Configuring SCIM User Sync with Microsoft Entra ID

Configure SCIM User Sync between Microsoft Entra ID and your UiPath organization in Test Cloud using OAuth2 or bearer token.

Warning:

Critical: Microsoft Entra ID's default SCIM attribute mappings are not compatible with UiPath. You must update them as described in Step 4.

This page describes how to configure SCIM (System for Cross-domain Identity Management) User Sync between Microsoft Entra ID and your UiPath organization.

Prerequisites

• An Enterprise or Enterprise Trial license for your UiPath organization.
• Admin permissions in both your UiPath organization and your Microsoft Entra tenant.
• A working Microsoft Entra ID or Security Assertion Markup Language (SAML) Single Sign-On (SSO) integration with UiPath.

Before you begin

Set up SSO before you enable SCIM. For a new configuration, complete the steps in this order:

1. Create the application in Microsoft Entra ID and configure SSO with UiPath. See Microsoft Entra ID integration, or Configuring the SAML integration if you sign in with SAML.
2. Enable SCIM in UiPath (Step 1 below).
3. Configure SCIM in Entra ID (the remaining steps).

Step 1: Enable SCIM in UiPath

1. Sign in to cloud.uipath.com using an account with organization admin permissions.

2. In the left-hand menu, select Admin, then select Security.

3. Under Directory integration and single sign-on (SSO), select Enable SCIM.

4. Select one of the following authorization methods:

   • OAuth2 client credentials grant (recommended)
   • Long-lived bearer token

5. Select Configure.

6. Record the following values — you will need them when configuring Entra ID:

   • SCIM URL (for example, https://cloud.uipath.com/{orgId}/identity_/api/scim/v2)
   • If using OAuth2: Client ID (the OAuth application ID) and Client Secret (the OAuth secret)
   • If using a bearer token: Bearer token value

   The OAuth token endpoint is not shown in the UiPath admin portal — construct it using the same org id that appears in your SCIM URL above:

   https://cloud.uipath.com/{orgId}/identity_/connect/token

   Your organization ID ({orgId}) is the identifier in your UiPath organization URL. Your organization name also works in place of it and is easier to read.

Note:

Leave this browser tab open. Do not select I have completed identity provider configuration until you finish the steps in the following sections.

Step 2: Set up the application in Entra ID

Use an Entra enterprise application to connect to UiPath. When you sign in with Entra ID SSO, create a dedicated application for SCIM provisioning. When you sign in with SAML SSO, use the Entra enterprise application you already have for SAML.

Find your scenario and follow the matching option:

Your current integration	What to do
Entra ID SSO	Create a dedicated application for provisioning — follow the steps below.
SAML SSO connected to an Entra enterprise application	Use that enterprise application and continue to Step 3. If you have not created one yet, follow the steps below.

Important:

Regardless of which application you use, you must update the attribute mapping in Step 4. Without it, user attributes do not map correctly.

Create the application

1. Sign in to portal.azure.com using an account with admin permissions in your Microsoft Entra tenant.
2. Select Microsoft Entra ID, then navigate to Enterprise applications > All applications and select + New application.
3. Select Create your own application.
4. Enter a name for your application (for example, UiPath SCIM Connector).
5. Select Integrate any other application you don't find in the gallery (Non-gallery).
6. Select Create.

Step 3: Connect Entra ID with UiPath

1. In your application, navigate to Manage > Provisioning.

2. Select Connect your application.

3. Select your authorization method and complete the required fields using the values recorded in Step 1:

   OAuth2 client credentials grant (recommended)

   Field	Value
   Tenant URL	SCIM URL from Step 1
   OAuth token endpoint	OAuth token endpoint from Step 1
   Client identifier	Client ID from Step 1
   Client secret	Client Secret from Step 1

   Bearer authentication

   Field	Value
   Tenant URL	SCIM URL from Step 1
   Secret token	Bearer token value from Step 1

4. Select Test connection.

5. Select Create.

Step 4: Update attribute mapping

Update your application's attribute mappings to match the mappings shown below. This step is required for all applications.

1. From the Azure home page, navigate to Microsoft Entra ID > Enterprise applications > UiPath SCIM Connector > Provisioning.
2. Select Edit attributes.
3. Select Provision Microsoft Entra ID Users.
4. Update the mappings so that they match the mappings shown below. Remove any mapping that is not shown.
5. Confirm that active is mapped. This mapping deactivates users in UiPath and releases their licenses when they are disabled, unassigned, or deleted in Entra ID.
6. Save.

After you save, the Attribute Mapping page shows the following mappings.

The following table lists the exact attribute values for reference:

Source Attribute (Microsoft Entra ID)	Target Attribute (uipath)	Mapping Type	Matching Precedence
objectId	externalId	Direct	1
userPrincipalName	userName	Direct	2
city	addresses[type eq "work"].locality	Direct
companyName	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization	Direct
department	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department	Direct
displayName	displayName	Direct
givenName	name.givenName	Direct
jobTitle	title	Direct
mail	emails[type eq "work"].value	Direct
surname	name.familyName	Direct
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active	Expression

Step 5: Assign target users

1. Navigate to Enterprise Application > UiPath SCIM Connector > Users and groups.
2. Select Add user/group.
3. Add the users from your source directory that you want to provision into UiPath.

Note:

Keep this user list in sync with the user list for the application registration used for SSO.

Step 6: Test provisioning

Before enabling provisioning, test the configuration to verify the connection and attribute mapping are working correctly.

1. Navigate to Enterprise Application > UiPath SCIM Connector > Provision on demand.
2. Select a test user.
3. Select Provision.
4. Confirm the user is created in UiPath as expected.

Step 7: Enable provisioning

1. Navigate to Enterprise Application > UiPath SCIM Connector > Provisioning.
2. Set Provisioning Status to On.

Step 8: Complete configuration in UiPath

Return to the UiPath browser tab from Step 1 and select I have completed identity provider configuration.

Result

SCIM User Sync is now active between Microsoft Entra ID and your UiPath organization. Users assigned to the application in Entra ID will be provisioned into UiPath automatically, and subsequent updates or deprovisioning events in your directory will be pushed to UiPath asynchronously.

To verify the setup, navigate to Admin > Security in UiPath and confirm that the SCIM status shows as enabled. You can also navigate to Admin > Accounts and Groups and confirm that provisioned users appear in the directory.