Linking external user provisioning with Microsoft Entra

Navigate in Microsoft Entra to Applications / Enterprise applications / button: 'New application' / button: Create your own application

Enter the name in the field 'What's the name of your app?'
For this guide the example name is: Zenvoices SCIM

Select the last option: 'Integrate any other application you don’t find in the gallery (Non-gallery)'

Confirm this with the button 'Create' at the bottom

Navigate in Microsoft Entra to Applications / App registrations / button: 'View all applications in the directory'

Select the newly created application (in this example: 'Zenvoices SCIM')

Copy the data from the field Application (client) ID and save it (for example in Notepad)

Do the same for the data from the field Directory (tenant) ID

Open Zenvoices in another browser tab and navigate to
Beheer / Omgeving / Instellingen / tab Microsoft Entra ID

Paste the data from step 3 into the field Application ID (client id)

Paste the data from step 4 into the field Directory ID (tenant id)

Return to Microsoft Entra and choose Add a certificate or secret in the top right

Then choose New client secret and enter a name in the field Description, for example: Demonstration

Select an expiration date in the field Expires (required field)
​Please note: keep track of the selected date so the secret can be renewed before it expires.

Confirm this with the button 'Add' at the bottom

Copy the data from the field Value

Open the Zenvoices tab again and paste this data into the field Client secret and choose 'Save all' in the top right

Navigate in Microsoft Entra to Applications / App registrations / button: 'View all applications in the directory'

Select the newly created application (in this example: 'Zenvoices SCIM')

Choose Overview at the top left and then Add a Redirect URI on the right

Choose Add a platform and then Web

Enter the following Redirect URL:

https://app.zenvoices.com/Entra/ExternalLoginCallback

Confirm at the bottom with the button Configure

Navigate in Microsoft Entra to Applications / App registrations / API permissions

On this page choose Add a permission / Microsoft Graph

Choose the button Delegated permissions

Search in the field 'Select permissions' for: 'User.Read'

Expand the User dropdown and select the field 'User Read'

Choose the button 'Add permissions' at the bottom

Choose 'Grant admin consent [company name]' and choose YES

Navigate in Microsoft Entra to Applications / App registrations / button View all applications in the directory

Select the newly created application (in this example: Zenvoices)

Choose 'App roles' in the submenu on the left and then 'Create app role' at the top

Open Zenvoices in another browser tab and navigate to Beheer / Omgeving / Rollen

Add the roles from Zenvoices in Microsoft Entra (see image). The role name from Zenvoices must exactly match the field Value in Microsoft Entra.

Select the field 'User/Groups' under Allowed member types

Select the field 'Do you want to enable this app role'

Choose 'Apply' at the bottom to assign the role mapping

Refresh the page after the last role has been assigned

Navigate to Identity / Applications / Enterprise applications / choose from the list (in this example: 'Zenvoices SCIM') / Provisioning

Choose Connect your application at the Create configuration button on the right

Enter the following in the field Tenant URL:
​https://app.zenvoices.com/api/scim/entra/

This URL must end with the Zenvoices environment ID. Open Zenvoices in another browser tab and navigate to Beheer / Omgeving / Instellingen / tab Microsoft Entra ID and check the field Zenvoices environment ID. The URL will then look like:
​https://app.zenvoices.com/api/scim/entra/1234

Scroll in Zenvoices to SCIM Access key and choose Generate access key. Copy the key that appears (note: this is shown only once).

Paste this key into Microsoft Entra in the field Secret code.

Then choose Save at the bottom in Microsoft Entra (refresh the Zenvoices browser tab).

Continue from the previous screen and choose Attribute mapping (Preview) in the menu on the left

Check whether Provision Microsoft Entra ID Groups is set to No (because in Zenvoices roles exist separately instead of in a group).
If it is set to Yes, click the row and change it to No

Refresh the page

When it appears as in the image below, choose Provision Microsoft Entra ID Users

Delete the following rules using the Delete button

Choose Save in the top left

Select Edit for the rule externalID

Change the Source attribute field to ObjectID and choose OK at the bottom

Choose Save in the top left

Refresh the page

Choose Add New Mapping at the bottom left to expand the list

Choose Edit attribute list for customappsso

Scroll down to add a new row and enter the following value in the next empty field: roles

Check the third checkbox (column: Multi-Value)

Choose Save in the top left

Refresh the page

Choose App again at the bottom left

Change the Mapping type field to Expression

The Expression field opens, enter the following value:
AssertiveAppRoleAssignmentsComplex([appRoleAssignments])

Change the Target attribute field to roles

Choose OK at the bottom

Choose Save in the top left

Navigate to Identity / Applications / Enterprise applications / select (in this example: 'Zenvoices SCIM')

Choose the button 1. Assign users and groups

Choose Add user/group at the top left

Choose None selected under Users

In the next step select the role, select the user(s) who should receive that role

Confirm by choosing Select at the bottom

Choose None selected under Select a role

Choose the role(s) that should be assigned to the users selected in step 5

Confirm by choosing Select and then Assign

Synchronize with Zenvoices by choosing Overview at the top and then Start provisioning