Configure SCIM provisioning

Deeploy supports user and group provisioning through SCIM 2.0, letting your identity provider automatically create, update, and deactivate users, and manage their Workspace and Team role assignments. SCIM provisioning is available for Private Cloud installations.

Deeploy's SCIM implementation provisions two things:

• Users — creating, updating, and deactivating (deleting) accounts, including their Team role (User, Governance manager, or Admin).
• Groups — a read-only, derived group per Workspace and Workspace role combination (Owner, Operator, or Reviewer). Adding or removing a user from one of these groups changes their Workspace role membership accordingly. Groups themselves can't be created or deleted through SCIM.

Prerequisites

SCIM requests are authenticated using Oauth. Create one as an organization-wide scoped OAuth credential with the User management (read, write, delete) and Workspace (read, write, delete) scopes. If your identity provider requires it, generate an access token for it:

curl -k -X POST https://api.<domain>/oauth2/token \
  -u "<clientId>:<clientSecret>" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials"

The SCIM base URL for your tenant is:

https://api.<domain>/scim/v2

info

Some identity providers (e.g. Azure Entra ID) require Oauth token TTL of at least 60 minutes, configure this during installation of the Deeploy helm chart under hydra.accessTokenTTL.

Setting up SCIM provisioning with Microsoft Entra ID

Create the Enterprise Application

• Go to Microsoft Entra ID → Enterprise Applications → New application → Create your own application
• Give it a name and select Integrate any other application you don't find in the gallery (Non-gallery)

Configure provisioning

• Within the Enterprise Application, go to Provisioning →
• Fill in your Oauth2 credentials under Connectivity:
  • Tenant URL: https://api.<domain>/scim/v2
  • OAuth2 token endpoint: https://api.<domain>/oauth2/token
  • Client identifier + secret: Fill in your Deeploy oauth credentials client ID and secret
• Select Test Connection to verify Entra can reach the SCIM endpoint, then Save

Configure the Team role attribute mapping

Team role is provisioned exclusively through Entra's App Role assignment mechanism, mapped onto the SCIM roles attribute. Before mapping this attribute, define the App Roles on the application's App Registration:

• Go to Microsoft Entra ID → App registrations → select the application backing your Enterprise Application → App roles → Create app role
• Add one app role per Deeploy Team role, with Allowed member types set to Users/Groups, and the Value set exactly to:
  • DeeployAdmin
  • DeeployGovernanceManager
  • DeeployUser

Because a user can end up with more than one App Role assignment for this application at once (for example, a Workspace-role group also happens to carry an App Role, alongside their real, direct Team role assignment — see the note below), map roles as a multi-valued attribute rather than a single value:

• Go to Provisioning → Attribute mapping → Users tab
• Add a new attribute mapping for the team roles.
  • Mapping type: Expression
  • Target attribute: roles[primary eq "True"].value
  • Expression: IIF(Instr(Join("", AppRoleAssignmentsComplex([appRoleAssignments])), "DeeployAdmin", , )>"0", "DeeployAdmin", IIF(Instr(Join("", AppRoleAssignmentsComplex([appRoleAssignments])), "DeeployGovernanceManager", , )>"0", "DeeployGovernanceManager", "DeeployUser"))
• Remove attribute mapping for DisplayName and Department

Deeploy resolves the Team role in order Admin > Governance manager > User. Unrelated App Role assignments picked up incidentally (see below) are safely ignored.

Assigning Workspace groups also assigns an App Role

Because Entra only provisions assigned users and groups, every Workspace-role group must be assigned to the Enterprise Application under Users and groups to be provisioned. Since this application declares custom App Roles, Entra requires you to pick one of them for that assignment. Pick the DeeployUser role for Workspace groups, then they are safely ignored by Deeploy.

Configure group provisioning

Deeploy's Workspace-role groups follow the naming convention:

Deeploy:Workspace:<workspaceName>:<Owner|Operator|Reviewer|ViewOnly|>

Only groups matching this pattern, for Workspaces that already exist in Deeploy, resolve successfully. Entra's provisioning agent typically probes with GET /Groups?filter=displayName eq "..." before creating a group, so as long as the name matches an existing Workspace and role, no manual group creation in Deeploy is needed. Make sure to assign the groups to the Enterprise Application with the DeeployUser as role.

info

You can add users directly to a Workspace-role group without having to add the user specifically to the Enterprise Application. A Deeploy account for the user will be added created and Workspace access granted. Note that deleting the user from the Workspace-role group will also delete the Deeploy account as is it is no longer part of the Enterprise Application. If the user is in multiple Workspace-role groups the account will not be deleted.

Deleting users

Deeploy has no separate "deactivated" state for users provisioned through SCIM: deactivating a user (active: false) hard deletes the user's account.

Deleting a user transfers ownership of their use cases and Deployments to the user tied to the scoped OAuth credentials configured under Prerequisites.

Before removing a user in Entra, also remove them from any Workspace-role groups assigned to the Enterprise Application. Entra doesn't automatically issue group-membership removals for a user it's about to delete, so leaving them in a group can leave stale Workspace role membership behind in Deeploy.

Start provisioning

• Go to Provisioning and select Start provisioning

Entra periodically syncs assigned users and groups afterward; check the Provisioning logs in the Enterprise Application for the status of individual sync operations.