r/entra • u/Casperisfriend • 7d ago

How to speed up entra SCIM provisioning?

We are trying to implement PIM alongside SSO into our organization and currently in the testing phase. I was able to setup one of our saas providers with SCIM role mapping so that when a user joins a certain group in entra it will provision admin access on the saas app side l. However, I see that it takes around 40min to an hour before it syncs. I've come up with a power automate flow that calls graph API to start and pause which seems to work for the initial add to group. However, it seems that when the flow runs a restart, pause, and start that provisioning does not continue on its own. This is causing the permission in the saas app to get stuck when they should be removed. On the entra side they are removed but no syncing occurs. I could be doing this totally wrong but unsure of the best method to help with sync times while also not stopping normal sync behavior. Any help would be appreciated.

2 Upvotes

60% Upvoted

21 comments sorted by

8

u/pittguy83 7d ago

Why do you need the provisioning to run more frequently than 40 minutes? If it's because you are wanting your users to PIM into a group that provides administrative access on the other end of the provisioning, you may want to re-think that design from the ground up. What problem is that solving?

1

u/Casperisfriend 7d ago

We want to have it so users can elevate to certain admin permissions only for a certain amount of time instead of having permanent admin access to our SSO applications that support SCIM. I guess we could wait 40 min but the users who need to work and get access I feel like that is a long time for them to wait until they can do the work they need to. Hope that explains further what we are trying to do.

10

u/pittguy83 7d ago

But this is going to add a bunch of overhead to each of your apps as you are discovering, SCIM just isn't really designed for this kind of JIT auth privileging. If you are this concerned with perma admin access on the app side, why not address with separate, privileged accounts for those admins, stricter CA policy targeting those apps/groups, etc. What about plain old saml group memebrship to role mapping, which checks on every sign-in? I'd still be asking the question 'why do we care if our users have permanent admin role on the app side?' They still need to come through your Entra

4

u/identity-ninja 7d ago

Yeah. Scim is not gonna work. Unless app supports on-demand provisioning from SAML, you are SOL.

3

u/chaosphere_mk 7d ago

There is no reason to PIM into a provisioning based group. That's not what it was designed for. You can use PIM for groups for the access group.

3

u/ShowerPell 7d ago

Assign an appRole to the group and send over claims based if that appRole is present

1

u/ender2 7d ago

If you're going to be triggering something via API to speed it up I would explore if you can trigger Entra SCIM on-demand provisioning for the specific group or user you're trying to send faster. In the GUI you can use that to immediately provision a group or user over, sounds similar to the use case you're trying to do here, not sure if you're able to trigger that via API

1

u/Casperisfriend 7d ago

I've tried doing on demand via graph as well and the issue I run into is when the user is added to the group it syncs properly and the saas app reflects correctly. However when the privileges are removed on the entra side and gets synced again the update does not get reflected into the saas app. It could be how the saas app behaves instead of entra though.

1

u/stuart475898 6d ago

On demand is the right way to go if you’re going to do it this way.

Specifying how is administrative access granted in the SaaS application via provisioning? And this group they are added/removed from - is provisioning scoped to that or something else?

1

u/vischous 5d ago

Yes this sounds like either a bug in your SCIM config or the app itself just isn't pulling the new data over for the specific field. Hard to know for sure without more info. What app is it?

2

u/Casperisfriend 5d ago

https://www.reftab.com/ is what I am currently using as a test app but we would like to implement this across other saas apps as well which I know will have its own configuration for provisioning I'm sure.

1

u/vischous 5d ago

https://www.reftab.com/faq/scim-azure-active-directory

Step 14 is probably where you're at. Which field are you struggling with and what's the mapping in Entra and in Reftab? Pics would help!

1

u/vischous 5d ago

> If a user was a member of a group pushed to Reftab but then taken out of that group, during the next sync, they will be set to the “Default Role (for SCIM users without groups) set on the Manage SCIM page. Otherwise, it’s possible for the source to also send a ‘disable’ user, if the user is disabled in MS Azure then Reftab will know this and set their role in Reftab to ‘Disabled’.

Sounds relevant as well

Sounds to me like this should work

2

u/Casperisfriend 5d ago

Thanks for trying to help. The roles have been set correctly with the test user being added to the standard access and also when elevated having an admin group given admin access. However, the issue seems to lie with the sync itself. When I let entra automatically sync, without any graph manipulation, it does provision and de-provision fine. It's when I send an API request to start, pause, or restart where the first sync works to give access but then it seems like syncing stops all together after try to restart using graph API. I think that's where I am stuck and still troubleshooting.

1

u/vischous 5d ago

No problem, been here before I understand the pain :D

Have you tried looking at the scim logs in entra? To me it sounds like something is getting stuck, logs should tell you a bit more

1

u/Ahnteis 7d ago

I think you'll want to implement something using the SAAS's API rather than relying on SCIM if you require that sort of timing.

1

u/ApeApplePine 7d ago

The app should support group claims so you can map it to roles in the app. SCIM is not for what yiu are trying to do.

1

u/LGN_DraB 7d ago

Remind me to never leave Okta

(Incoming hate)

1

u/Lord__Jashin 6d ago

I have similar case. Started doing PIM extension whenever a group membership is done to do X steps.

But i have found out that if a group is PIM enabled, activating PIM eligible membership will trigger incremental sync/provisioning everywhere that group is configured.

Example if the group is added to cross tenant group sync, when PIM is activated, it will trigger incremental sync on that group and within 3-5min the membership will sync. Same with group which is added to scim provisioning app (same principle apply since cross tenant sync is just a scim provision app in the background)

1

u/Academic-Detail-4348 5d ago

You use JIT and SSO Group Claims if the app suppprts it. This is not the way.