Useful Information for SCIM Provisioning Setup in Microsoft Entra ID

Problem

Whilst setting up SCIM provisioning for JetBrains IDE Services through Microsoft Entra ID, user might encounter issues fetching the metadata file and identifying key configurations like Entity ID and Reply URL. Specific error messages such as 404 Not Found are observed when trying to access endpoints.

Cause

The configuration misunderstanding arises from conflating terminology and requirements of SCIM 2.0 with SAML2 processes. Additionally, incorrect assumptions regarding the necessity and the roles of SCIM provisioning versus existing Entra ID synchronization may contribute to the confusion.

Resolution

1. Verify Base URL and Token:

   • Base URL for SCIM provisioning endpoint should be https://<companyname>.oauth.jetbrains-ide-services.com/api/rest/scim2/Users.
   • Ensure a permanent token is generated from the recommended page to use as a Bearer token in the request.

2. Endpoint Testing:

   • Test endpoints including /Users, /Groups, /ServiceProviderConfig, /ResourceTypes, /Schemas to verify operational responses.

3. Clarifications on Configuration:

   • The terms "Entity ID" and "Reply URL" are tied to SAML2 and not SCIM 2.0 directly. This setup often involves https://<companyname>.oauth.jetbrains-ide-services.com/api/rest/scim2 as the configuration path.
   • Entra ID authorization modules already enable background synchronization of provisioning and deprovisioning, making SCIM provisioning redundant unless:
     • A regulated environment where you can't grant permissions on the Entra ID side required for background sync to function
     • Company policy that only allows SAML and forbids OIDC

For additional information, refer to SCIM Provisioning documentation.