Microsoft Entra ID SCIM Integration

System for cross-domain identity management (SCIM) can be used to automatically provision and de-provision members and groups in your Bitwarden organization.

This article will help you configure a SCIM integration with Azure. Configuration involves working simultaneously with the Bitwarden web vault and Azure Portal. As you proceed, we recommend having both readily available and completing steps in the order they are documented.

To start your SCIM integration, open your organization's Settings → SCIM provisioning page:

Select the Enable SCIM checkbox and take note of your SCIM URL and SCIM API Key. You will need to use both values in a later step.

In the Azure Portal, navigate to Microsoft Entra ID and select Enterprise applications from the navigation menu:

Select the  New application button:

On the Browse Microsoft Entra ID Gallery screen, select the  Create your own application button:

On the Create your own application screen, give the application a unique, Bitwarden-specific name. Choose the Non-gallery option and then select the Create button.

Select Provisioning from the navigation and complete the following steps:

1. Select the Get started button.

2. Select Automatic from the Provisioning Mode dropdown menu.

3. Enter your SCIM URL (learn more) in the Tenant URL field.

4. Enter your SCIM API Key (learn more) in the Secret Token field.

5. Select the Test Connection button.

6. If your connection test successfully, select the Save button.

Bitwarden uses standard SCIM v2 attribute names, though these may differ from Microsoft Entra ID attribute names. The default mappings will work, but you can use this section to make changes if you wish. Bitwarden will use the following properties for users and groups:

User mapping

ª - Because SCIM allows users to have multiple email addresses expressed as an array of objects, Bitwarden will use the value of the object which contains "primary": true.

Group mapping

Under the Settings dropdown, choose:

• Whether to send an email notification when failure occurs, and if so, what address to send it to (recommended).

• Whether to sync only assigned users and groups or sync all users and groups. If you choose to sync all users and groups, skip the next step.

Complete this step if you have selected to sync only assigned users and groups from the provisioning settings. Select Users and groups from the navigation:

Select the  Add user/group button to assign access to the SCIM application on a user or group level. The following sections describe how modifying users and groups in Azure will impact their counterparts in Bitwarden:

Users

• When a new user is assigned in Azure, the user is invited to your Bitwarden organization.

• When a user who is already a member of your organization is assigned in Azure, the Bitwarden user is linked to the Azure user through their UserName value.

  • Users linked in this way are still subject to the other workflows in this list, however values like displayName and externalId/mailNickname are not automatically changed in Bitwarden.

• When an assigned user is suspended in Azure, the user has their access to the organization revoked.

• When an assigned user is deleted in Azure, the user is removed from the organization.

• When an assigned user is removed from a group in Azure, the user is removed from that group in Bitwarden but remains a member of the organization.

Groups

• When a new group is assigned in Azure, the group is created in Bitwarden.

  • Group members who are already members of your Bitwarden organization are added to the group.

  • Group members who are not already members of your Bitwarden organization are invited to join.

• When a group that already exists in your Bitwarden organization is assigned in Azure, the Bitwarden group is linked to Azure through the displayName and externalId/objectId values.

  • Groups linked in this way will have their members synced from Azure.

• When a group is renamed in Azure, it will be updated in Bitwarden as long as the initial sync has been made.

  • When a group is renamed in Bitwarden, it will be changed back to what it's named in Azure. Always change group names Azure-side.

Once the application is fully configured, start provisioning by selecting the  Start provisioning button on the enterprise application's Provisioning page:

Now that your users have been provisioned, they will receive invitations to join the organization. Instruct your users to accept the invitation and, once they have, confirm them to the organization.