TrustBuilder Safe-T
TrustBuilder Safe-T
Breadcrumbs

Entra ID: SCIM + EAM

To configure TrustBuilder as an EAM with SCIM user provisioning in Microsoft Entra ID, the Microsoft Entra ID object ID (objectId) must be synchronized to a TrustBuilder oid attribute. The oid attribute is then used to identify the user during EAM authentication.

1. Configure SCIM provisioning

Configure SCIM provisioning between Microsoft Entra ID and TrustBuilder to synchronize users. Follow the steps in SCIM provisioning with Entra ID.

2. Create the oid attribute in TrustBuilder

In TrustBuilder Admin Portal,

  1. Go to Directory > User attributes.

  2. Click on + Set up attribute definition.

  3. Create a custom attribute with the following properties:

    1. Category: SCIM

    2. Attribute name: oid

    3. Data type: String

    4. Properties: Unique, case-sensitive

    5. Visibility: Hidden on Self-Service portal

  4. Copy the attribute URN. You will need it to map the attribute in Entra ID.

  5. Add the attribute to the user profile definition:

    1. Go to Directory > User Profile Definition.

    2. Select Oid.

    3. Click Save.

3. Map the Microsoft Entra ID object ID

The Object ID (OID) is a unique identifier for each user in Microsoft Entra ID.

TrustBuilder uses this OID to identify users and populate the sub claim in the ID Token. Without it, authentication would fail because Entra requires a valid sub.

In Microsoft Entra admin center:

  1. Go to Enterprise Applications > [Your app] > Provisioning > Attribute Mapping (Preview).

  2. Click on Provision Microsoft Entra ID Users to configure the attribute mapping.

  3. Enable Show advanced options and click Edit attribute list for customappsso

    image-20260302-153310.png

  4. Add the following attribute:

    • Paste the URN of the custom attribute previously created in TrustBuilder.

      urn:ietf:params:scim:schemas:extension:trustbuilder:2.0:User:oid

    • Type: String

  5. Click Save.

  6. Click on Add New Mapping.

  7. Fill in at least the mandatory parameters:

    1. Source attribute → select objectId

    2. Target attribute → select urn:ietf:params:scim:schemas:extension:trustbuilder:2.0:User:oid

  8. Click Ok.

4. Configure TrustBuilder as an External Authentication method

Once user provisioning and the oid mapping are configured, configure TrustBuilder as an External Authentication Method in Microsoft Entra ID.

Follow the steps in Entra ID : EAM (External Authentication Method).