ
diff --git a/static/img/security/provision-okta-assign-role.png b/static/img/security/provision-okta-assign-role.png
new file mode 100644
index 0000000000..f02cf3cd5b
Binary files /dev/null and b/static/img/security/provision-okta-assign-role.png differ
diff --git a/static/img/security/provision-okta-assign-to-people.png b/static/img/security/provision-okta-assign-to-people.png
new file mode 100644
index 0000000000..248b1cca55
Binary files /dev/null and b/static/img/security/provision-okta-assign-to-people.png differ
diff --git a/static/img/security/provision-okta-attribute-mappings-to-okta.png b/static/img/security/provision-okta-attribute-mappings-to-okta.png
new file mode 100644
index 0000000000..55f305b0a8
Binary files /dev/null and b/static/img/security/provision-okta-attribute-mappings-to-okta.png differ
diff --git a/static/img/security/provision-okta-attribute-mappings.png b/static/img/security/provision-okta-attribute-mappings.png
new file mode 100644
index 0000000000..5ff992194e
Binary files /dev/null and b/static/img/security/provision-okta-attribute-mappings.png differ
diff --git a/static/img/security/provision-okta-configure-saml.png b/static/img/security/provision-okta-configure-saml.png
new file mode 100644
index 0000000000..3c5d11768c
Binary files /dev/null and b/static/img/security/provision-okta-configure-saml.png differ
diff --git a/static/img/security/provision-okta-create-app.png b/static/img/security/provision-okta-create-app.png
new file mode 100644
index 0000000000..17c85c8789
Binary files /dev/null and b/static/img/security/provision-okta-create-app.png differ
diff --git a/static/img/security/provision-okta-new-app.png b/static/img/security/provision-okta-new-app.png
new file mode 100644
index 0000000000..675eab6dea
Binary files /dev/null and b/static/img/security/provision-okta-new-app.png differ
diff --git a/static/img/security/provision-okta-profile-editor-app-attributes.png b/static/img/security/provision-okta-profile-editor-app-attributes.png
new file mode 100644
index 0000000000..22ace41a1e
Binary files /dev/null and b/static/img/security/provision-okta-profile-editor-app-attributes.png differ
diff --git a/static/img/security/provision-okta-provisioning-tab.png b/static/img/security/provision-okta-provisioning-tab.png
new file mode 100644
index 0000000000..9112afd957
Binary files /dev/null and b/static/img/security/provision-okta-provisioning-tab.png differ
diff --git a/static/img/security/provision-okta-provisioning-to-app.png b/static/img/security/provision-okta-provisioning-to-app.png
new file mode 100644
index 0000000000..7c6f48cb64
Binary files /dev/null and b/static/img/security/provision-okta-provisioning-to-app.png differ
diff --git a/static/img/security/provision-okta-scim-app-user.png b/static/img/security/provision-okta-scim-app-user.png
new file mode 100644
index 0000000000..afb761f416
Binary files /dev/null and b/static/img/security/provision-okta-scim-app-user.png differ
diff --git a/static/img/security/provision-okta-scim-provisioning-setting.png b/static/img/security/provision-okta-scim-provisioning-setting.png
new file mode 100644
index 0000000000..02a50a9f3d
Binary files /dev/null and b/static/img/security/provision-okta-scim-provisioning-setting.png differ
diff --git a/static/img/security/provision-okta-select-saml-20.png b/static/img/security/provision-okta-select-saml-20.png
new file mode 100644
index 0000000000..b514c5a7c0
Binary files /dev/null and b/static/img/security/provision-okta-select-saml-20.png differ
diff --git a/static/img/security/provision-okta-select-user.png b/static/img/security/provision-okta-select-user.png
new file mode 100644
index 0000000000..b30dbda413
Binary files /dev/null and b/static/img/security/provision-okta-select-user.png differ
diff --git a/static/img/security/provision-okta-test-connection.png b/static/img/security/provision-okta-test-connection.png
new file mode 100644
index 0000000000..b4236e5e2e
Binary files /dev/null and b/static/img/security/provision-okta-test-connection.png differ
diff --git a/static/img/security/provision-okta-users.png b/static/img/security/provision-okta-users.png
new file mode 100644
index 0000000000..fe8fb7b0f8
Binary files /dev/null and b/static/img/security/provision-okta-users.png differ
diff --git a/static/img/security/provision-one-login-add-user-to-app.png b/static/img/security/provision-one-login-add-user-to-app.png
new file mode 100644
index 0000000000..c0b5315849
Binary files /dev/null and b/static/img/security/provision-one-login-add-user-to-app.png differ
diff --git a/static/img/security/provision-onelogin-add-app.png b/static/img/security/provision-onelogin-add-app.png
new file mode 100644
index 0000000000..2d5ed21624
Binary files /dev/null and b/static/img/security/provision-onelogin-add-app.png differ
diff --git a/static/img/security/provision-onelogin-all-parameters.png b/static/img/security/provision-onelogin-all-parameters.png
new file mode 100644
index 0000000000..a82c36c9f1
Binary files /dev/null and b/static/img/security/provision-onelogin-all-parameters.png differ
diff --git a/static/img/security/provision-onelogin-app.png b/static/img/security/provision-onelogin-app.png
new file mode 100644
index 0000000000..f15cba17ac
Binary files /dev/null and b/static/img/security/provision-onelogin-app.png differ
diff --git a/static/img/security/provision-onelogin-approve-dialog.png b/static/img/security/provision-onelogin-approve-dialog.png
new file mode 100644
index 0000000000..8572e97345
Binary files /dev/null and b/static/img/security/provision-onelogin-approve-dialog.png differ
diff --git a/static/img/security/provision-onelogin-approve-user.png b/static/img/security/provision-onelogin-approve-user.png
new file mode 100644
index 0000000000..347dcb3b5a
Binary files /dev/null and b/static/img/security/provision-onelogin-approve-user.png differ
diff --git a/static/img/security/provision-onelogin-configuration.png b/static/img/security/provision-onelogin-configuration.png
new file mode 100644
index 0000000000..77cf9a2bd3
Binary files /dev/null and b/static/img/security/provision-onelogin-configuration.png differ
diff --git a/static/img/security/provision-onelogin-enable-provisioning.png b/static/img/security/provision-onelogin-enable-provisioning.png
new file mode 100644
index 0000000000..18ce1c3b3a
Binary files /dev/null and b/static/img/security/provision-onelogin-enable-provisioning.png differ
diff --git a/static/img/security/provision-onelogin-new-user.png b/static/img/security/provision-onelogin-new-user.png
new file mode 100644
index 0000000000..e19d6a6495
Binary files /dev/null and b/static/img/security/provision-onelogin-new-user.png differ
diff --git a/static/img/security/provision-onelogin-parameters.png b/static/img/security/provision-onelogin-parameters.png
new file mode 100644
index 0000000000..bf56b298dc
Binary files /dev/null and b/static/img/security/provision-onelogin-parameters.png differ
diff --git a/static/img/security/provision-onelogin-rename-app.png b/static/img/security/provision-onelogin-rename-app.png
new file mode 100644
index 0000000000..2ad0ce5fc6
Binary files /dev/null and b/static/img/security/provision-onelogin-rename-app.png differ
diff --git a/static/img/security/provision-onelogin-role-field.png b/static/img/security/provision-onelogin-role-field.png
new file mode 100644
index 0000000000..c06ebe0c74
Binary files /dev/null and b/static/img/security/provision-onelogin-role-field.png differ
diff --git a/static/img/security/provision-onelogin-role-parameter.png b/static/img/security/provision-onelogin-role-parameter.png
new file mode 100644
index 0000000000..8fc2f5d0b8
Binary files /dev/null and b/static/img/security/provision-onelogin-role-parameter.png differ
diff --git a/static/img/security/provision-onelogin-sso-tab.png b/static/img/security/provision-onelogin-sso-tab.png
new file mode 100644
index 0000000000..21391a6410
Binary files /dev/null and b/static/img/security/provision-onelogin-sso-tab.png differ
diff --git a/static/img/security/provision-onelogin-sumologic-saml-settings.png b/static/img/security/provision-onelogin-sumologic-saml-settings.png
new file mode 100644
index 0000000000..fda6f20ca2
Binary files /dev/null and b/static/img/security/provision-onelogin-sumologic-saml-settings.png differ
diff --git a/static/img/security/provision-sumo-logic-saml-settings.png b/static/img/security/provision-sumo-logic-saml-settings.png
new file mode 100644
index 0000000000..7486798a99
Binary files /dev/null and b/static/img/security/provision-sumo-logic-saml-settings.png differ
}){kind=icon}
}){kind=icon}