Add and remove people automatically with SCIM

This article is for administrators who may change settings and also invite, deactivate and give roles to people, such as the Tenant administrator. With SCIM, your identity provider adds people to FairPro, keeps their names and email addresses current and deactivates them when they leave.

How it works

• People only. Your identity provider adds, changes and deactivates people. It does not send groups, and it never gives roles beyond the one you choose for new people. You give other roles in FairPro.
• Acts as you. The token works with your permissions. If you are deactivated it stops working, and if you lose a permission it can no longer do what that permission allows.
• Nobody is deleted. Removing someone in the identity provider deactivates them in FairPro, so their history and audit trail are kept.
• Single sign-on too. People it adds can sign in through your identity provider when single sign-on is set up for their email domain.

Microsoft Entra ID and Okta can provision people this way. Google Workspace cannot: it provisions people only to apps from its own catalogue, not to a custom app. With Google Workspace, invite people under People, or let FairPro add them on their first single sign-on.

Make a token in FairPro

1. Open Security and find Provisioning (SCIM).
2. Type a Name, such as Microsoft Entra ID or Okta.
3. Choose the Role for new people. Roles that let people manage users or settings are not offered, so a lost token cannot make administrators.
4. Leave Email a welcome to people it adds ticked unless you tell people yourself. Identity providers do not tell people they have been added.
5. Choose Make a token.

FairPro shows the Tenant URL and the Secret token once. Copy both into your identity provider straight away. FairPro keeps only a fingerprint of the token, so it cannot show it again.

Where people sign in with a password, everyone added also gets an email with a temporary password, even with the welcome turned off.

Microsoft Entra ID

1. In the Microsoft Entra admin center, open Enterprise applications and open your FairPro application. If you have none yet, choose New application, then Create your own application, and choose the option for an application not in the gallery.
2. Open Provisioning and choose New configuration. On older screens, choose Get started and set Provisioning Mode to Automatic.
3. Paste FairPro’s Tenant URL into Tenant URL and the Secret token into Secret token. Choose Test connection, then save.
4. Under Mappings, set Provision Microsoft Entra ID Groups to off, because FairPro does not take groups.
5. Open Provision Microsoft Entra ID Users. Entra sends the user principal name as userName unless you change it. If people’s user principal name is not their email address, map userName from mail instead, because FairPro knows people by email.
6. Under Settings, set Scope to Sync only assigned users and groups, and assign people under Users and groups.
7. Set Provisioning Status to On and save.

Entra sends changes about every 40 minutes. To try one person at once, use Provision on demand.

Okta

Okta adds provisioning to the SAML app integration you made for single sign-on.

1. In the Okta Admin Console, open the FairPro app. On the General tab, under App Settings, choose Edit, set Provisioning to SCIM and choose Save.
2. On the Provisioning tab, under Integration, choose Edit.
3. Paste FairPro’s Tenant URL into SCIM connector base URL, and type userName in Unique identifier field for users.
4. Under Supported provisioning actions, tick Push New Users and Push Profile Updates.
5. Set Authentication Mode to HTTP Header and paste the Secret token into Authorization.
6. Choose Test Connector Configuration, then Save.
7. Under To App, choose Edit, turn on Create Users, Update User Attributes and Deactivate Users, and choose Save.
8. On the Assignments tab, assign the people or groups who should have FairPro.

Okta sends the application username as userName. If you set it to the Okta user ID for single sign-on, FairPro takes the person’s email address from their email instead. Okta then cannot match people who were in FairPro before provisioning started, and shows an error for them; they keep their FairPro access as it is.

What happens to people

• Added: they are invited with the token’s role and, if the token sends it, a welcome email saying how to sign in. If your plan has no room for another person, FairPro refuses and your identity provider shows the error.
• Changed: FairPro keeps their name current. It changes an email address only for someone the token added who has not signed in yet and is not an administrator.
• Removed or deactivated: they are deactivated and signed out. Their open work goes to their line manager, or to you if they have none. Assigning them again brings them back with their roles.
• You: the token cannot deactivate the administrator who made it. Make a token as another administrator first.

Replacing or revoking a token

You can have up to five live tokens, so you can replace one without a gap: make a new token, paste it into your identity provider, then choose Revoke beside the old one. A revoked token stops at once.

If a token may have been seen by someone else, revoke it straight away. Anyone with it can add and deactivate people here.

To change whether a token sends welcome emails, choose Send welcome emails from or Stop welcome emails from beside it.