Skip to content

Commit e0dce44

Browse files
dcpenadcpena
committed
Split out SCIM content
1 parent e6f572c commit e0dce44

File tree

4 files changed

+276
-168
lines changed

4 files changed

+276
-168
lines changed

‎src/content/docs/fundamentals/account/account-security/scim-setup.mdx‎

Lines changed: 0 additions & 168 deletions
This file was deleted.

‎src/content/docs/fundamentals/account/account-security/scim-setup/entra.mdx‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Provision with Microsoft Entra
4+
sidebar:
5+
label: Microsoft Entra
6+
---
7+
8+
## Set up the Enterprise application
9+
10+
1. Go to your Microsoft Entra ID instance and select **Enterprise Applications**.
11+
2. Select **Create your own application** and name your application.
12+
3. Select **Integrate any other application you do not find in the gallery (Non-gallery)**.
13+
4. Select **Create**.
14+
15+
## Provision the Enterprise application
16+
17+
1. Under **Manage** on the sidebar menu, select **Provisioning**.
18+
2. Select **Automatic** on the dropdown menu for the Provisioning Mode.
19+
3. Enter your API token value and the tenant URL: `https://api.cloudflare.com/client/v4/accounts/<your_account_ID>/scim/v2`.
20+
4. Select **Test Connection**, then select **Save**.
21+
22+
## Configure user permissions in Microsoft Entra ID
23+
24+
1. Once the SCIM application is created, [assign users and groups to the application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal).
25+
26+
:::note
27+
You must have opted into the Cloudflare User Groups Public Beta to synchronize groups from Okta to Cloudflare. Refer to the [User Groups](/fundamentals/setup/manage-members/user-groups/) documentation for more information.
28+
29+
Currently, groups need to match a specific format to provision specific Cloudflare account-level roles. Cloudflare is in the process of adding Cloudflare Groups, which can take in freeform group names in the future.
30+
:::
31+
32+
2. To begin syncing your Users & Groups into Cloudflare, navigate back to **Provisioning**, and under **Provisioning Status**, check *On*, then select **Save**.
33+
34+
:::note
35+
To successfully provision with Microsoft Entra ID, the `user principal name` and `email` fields must match. These values are case-sensitive.
36+
:::
37+
38+
3. To check which users and groups were synchronized, select **Provisioning logs**.
39+
4. To verify the integration, select **Provisioning Logs** in Entra ID application, and check the Cloudflare Dash Audit Logs by navigating to **Manage Account** > **Audit Log**.
40+
5. To grant permissions to Users & Groups in Cloudflare, refer to the Permission Policies guide.
41+
42+
43+
## (Optional) Automate Cloudflare's SCIM integration
44+
45+
Cloudflare's SCIM integration requires one external application per account. Customers with many accounts may want to automate part of the setup to save time and reduce the amount of time spent in the Entra administrative UI.
46+
47+
The initial setup of creating the non-gallery applications and adding the provisioning URL and API key are scriptable via API, but the rest of the setup is dependent on your specific need and IDP configuration.
48+
49+
**1. Get an access token**
50+
51+
Get an Entra access token. Note that the example below is using the Azure CLI.
52+
53+
```
54+
# Using azure-cli
55+
az login
56+
az account get-access-token --resource https://graph.microsoft.com
57+
58+
(payload with accessToken returned)
59+
```
60+
**2. Create a new application via template.**
61+
62+
The template ID 8adf8e6e-67b2-4cf2-a259-e3dc5476c621 is the suggested template to create non-gallery apps in the Entra docs. Replace `<accessToken>` and `displayName` with your values.
63+
64+
```curl title="Example request"
65+
curl -X POST 'https://graph.microsoft.com/v1.0/applicationTemplates/8adf8e6e-67b2-4cf2-a259-e3dc5476c621/instantiate' \
66+
--header 'Content-Type: application/json' \
67+
--header 'Authorization: Bearer <accessToken>' \
68+
--data-raw '{
69+
"displayName": "Entra API create application test"
70+
}'
71+
```
72+
73+
```curl title="Example response"
74+
{
75+
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.applicationServicePrincipal",
76+
"application": {
77+
"id": "343a8552-f9d9-471c-b677-d37062117cc8", //
78+
"appId": "03d8207b-e837-4be9-b4e6-180492eb3b61",
79+
"applicationTemplateId": "8adf8e6e-67b2-4cf2-a259-e3dc5476c621",
80+
"createdDateTime": "2025-01-30T00:37:44Z",
81+
"deletedDateTime": null,
82+
"displayName": "Entra API create application test",
83+
"description": null,
84+
// ... snipped rest of large application payload
85+
},
86+
"servicePrincipal": {
87+
"id": "a8cb133d-f841-4eb9-8bc9-c8e9e8c0d417", // Note this ID for the subsequent request
88+
"deletedDateTime": null,
89+
"accountEnabled": true,
90+
"appId": "03d8207b-e837-4be9-b4e6-180492eb3b61",
91+
"applicationTemplateId": "8adf8e6e-67b2-4cf2-a259-e3dc5476c621",
92+
"appDisplayName": "Entra API create application test",
93+
// ...snipped rest of JSON payload
94+
}
95+
```
96+
97+
**3. Create a provisioning job**
98+
99+
To enable provisioning, you will also need to create a job. Note the SERVICE_PRINCIPAL_ID in the previous request will be used in the request below. The SCIM templateId is an Entra provided template.
100+
101+
```curl title="Example request"
102+
curl -X POST 'https://graph.microsoft.com/v1.0/servicePrincipals/<SERVICE_PRINCIPAL_ID>/synchronization/jobs' \
103+
--header 'Content-Type: application/json' \
104+
--header 'Authorization: Bearer <accessToken>' \
105+
--data-raw '{
106+
"templateId": "scim"
107+
}'
108+
```
109+
110+
```curl title="Example response"
111+
{
112+
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a8cb133d-f841-4eb9-8bc9-c8e9e8c0d417')/synchronization/jobs/$entity",
113+
"id": "scim.5b223a2cc249463bbd9a791550f11c76.03d8207b-e837-4be9-b4e6-180492eb3b61",
114+
"templateId": "scim",
115+
"schedule": {
116+
"expiration": null,
117+
"interval": "PT40M",
118+
"state": "Disabled"
119+
},
120+
// ... snipped rest of JSON payload
121+
```
122+
123+
**4. Configure the SCIM provisioning URL and API token**
124+
125+
Next, configure the Tenant URL (Cloudflare SCIM endpoint) and API token (SCIM Provisioning API Token).
126+
127+
Replace `<accessToken>`, `<ACCOUNT_ID>`, `<SCIM_PROVISIONING_API_TOKEN_VALUE>` with your values.
128+
129+
```curl title="Example request"
130+
--header 'Content-Type: application/json' \
131+
--header 'Authorization: Bearer <accessToken>' \
132+
--data-raw '{
133+
"value": [
134+
{
135+
"key": "BaseAddress",
136+
"value": "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/scim/v2"
137+
},
138+
{
139+
"key": "SecretToken",
140+
"value": "<SCIM_PROVISIONING_API_TOKEN_VALUE>"
141+
}
142+
]
143+
}'
144+
```
145+
146+
After completing the tasks above, the next steps in Entra include:
147+
148+
- Additional group/provisioning configuration
149+
- Test and save after updating the config.
150+
- Provisioning after configuration is complete
151+
152+
## Expected behaviors
153+
154+
Expectations for user lifecycle management with SCIM:
155+
156+
| Expected Cloudflare dash behavior | Identity provider action |
157+
| ---------------------------------------------- |-------------------------------|
158+
| User is added to account as member | Assign the user to a SCIM application. They will be assigned the Minimal Account Access role so that their dash experience is not broken. |
159+
| User is removed from account as member | Unassign the user from the SCIM application. |
160+
| Add role to user | Add the user to a group in the IdP which is pushed via SCIM. They must also be assigned to the SCIM application and exist as an account member. |
161+
| Remove role from user | Remove the user from the corresponding group in the IdP. |
162+
| Retain user in account but with no permissions | Remove the user from all role groups but leave them assigned to the SCIM application. They will be an account member with only the role Minimal Account Access. |

‎src/content/docs/fundamentals/account/account-security/scim-setup/index.mdx‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
pcx_content_type: how-to
3+
title: SCIM provisioning
4+
updated: 2024-12-04
5+
6+
---
7+
8+
Cloudflare supports bulk provisioning of users into the Cloudflare dashboard by using the System for Cross-domain Identity Management (SCIM) protocol. This allows you to connect your external identity provider (IdP) to Cloudflare and quickly onboard and manage users and their permissions. Cloudflare supports SCIM onboarding with Okta and Microsoft Entra.
9+
10+
:::note
11+
This section covers SCIM provisioning for the Cloudflare dashboard only. If you need to provision SCIM for Cloudflare Zero Trust, refer to [Zero Trust SCIM provisioning](/cloudflare-one/identity/users/scim/).
12+
:::
13+
14+
## Limitations
15+
16+
- If a user is the only Super Administrator on an Enterprise account, they will not be deprovisioned.
17+
- Cloudflare currently only supports [Account-scoped Roles](/fundamentals/manage-members/roles/#account-scoped-roles) and does not support Domain-scoped Roles provisioning via SCIM.
18+
- Cloudflare does not allow custom user groups.
19+
20+
## Prerequisites
21+
22+
- Cloudflare provisioning with SCIM is only available to Enterprise customers using Okta or Microsoft Entra.
23+
- You must be a [Super Administrator](/fundamentals/manage-members/roles/) on the account.
24+
- In your identity provider, you must have the ability to create applications and groups.
25+
26+
---
27+
## Gather the required data
28+
29+
To start, you will need to collect a couple of pieces of data from Cloudflare and set these aside for later use.
30+
31+
### Get your Account ID
32+
33+
34+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to the Cloudflare account that you want to configure for SCIM provisioning.
35+
2. Copy your account ID from the account home page.
36+
37+
### Create an API token
38+
39+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
40+
41+
| Type | Item | Permission |
42+
| ------- | ----------------- | ---------- |
43+
| Account | SCIM Provisioning | Edit |
44+
45+
:::note
46+
47+
Cloudflare recommends using Account Owned API Tokens for SCIM Provisioning. Using user-specific API tokens, while supported, will lead to a broken SCIM connection in the event that the user's policies are revoked from the account with the SCIM integration. Learn more about [account owned tokens](/fundamentals/api/get-started/account-owned-tokens/).
48+
:::
49+
50+
2. Under **Account Resources**, select the specific account to include or exclude from the dropdown menu, if applicable.
51+
3. Select **Continue to summary**.
52+
4. Validate the permissions and select **Create Token**.
53+
5. Copy the token value.
54+
55+
## Expected behaviors
56+
57+
Expectations for user lifecycle management with SCIM:
58+
59+
| Expected Cloudflare dash behavior | Identity provider action |
60+
| --------------------------------- | ------------------------- |
61+
| User is added to account as member | Assign the user to a SCIM application. They will be assigned the Minimal Account Access role so that their dash experience is not broken. |
62+
| User is removed from account as member | Unassign the user from the SCIM application. |
63+
| Add role to user | Add the user to a group in the IdP which is pushed via SCIM. They must also be assigned to the SCIM application and exist as an account member. |
64+
| Remove role from user | Remove the user from the corresponding group in the IdP. |
65+
| Retain user in account but with no permissions | Remove the user from all role groups but leave them assigned to the SCIM application. They will be an account member with only the role Minimal Account Access. |

0 commit comments

Comments
 (0)