How to provision users to Incydr from Microsoft Entra ID (formerly Azure AD)

Overview

This article explains how to provision users from Microsoft Entra ID (formerly Azure AD) to Incydr. Once configured, Incydr automatically adds, updates, and removes users when Entra ID syncs to Incydr.

This article assumes you are familiar with the concept of provisioning. To learn more, see our Introduction to SCIM provisioning.

The Incydr application in Entra ID is intended for single sign-on (SSO) as well as provisioning. This article describes only how to set up provisioning. To learn how to set up SSO, see Configure Azure for SSO in your environment.

Considerations

Azure AD rebranded as Entra ID
Microsoft renamed Azure AD to Entra ID. References to "Azure AD" throughout this article also apply to Entra ID.

• To use this functionality, you must be assigned the Identity Management Administrator role. 
• If you have been using Code42 User Directory Sync for provisioning and want to start using Azure AD for provisioning instead, contact your Customer Success Manager (CSM) to engage the Incydr Professional Services team.
• Local users in Incydr cannot be created, updated, or deleted from Azure AD. These users can only be managed in the Incydr console.
• Incydr service provider integration for user provisioning is supported in Azure's Gov cloud. You can provision users with Azure AD in the Incydr federal environment. 

Deactivate users

Deactivation delay

When Azure AD sends an update to deactivate a user, Incydr waits 15 minutes before deactivating that user. This delay applies only when you use provisioning to deactivate users. When you manually deactivate users in the Incydr console, there is no delay.

Backup agent only: The deactivation delay helps protect against moving users' backup archives into cold storage if users are accidentally deactivated in Azure AD. Although Incydr waits before deactivating users, users are immediately blocked once they receive a deactivation update from Azure AD. Blocked users can no longer sign in, but their devices continue to back up. 

To learn more about user deactivation, see Deactivate and reactivate users and devices.

Users on legal hold cannot be deactivated

Backup agent only

If you place users on legal hold, Azure AD can't deactivate them. Their data is retained for the legal hold process. Users are blocked instead of deactivated. Once you release users from legal hold, they are automatically deactivated.

Supported attributes and features

Supported attributes

The following Azure AD SCIM user attributes are automatically updated in Incydr. (To change user attribute mapping, see Step 4.)

Value in Azure AD	Value in the Incydr User Profile
userPrincipalName	Username
userPrincipalName	Email
manager	Manager The manager must also exist in Incydr.
jobTitle	Job title
givenName	First name
surname	Last name
city	City
state	State
usageLocation	Country
department	Department

Supported SCIM attributes

The following SCIM attributes are not supported in Azure AD but are supported in Incydr:

• Division
• EmployeeType
  Note: The UserType attribute in Azure AD is not equivalent to the EmployeeType SCIM attribute, and should not be used as the employee type attribute in Incydr.

Supported user provisioning features

Supported 

The following user provisioning features are available in the Azure AD application:

• Create users: New users created in Azure AD are also created in Incydr.
• Deactivate users: Deactivating a user in Azure AD deactivates the user in Incydr.
• Update user attributes: Azure AD updates users' attributes. These updates overwrite any changes made in Incydr.

Not supported 

• Import users from Incydr to Azure AD
• Sync passwords
• Map Azure AD roles to users provisioned in Incydr
  However, you can assign Incydr roles to provisioned users based on the group they belonged to in Azure AD. See Step 6 below.

Step 1: Create Incydr organizations

This step is only required if you choose to use the Single Organization or Custom SCIM mapping methods. The "c42OrgName" attribute and Custom attribute methods create Incydr organizations automatically. 

Create the Incydr organization to which users from Azure AD are added during provisioning. (You specify the organization that receives provisioned users in Step 2 below.)

1. Sign in to the Incydr console.
2. Select Administration > Environment > Organizations from the navigation menu.
3. Click Create organization.
4. Enter a descriptive name for the organization.
   Names must contain at least 3 characters, to a maximum of 220 characters.
5. To automatically assign the new organization to a parent organization, select an existing organization from the Parent organization list.
   By default, new organizations are created as children of your top-level organization, but you can select a different parent organization if needed. When you add a child organization using the Actions menu on the organization detail screen, the new organization is automatically created as a child of that existing organization and this list is not available. 
6. Click Create to add the new organization.
7. Repeat until you have added all of your organizations.

Organization inheritance
Child organizations inherit the settings of their parent organization by default. To edit the settings for a child organization, go to the organization details and change the Inherit settings from parent organization setting as needed.

Step 2: Add a provisioning provider in the Incydr console

Create the provisioning provider configuration that Azure AD uses to connect to Incydr.

1. In the Incydr console, navigate to Administration > Integrations > Identity Management.
2. Select the Provisioning tab.
   
3. Click Add Provisioning Provider > Add SCIM Provider.
4. Enter a display name and select OAuth token for the authentication credential type.
   You must select OAuth token for use with Azure AD provisioning.
5. Click Next. 
6. The SCIM Provider Created message appears. Copy the Base URL and Token values to a safe location for use later. You'll need this information later in the provisioning provider setup.
   If you lose this information, you can always click Regenerate credentials on the provisioning provider details page and copy the newly-generated token to the Secret token field in Azure (see Step 4).
   
7. Click Done.
   The provisioning provider details appear.
8. Select the edit icon next to Organization Mapping. 
   
9. In the Edit organization mapping method dialog, ensure that Create new users in the organization below is selected, and select an organization to receive newly-provisioned users.
   Do not map with SCIM groups yet 
   If you want to use the Map users to organizations using SCIM groups option, you can only do so after SCIM groups have been pushed during the first synchronization (see Step 5). After the SCIM groups are pushed, in Step 6 you can then map users to organization using SCIM groups.
   

10. Click Save.

Step 3: Add the Azure AD application

1. Sign in to your Azure portal. 
2. Go to Azure Active Directory.
3. Select Enterprise applications.
4. Click New application.
   
5. Add the Code42 application.
   1. In Add from the gallery, enter Code42.
      Note: Your experience searching for and selecting the Code42 application may vary if you view the gallery catalog in preview mode. 
   2. Select the Code42 application.
   3. (Optional) Give the application a unique name.
   4. Click Create.
      The Code42 application is added to the list of enterprise applications.

Step 4: Configure Azure AD provisioning 

Use the Azure portal to configure provisioning for the Code42 application. For general information about provisioning in Azure AD, see the Azure AD documentation. For more information about how to configure provisioning specifically for Incydr, see the Azure AD tutorial Configure Code42 for automatic user user provisioning.

1. From Enterprise Applications, select the Code42 application you created in Step 3.
2. Under Manage, select Users and Groups to add users and groups to the application. 
3. Under Manage, select Provisioning.
4. Click Get Started in the "Automate identity lifecycle management with Azure Active Directory" screen.
5. For Provisioning mode, select Automatic.
6. Under Admin Credentials, enter the information you copied from the Incydr console in Step 2:
   1. In Tenant URL, enter the base URL.
   2. In Secret Token, enter the token.
   3. In Notification Email, enter the email address of the person to receive notification emails and select Sent an email notification when a failure occurs.
      
7. Click Test Connection to ensure that the connection to Incydr is working. If the test is successful, the following message is displayed: The supplied credentials are authorized to enable provisioning.
   If the test is not successful, regenerate the credentials in the Incydr console and enter the new values in the Admin Credentials fields.
8. If desired, select Mappings to change how group and user attributes flow from Azure AD to Incydr. For information about how to configure provisioning mapping in Azure AD, see the Azure AD documentation.
   User attribute mappings
   The default mappings listed in the Code42 application may be different than what is shown below. To ensure provisioning occurs as expected, use the following mappings. You can modify each Azure or Code42 attribute by clicking the specific attribute. See the Azure AD documentation for directions on how to edit each attribute.
   1. To change group mapping, select Provision Azure Active Directory Groups. 
   2. To change user mapping, select Provision Azure Active Directory Users. 
      The following are the suggested user attribute mappings from Azure AD to Incydr. To change these mappings, click the Azure Active Directory attribute.

   Azure Active Directory attribute	Incydr attribute
   userPrincipalName	userName
   userPrincipalName	emails[type eq "work"].value
   manager	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager
   Not([IsSoftDeleted])	active
   jobTitle	title
   givenName	name.givenName
   surname	name.familyName
   city	addresses[type eq "work"].locality
   state	addresses[type eq "work"].region
   usageLocation Use "usageLocation" instead of "country" for mapping. If you have any problems mapping country codes, see Troubleshooting.	addresses[type eq "work"].country
   objectId	externalId
   department	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department

9. In Scope, select Sync only assigned users and groups. You can only provision users and groups that are assigned to the Code42 application in Azure AD.
10. Click Save. 
11. Make any other settings changes your new application requires, and add users and groups to the new application. 
    See the Azure AD documentation for details on adding users to applications and performing other application setup tasks.
12. Start provisioning users to Incydr.
    1. Return to the Provisioning panel and set the Provisioning Status to On. 
    2. Click Save to start provisioning. (If you have already run a sync, click Restart Sync.) 
       It may take up to 40 minutes before synchronization runs and users are provisioned to the mapped organization in Incydr. 
    3. (Optional): To provision users manually, use Provision on demand.

Users are provisioned into the Incydr organization you specified in Step 2. If you want to provision users into different organizations based on the group they belong to in Azure, proceed to the next step. 

Step 5: Push SCIM groups from Azure to Incydr

SCIM groups pushed to Incydr are used to map users to organizations, roles, and watchlists. If you are not using groups, continue to the next step.

To push SCIM groups from Azure:

1. Ensure that you have added users to groups. (See the Azure documentation.)
2. In Mappings, ensure that you have enabled Provision Azure Active Directory Groups.  
3. Provision users and groups to Incydr by setting the Provisioning Status to On and clicking Save, or if you have already run a sync, by clicking Restart Sync.

Apply changes after mapping SCIM groups

If you want to map SCIM groups to Incydr organizations in Step 6, you must first push or provision SCIM groups and their users to Incydr so they are available in the Incydr console. 

However, this means that initially the users are provisioned in the default organization and are assigned default roles rather than the ones you want to map them to. To move these users to the desired organizations and roles, ensure that you map SCIM groups to organizations and roles (Step 6) and then apply the mappings using the Apply Org and Role Settings action. 

Step 6: Map users to organizations and roles using SCIM groups

When users are first provisioned into Incydr, they are provisioned to an organization that you specified in the Edit organization mapping method dialog in Step 2. If you prefer, you can map users to Incydr organizations based on the SCIM groups they belong to in Azure. You can also assign users roles in Incydr based on their SCIM groups.

Follow the steps in the sections below:

• Map users to organizations using SCIM groups
• Map users to roles using SCIM groups
• Apply organization and role mappings

You must first provision groups to Incydr from Azure AD before you can map users to organizations and roles based on SCIM group. 

Map users to organizations using SCIM groups

1. In the Incydr console, navigate to Administration > Integrations > Identity Management.
2. Select the Provisioning tab.
3. Select the provisioning provider you set up in Step 2.
4. Click the edit icon  to the right of Organization mapping.
   The Edit Organization Mapping Method dialog is displayed.
   
   
5. Select Map users to organizations using SCIM groups. 
   Do not select Map users to organizations based on the provider's "c42OrgName" attribute. Azure AD does not support this method. 
6. Choose an organization to which unmapped users will be assigned. Unmapped users are users who either do not belong to a group or their group is not mapped. 
7. Click Save. 
   The Add organization mapping dialog appears. 
8. In Select a SCIM group, select one or more groups.
   Groups appear only after a provisioning synchronization from Azure AD has completed.
9. From Select a Code42 organization, choose an organization from the menu. 
   
10. Click Save. 
    The mapping appears on the Provisioning Provider details page. 
11. Click Add mapping and repeat the process until all of your SCIM groups have been mapped to Code42 organizations. 
    Once all available SCIM groups have been mapped, the message All SCIM groups are mapped appears.
    
12. (Optional) Adjust the priority of each mapping. This is useful for users who belong to more than one SCIM group. 

If you want to assign roles to users provisioned to Incydr, proceed with the steps below in Map users to roles using SCIM groups. Otherwise, apply the mapping as described in Apply organization and role mappings.

Map users to roles using SCIM groups

Role mapping allows you to automatically assign Incydr roles and permissions to provisioned users based on their SCIM group. Users who are not mapped inherit the default roles for their organization. 

1. In the provisioning provider details page, click the edit icon  to the right of Role mapping.
   The Edit role mapping dialog appears.
2. Select Map SCIM groups to Code42 roles.
   Only select Manually if you want to assign roles manually in Incydr. 
   
3. Click Save.
   An Add mapping button appears under Role mapping.
4. Click Add mapping. 
   The Add Role Mapping dialog appears.
   
5. In Select a SCIM group, select one or more groups.  
   Only groups that have not been mapped appear in the dropdown.
6. In Select a Code42 role, select one or more roles from the list to apply to this SCIM group. 

Basic roles

• If the insider risk agent is deployed to users in this group, include the Agent User role.
• If the backup agent is deployed to users in this group, include the Desktop User and PROe User roles. These roles allow users to sign in to the agent and Incydr console to manage their backups and restore their files. If you are giving external groups access to your environment (for example, outside legal council) they do not need these roles.

7. Click Add. 
   The role mapping appears under the provisioning provider detail. 
8. Click Add mapping and repeat the process until all of your SCIM groups have been mapped to Incydr roles. 
   The message All SCIM groups are mapped appears. 

When you are done mapping roles, apply the mapping as described below in Apply organization and role mappings.

Apply organization and role mappings

After you have completed the organization mapping and role mapping as described in the preceding sections, you must apply the mappings. 

1. In the provisioning provider details page, select Actions > Apply org and role settings.
   
2. In the Apply organization and role settings dialog, click Apply.
   Provisioned users are moved to the mapped organizations and are assigned the mapped roles. 
   

If you change organization or role mapping in the future, apply the mappings as described here using Actions > Apply org and role settings. 

(Optional) Step 7: Edit deactivation delay

In the Incydr console, view the provisioning provider details and select Deactivation Delay. 

The deactivation delay determines how long Incydr waits to deactivate a user after syncing with the provisioning provider. To learn more about user deactivation, see Deactivate and reactivate users and devices.

Backup agent only: Although Incydr may be configured to wait, users are immediately blocked once they receive a deactivation update from the provisioning provider. Blocking a user means they can no longer sign in to the backup agent, but their devices continue to back up. The delay helps prevent accidentally deactivating a user and removing their backup archive. If you need to cancel a pending user deactivation during the delay period, unblock the user.

Troubleshooting

Users are not provisioned to Incydr

To troubleshoot why users or attributes aren't being sent to Incydr from Azure AD, see the Azure AD documentation to review provisioning errors. 

If everything is configured properly in Azure AD but users aren't being provisioned to Incydr, assign an empty group to the Code42 application in Azure AD, then add users to that group. This initiates new provisioning calls for those users.

There are no SCIM groups available

This message appears if SCIM groups have not been provisioned. You must first provision groups to Incydr from Azure AD before you can map organizations and roles based on SCIM group. 

Syncing

• To view information about provisioning in Incydr, see the Sync Log in the Incydr console. It contains details of all of the users that have been created, updated, or deleted in Incydr due to provisioning. 
• Once provisioning is configured in the Code42 application in Azure AD, make all user changes in Azure AD. Incydr does not sync changes back to Azure AD, so any changes you make to user values on the Incydr side causes the two apps to become out-of-sync. 
• Updating the Incydr console does not start a sync between Azure AD and Incydr. Only adding or removing a user from a group in Azure AD starts a sync. 

Need more help?
Contact our Technical Support Engineers​. 

The country value is incorrect in Incydr

If the value of the country code is incorrect in Incydr, it could be because the default mapping in Azure does not contain the correct country value.

The default country value in Incydr is mapped to the usageLocation Azure AD attribute. While this value will always conform to the SCIM spec that requires a two-character country code, it may represent the region in which the user accesses Microsoft products, not necessarily where they are located. If you use Azure AD Connect, this value is typically populated by the msExchUsageLocation attribute in your on-premises Azure AD by default.

Should you want to use a different mapping, you have a few options:

Option 1: Build an expression

Reconfigure the user attribute mapping to use the country attribute in Azure AD. Then create a mapping expression that looks up the appropriate ISO 3166 country codes for long-form country names.

1. In the Attribute Mapping dialog, click usageLocation.
2. In the Edit Attribute dialog, click the Mapping type field and select Expression.
3. In the Expression field enter the following switch expression:

IIF(IsNull([country]), "", Switch(ToLower([country], ), , "afghanistan", "AF", "albania", "AL", "algeria", "DZ", "american samoa", "AS", "andorra", "AD", "angola", "AO", "anguilla", "AI", "antarctica", "AQ", "antigua", "AG", "barbuda", "AG", "argentina", "AR", "armenia", "AM", "aruba", "AW", "australia", "AU", "austria", "AT", "azerbaijan", "AZ", "bahamas", "BS", "bahrain", "BH", "bangladesh", "BD", "barbados", "BB", "belarus", "BY", "belgium", "BE", "belize", "BZ", "benin", "BJ", "bermuda", "BM", "bhutan", "BT", "bolivia", "BO", "bosnia", "BA", "herzegovina", "BA", "botswana", "BW", "bouvet island", "BV", "brazil", "BR", "british indian ocean territory", "IO", "brunei darussalam", "BN", "bulgaria", "BG", "burkina faso", "BF", "burundi", "BI", "cambodia", "KH", "cameroon", "CM", "canada", "CA", "cape verde", "CV", "cayman islands", "KY", "central african republic", "CF", "chad", "TD", "chile", "CL", "china", "CN", "christmas island", "CX", "cocos islands", "CC", "colombia", "CO", "comoros", "KM", "congo", "CG", "democratic republic of the congo", "CD", "cook islands", "CK", "costa rica", "CR", "croatia", "HR", "cuba", "CU", "curaçao", "CW", "cyprus", "CY", "czech republic", "CZ", "denmark", "DK", "djibouti", "DJ", "dominica", "DM", "dominican republic", "DO", "ecuador", "EC", "egypt", "EG", "el salvador", "SV", "equatorial guinea", "GQ", "eritrea", "ER", "estonia", "EE", "ethiopia", "ET", "falkland islands", "FK", "faroe islands", "FO", "fiji", "FJ", "finland", "FI", "france", "FR", "french guiana", "GF", "french polynesia", "PF", "french southern territories", "TF", "gabon", "GA", "gambia", "GM", "georgia", "GE", "germany", "DE", "ghana", "GH", "gibraltar", "GI", "greece", "GR", "greenland", "GL", "grenada", "GD", "guadeloupe", "GP", "guam", "GU", "guatemala", "GT", "guernsey", "GG", "guinea", "GN", "guinea-bissau", "GW", "guyana", "GY", "haiti", "HT", "holy see", "VA", "honduras", "HN", "hong kong", "HK", "hungary", "HU", "iceland", "IS", "india", "IN", "indonesia", "ID", "iran", "IR", "iraq", "IQ", "ireland", "IE", "isle of man", "IM", "israel", "IL", "italy", "IT", "jamaica", "JM", "japan", "JP", "jersey", "JE", "jordan", "JO", "kazakhstan", "KZ", "kenya", "KE", "kiribati", "KI", "democratic people's republic of korea", "KP", "south korea", "KR", "korea", "KR", "kuwait", "KW", "kyrgyzstan", "KG", "lao", "LA", "latvia", "LV", "lebanon", "LB", "lesotho", "LS", "liberia", "LR", "libya", "LY", "liechtenstein", "LI", "lithuania", "LT", "luxembourg", "LU", "macao", "MO", "macedonia", "MK", "madagascar", "MG", "malawi", "MW", "malaysia", "MY", "maldives", "MV", "mali", "ML", "malta", "MT", "marshall islands", "MH", "martinique", "MQ", "mauritania", "MR", "mauritius", "MU", "mayotte", "YT", "mexico", "MX", "federated states of micronesia", "FM", "micronesia", "FM", "republic of moldova", "MD", "moldova", "MD", "monaco", "MC", "mongolia", "MN", "montenegro", "ME", "montserrat", "MS", "morocco", "MA", "mozambique", "MZ", "myanmar", "MM", "namibia", "NA", "nauru", "NR", "nepal", "NP", "netherlands", "NL", "new caledonia", "NC", "new zealand", "NZ", "nicaragua", "NI", "niger", "NE", "nigeria", "NG", "niue", "NU", "norfolk island", "NF", "northern mariana islands", "MP", "norway", "NO", "oman", "OM", "pakistan", "PK", "palau", "PW", "palestine", "PS", "state of palestine", "PS", "panama", "PA", "papua new guinea", "PG", "paraguay", "PY", "peru", "PE", "philippines", "PH", "pitcairn", "PN", "poland", "PL", "portugal", "PT", "puerto rico", "PR", "qatar", "QA", "réunion", "RE", "romania", "RO", "russian federation", "RU", "russia", "RU", "rwanda", "RW", "saint barthélemy", "BL", "saint helena, ascension and tristan da cunha", "SH", "saint helena", "SH", "saint kitts", "KN", "saint kitts and nevis", "KN", "saint lucia", "LC", "saint martin", "MF", "saint pierre and miquelon", "PM", "saint vincent and the grenadines", "VC", "samoa", "WS", "san marino", "SM", "sao tome", "ST", "sao tome and principe", "ST", "saudi arabia", "SA", "senegal", "SN", "serbia", "RS", "seychelles", "SC", "sierra leone", "SL", "singapore", "SG", "sint maarten", "SX", "slovakia", "SK", "slovenia", "SI", "solomon islands", "SB", "somalia", "SO", "south africa", "ZA", "south sudan", "SS", "spain", "ES", "sri lanka", "LK", "sudan", "SD", "suriname", "SR", "svalbard and jan mayen", "SJ", "swaziland", "SZ", "sweden", "SE", "switzerland", "CH", "syrian arab republic", "SY", "taiwan", "TW", "taiwan, republic of china", "TW", "tajikistan", "TJ", "united republic of tanzania", "TZ", "tanzania", "TZ", "thailand", "TH", "timor-leste", "TL", "togo", "TG", "tokelau", "TK", "tonga", "TO", "trinidad and tobago", "TT", "tunisia", "TN", "turkey", "TR", "turkmenistan", "TM", "turks and caicos islands", "TC", "tuvalu", "TV", "uganda", "UG", "ukraine", "UA", "united arab emirates", "AE", "united kingdom", "GB", "united states", "US", "united states minor outlying islands", "UM", "uruguay", "UY", "uzbekistan", "UZ", "vanuatu", "VU", "bolivarian republic of venezuela", "VE", "venezuela", "VE", "viet nam", "VN", "vietnam", "VN", "british virgin islands", "VG", "us virgin islands", "VI", "wallis and futuna", "WF", "western sahara", "EH", "yemen", "YE", "zambia", "ZM", "zimbabwe", "ZW"))

4. Click OK to save the attribute mapping.

Option 2: Change the mapping between on-premises Active Directory and Azure AD

If you use Azure AD Connect, change the mapping between on-premises Active Directory and Azure AD.

On-premises Active Directory has various attributes that represent a user's country. For example, the "c" attribute is typically populated in Active Directory with the two-character country code. Choose the appropriate attribute in your on-premises directory, then update your Azure AD Connect mapping to associate the chosen attribute to Azure AD's country attribute.

Once the Azure AD Connect mapping has been updated, perform the following steps to use the new mapping:

1. In the Attribute Mapping dialog, click usageLocation.
2. In the Edit Attribute dialog, click the Source Attribute field.
3. Select country.
4. Select OK to save the configuration.

Option 3: Delete the usageLocation attribute mapping

If the country information isn't being provisioned  to Incydr as expected, simply delete the mapping for the usageLocation user attribute outright. Although the country information would not appear in Incydr as a result, this approach avoids causing failures or errors with your Azure provisioning application altogether.

External resources

• Azure AD
  • Tutorial: Configure Code42 for automatic user provisioning
  • Managing user account provisioning for enterprise apps in the Azure portal
  • Customizing user provisioning attribute-mappings for SaaS applications in Azure Active Directory
  • Attribute-based application provisioning with scoping filters
• SCIM: Core schema

Related topics

• Introduction to SCIM provisioning
• Identity management reference
• Configure Azure for SSO in your environment
• Provision user attributes to Incydr