> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Provision users from IDaaS

Use this procedure to add users from IDaaS to your third-party application. The outbound provisioning process includes using groups and user attributes to identify the users that need to be provisioned. IDaaS integration templates include the mandatory user attributes needed for the user provisioning, but custom attributes can also be included as part of the provisioning process.

## Step 1: Complete the prerequisites

Before you begin, review and complete the following, as required:

1. Map IDaaS user attributes to the attributes that are expected by the third-party service. Consult your service documentation for help. If required, create custom user attributes in IDaaS. See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).
2. Identify the IDaaS users that need to be provisioned. In IDaaS, you select the users for provisioning using the Group option. If necessary, create the required groups and add the users to those groups. By default, provisioning searches all IDaaS users if no groups are selected. See [Create and manage groups](/docs/people-and-access/manage-members/create-and-manage-groups.md) and [Import groups](/docs/perform-bulk-operations/bulk-import-operations/import-groups.md).
3. Copy the information required to set up the OIDC relationship between IDaaS and the third-party service. To do this, open a text file with a text editor, copy and save the following information from the third-party service that you want to provision with IDaaS:
   - SCIM Server Endpoints (this is usually your domain, for example: `mytenantID.mycompany.com`)
   - Client Secret of the third-party service
   - Issuer Client ID
   - Issuer URL

## Step 2: Add the provisioner to IDaaS

1. Click Menu icon **>** **Resources > Provisioners**. The **Provisioners** page appears.

2. Select **Generic Integrations**. The **Add Provision** page appears.

3. Enter a **Name** for the provisioner.

4. Select **Enable** to automatically enable the provisioner when it is created. By default, this setting is deselected.

attention
Entrust recommends keeping this setting at the default (deselected) when in draft mode.

5. Select the **Groups** to provision all users from the selected groups. You can select more than one group.

6. Enter the **SCIM Server Endpoints** that you saved in _Step 1: Prerequisites_.

example
**Example:**  
`https://<tenantId.mycompany.com>/services/scim/v2/`

where `<tenantId.mycompany.com>` is your service domain.

note
SCIM Server Endpoints cannot be edited after the provisioner has been added to IDaaS.

7. The template maps the user attributes, but if required, add the custom user attributes, as follows:

   1. Under **User** **Attribute Mapping**, click **Circle Plus icon**. The **SCIM Attribute** dialog box appears.
   2. Select the **Schema Name** from the drop-down list or enter a custom name required by your service provider.
   3. From the **Data Type** drop-down list, select the conversion for the attribute mapping. The options include:
      - string
      - boolean
      - number
   4. From the **SCIM Attribute Name** drop-down list, select the SCIM attribute to map to IDaaS.
   5. From the **IDaaS Attribute to map to** field, do the following as required to map the SCIM attribute to IDaaS:
      1. Enter an attribute name.
      2. Select an attribute from the drop-down list.
      3. Combine multiple IDaaS attributes for mapping.
   6. **Example:** If you combine `<First Name>_<Last Name>`, IDaaS replaces `<First Name>` and `<Last Name>` with their corresponding values and keeps the underscore (`_`) separator between the attributes. If IDaaS does not find the attribute, it leaves the attribute unchanged. For example, if `<First Name>` is defined as Jane and `<Last Name>` is not defined, the attribute result is Jane.
   7. Click **Add**.
   8. Repeat these steps to map the following additional custom user attributes.

8. Click **Save**. The provisioner appears on the **Provisioner List** page with an authorize (Key icon) icon.

## Step 3: Authorize and enable the provisioner

1. Click Key icon next to the Provisioner you created in _Step 2: Add the provisioner to IDaaS_. The **General Settings** page appears.

2. Select the **Authorization Method**.

3. If you select **OAuth** as the Authorization Method, complete the following:

   1. Enter the **Client ID** that you copied and saved in _Step 1: Prerequisites_.
   2. Enter the **Client Secret** that copied and saved in _Step 1: Prerequisites_.
   3. Enter the **Issuer URL** that you copied and saved in _Step 1: Prerequisites_.
   4. Open a text file and copy and paste the Redirect URI, and then save the file. You need it for _Step 4: Add the IDaaS Redirect URI to your third-party service_.
   5. Click **Fetch Configuration**.
   6. Click **Authorize** to acquire OAuth access and refresh tokens.
   7. Follow the prompts that appear from your service to allow access. An Authorized message appears on the **General Settings** page to confirm successful authorization.
   8. Click **Send Test SCIM** to do a SCIM call to your service. A message appears to confirm a successful SCIM call to your third-party service.

4. If you select **API Key** as the Authorization Method,do the following:

   1. Enter the **API Key** from your provisioner.
   2. Click **Send SCIM Test** to do a SCIM call to your service. A message appears to confirm a successful SCIM call to your third-party service.

5. Click **Save** to return to the **Provisioners List** page.

note
If the Save fails, you may need to reauthorize and send a test SCIM again to save new refresh and access tokens.

6. On the **Provisioners List** page, enable the provisioner as follows:

   1. Under **Actions** for the new provisioner, click Play icon. The **Enable Provisioner** prompt appears.
   2. Click **Enable**.

## Step 4: Add the IDaaS Redirect URI to your third-party service

If OAuth is used by your provisioner, you need to enter the IDaaS Redirect URI you copied in *Step 2: Add a Provisioner to IDaaS *to set up provisioning between IDaaS and your third-service. How you do this depends on the third-party service. Consult the third-party service documentation for more information.

example

**Note:** If you want to provision more than one IDaaS tenant, you must add the Redirect URI for each tenant.

The Redirect URI should be entered in the following format:

**Example:** `https://<tenantname>.<locale>.trustedauth.com/api/web/v1/oauth/scim/redirect` where `<tenantname>.<locale>` is your IDaaS tenant name and locale code, for example, `mycompany.us`.

## Step 5: Synchronize your users

1. In IDaaS, click Menu icon **>** **Resources > Provisioners**. The **Provisioners List** page appears.
2. Ensure that the provisioner is enabled.
3. Click Ellipsis Vertical icon and then select Refresh CW icon. The **Synchronize Provisioner** dialog box appears.
4. Click **Synchronize**.

recommendation

Check the [Audit logs](/docs/reports-and-audits/view-and-export-audit-logs.md) for errors after synchronizing your users for provisioning.

note

Once a refresh token expires, you must re-authorize and repeat this step.

## Step 6: Edit a provisioner

1. In IDaaS, click Menu icon **>** **Resources > Provisioners**. The **Provisioners List** page appears.
2. Click the name of the provisioner. The **Edit Provisioner** page appears.
3. Make your required changes and then click **Save**.

attention

If you need to make edits to the provisioner, changing a group or attribute mapping triggers a large number of SCIM calls. Entrust recommends disabling the provisioner until you have completed all the required changes. When disabled, the only SCIM calls made are to are delete users or provisioners, as applicable. In addition, you may need to reauthorize the provisioner if an authentication configuration has changed.