Skip to main content
All guides

For IT admins

SCIM: automatic provisioning and de-provisioning from Entra ID

With SCIM, Microsoft Entra ID creates members in Varhugi as they are assigned to the app and deactivates them when they leave or are removed from the group. Setup takes about ten minutes and needs nothing beyond admin rights in Varhugi. Available on the paid plans.

What happens automatically

  • A user assigned to Varhugi in Entra is created in the workspace with name and email and the learner role. They can sign in with Microsoft or with the email link to the same address.
  • A user removed from the group, disabled or deleted in Entra is deactivated in Varhugi: they drop out of statistics, reminders and the seat count, while their training history, certificates and reports stay.
  • Name and email are updated when they change in Entra. A user put back into the group becomes active again with their history intact.
  • Roles (admin, manager) and departments are still managed in Varhugi or through Entra app roles. SCIM does not change them.

Setting it up in Entra

  1. 1. Generate a token in Varhugi

    On /stjornbord/stillingar, under SCIM provisioning, click "Generate token". It is shown once; copy it straight away. The Tenant URL is shown in the same place: https://varhugi.is/api/scim/v2.

  2. 2. Open the Varhugi app in Entra

    In the Entra admin center: Enterprise applications, then the Varhugi app you use for sign-in. If it does not exist yet, choose "New application", "Create your own application", name it Varhugi and pick "Integrate any other application you don't find in the gallery".

  3. 3. Turn on Provisioning

    In the app: Provisioning, "Get started", set Provisioning Mode to Automatic. Paste the Tenant URL and the token into Secret Token and click "Test Connection". Entra should confirm the connection. Save.

  4. 4. Check the mappings

    Under Mappings, "Provision Microsoft Entra ID Users", the defaults are fine. Disable "Provision Microsoft Entra ID Groups"; Varhugi does not accept groups.

  5. 5. Choose who is included

    Under Settings, Scope, choose "Sync only assigned users and groups" and assign the app to the group or groups that should be in Varhugi (Users and groups). The same group you use for sign-in is the natural choice.

  6. 6. Try one, then switch on

    "Provision on demand" with a single user shows immediately whether they appear in Varhugi. Then set Provisioning Status to On. Entra runs an initial sync and then a regular one, typically about every 40 minutes.

Attributes Varhugi reads

Entra's default mappings work. For reference, Varhugi accepts these attributes:

  • userName: the user's email (userPrincipalName in Entra). If userPrincipalName is not an email, map mail to emails[type eq "work"].value.
  • externalId: Entra's stable identifier (objectId is best; the default mailNickname also works).
  • displayName or name.givenName and name.familyName: the name shown in Varhugi.
  • active: active or not. Entra sends False when a user is disabled, deleted or removed from the group.

Seats and limits

  • Every active user takes a seat. When the plan's seats are used up, Varhugi refuses creation with a 403 that shows in Entra's provisioning log; add seats or deactivate someone and Entra retries on the next cycle.
  • Deactivated users do not take a seat.
  • A user already in the workspace with the same email (invited, or joined via SSO) is linked to the Entra identifier rather than created twice.
  • An email is only changed if no other account owns the new one; otherwise Varhugi answers 409 and the old email stays.

What SCIM does not do

  • Groups are not synced. Departments are set in Varhugi and roles through Entra app roles or the dashboard.
  • Users are never deleted from Varhugi through SCIM, only deactivated. To delete training history an admin removes the user by hand.
  • The token is for one workspace. Rotate it on the settings page if it leaks; the old one stops working immediately.

If something goes wrong

"Test Connection" fails
Check that the Tenant URL is exactly https://varhugi.is/api/scim/v2 (no trailing slash) and that the whole token was copied. If the token was revoked or rotated in Varhugi, Entra needs the new one.
A user is not created
Look at Provisioning logs in Entra. A 403 means the seats are used up. A 400 means userName is not an email; map mail to emails[type eq "work"].value.
A leaver is still active
Entra only sends "inactive" for users inside the scope. With "Sync all users and groups" and a plain deletion it can take up to 30 days (soft delete) before Entra reports it. Removing the user from the group takes effect on the next cycle.