---
title: "SCIM/User Provisioning/Role Management for Azure AD"
slug: "scim-user-provisioning-role-management-for-azure-ad"
description: "Configuration steps for SCIM, user provisioning, and role management for Azure AD"
updated: 2026-07-12T09:22:06Z
published: 2026-07-12T09:22:06Z
canonical: "academy.insiderone.com/scim-user-provisioning-role-management-for-azure-ad"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://academy.insiderone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM/User Provisioning/Role Management for Azure AD

This guide lists the steps you need to complete on Microsoft Azure AD to:

- [Create necessary roles for Insider](/docs/scimuser-provisioningrole-management-for-azure-ad#creating-necessary-roles-for-insider)
- [Set up provisioning](/docs/scimuser-provisioningrole-management-for-azure-ad#setting-up-provisioning)
- [Update mappings](/docs/scimuser-provisioningrole-management-for-azure-ad#updating-mappings)
- [Add more users to the application](/docs/scimuser-provisioningrole-management-for-azure-ad#adding-more-users-to-the-application)

The steps might differ for each Identity Provider. However, you should configure the role names and attribute mapping for a different identity provider based on the namings in this guide.

## Creating necessary roles for Insider

To create the necessary roles for Insider:

1. Go to **Applications** > **App registrations** on the left menu, and select the **Insider** application you created earlier under **All applications**.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/3b7325b2-084e-4d57-97c0-d9ef9133f39d.png)

2. Navigate to **Manage** > **App roles** to click the **+ Create app role** button.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/70512efb-b13f-44df-abac-8e0a2a027788.png)

3. Add the Display name, value, and description values, and select the Allowed member types as listed in the table below for each role. Click the **Apply** button to save the role.

| Display Name | Allowed Member Type | Value | Description |
| --- | --- | --- | --- |
| manage-users | Users/Groups | manage-users | Administrator role for Insider One |
| edit-and-publish | Users/Groups | edit-and-publish | Editor role for Insider One |
| collaborate | Users/Groups | collaborate | Collaborator role for Insider One |
| view-only | Users/Groups | view-only | Viewer role for Insider One |
| change-campaign-status-only | Users/Groups | change-campaign-status-only | Campaign Status Updater role for Insider One |
| outsource | Users/Groups | outsource | Outsourcer role for Insider One |

## Setting up provisioning

To set up provisioning:

1. Go to **Applications** > **Enterprise applications** on the left menu, and click **Manage** > **Provisioning**.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/2109045b-1f44-4f8f-987f-fb391f57b00d.png)

2. Click the **Get Started** button to start the SCIM (System for Cross-domain Identity Management) integration.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/7776fb6a-e54a-4492-bc52-346771366f8d.png)

3. On the following page, fill out the necessary input fields as displayed below.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/16dfa1f4-23ff-47ac-8e94-45b5679231ae.png)

| Field | Value |
| --- | --- |
| Provisioning Mode | Automatic |
| Tenant URL | https://inone.useinsider.com/scim/v2 |
| Secret Token | The SCIM API token can be obtained from Inone Settings > [Security](https://academy.insiderone.com/docs/security-settings). |

4. After copying the token from Insider and pasting it to Azure, go to **InOne Settings** > **Security** on InOne panel to click the **Save** on the bottom right corner. If you do not save this page, you will receive an error during the Test Connection.

5. Click the **Test Connection** button on **Inone Settings** > **Security** to see if the setup is successful for the Active Directory. Then click the **Save** button to save your changes.

6. Finally, click the **Start Provisioning** button to enable the provisioning process for your panel users. You can also click the **Stop Provisioning** button next to it to stop this process.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/682bacf0-9a64-4567-afec-06749c430b7c.png)

## Updating mappings

After saving your changes, you will see the **Mappings** section under **Admin Credentials**. If you cannot see the Mappings section, please hit the refresh button in your browser.

1. Click the **Provision Azure Active Directory Users** link under the **Mappings** section to update the mapping for user attributes.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/42a849de-9571-4875-bdff-151d55cea3eb.png)

2. On the following page, scroll down to the bottom of the page and make sure to check the **Show advanced options** box. Then click the **Edit attribute list for customappsso** link under the advanced options.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/86a11f3a-497a-4af0-a2d9-119bce4ad892.png)

3. On the following page, make sure to check the required checkboxes for attributes that start with roles[primary eq ”True”. After selecting the respective attributes, click the **Save** button. You will now be redirected to the previous page.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/d202cbbc-5950-4e1e-afc9-b798241e7cf1.png)

4. Click the **Add New Mapping** button to add the required mapping to the Insider application.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/dc47ef0f-41a5-4302-b6a0-8d13878e79c5.png)

5. On the following page, you need to add role mapping to your application to make sure you sync user roles between your Active Directory and Insider’s databases. Fill out the necessary input fields as displayed below.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/24f280f9-0b40-4899-9a10-6456cea4da83.png)

| Field | Value |
| --- | --- |
| Mapping type | Expression |
| Expression | SingleAppRoleAssignment([appRoleAssignments]) |
| Default value if null (optional) | *Leave it empty* |
| Target attribute | roles[primary eq “True“].value |
| Match objects using this attribute | No |
| Apply this mapping | Always |

Click the **Ok** button to save your changes.

## Adding more users to the Application

You can add more users to your application and assign them the roles that you have set up above.

1. Go to **Users** > **All users** to click the **+ New user** button.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/00f5961f-4cb6-4668-993a-2e4b5c10002e.png)

2. Fill in the user name, name, first name, and last name fields on the following page, and click the **Review +** **Create** button.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image%20(1)(6).png)

3. Go back to **Applications** > **Enterprise applications** to select Insider from the list. Navigate to **Manage** > **Users and groups,** then click the **+ Add user/group** button to add the new user to the Insider application so they can also log in to the Insider panel.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/cb91a276-cf7a-45c2-b33a-e08383caaee6.png)

4. Make sure to assign the correct roles while adding users or groups to the application.

## Related

- [Azure Active Directory Configuration for SSO](/azure-active-directory-configuration-for-sso.md)
- [Single Sign-On (SSO)](/single-sign-on.md)