LivionKey Register: Set up SCIM provisioning with Microsoft Entra ID

LivionKey Register supports SCIM provisioning with Microsoft Entra ID. Once configured, Microsoft Entra can provision users to your LivionKey Register organization, keep their account status in sync, and assign the appropriate LivionKey role.

This guide is intended for LivionKey Register organization admins and Microsoft Entra admins.

SCIM is an optional feature: SCIM provisioning must be enabled for your organization by Livion Support before an admin can configure it. Additional fees may apply depending on your agreement. Contact [email protected] to check availability, pricing, and enablement.

Before you begin

Make sure that you:

Have asked Livion Support to enable SCIM provisioning for your organization.
Have an Admin role in the LivionKey Register organization you want to configure.
Have permission to create and configure enterprise applications and app registrations in Microsoft Entra.
Have a secure place to store the SCIM secret token. The token is displayed when you enable SCIM provisioning in LivionKey Register.

Important: Treat the SCIM secret token like a password. Do not share it or include it in screenshots, emails, or support requests.

Enable SCIM provisioning in LivionKey Register

After Livion Support has enabled the SCIM feature for your organization:

In LivionKey Register, go to Organization > Users & Security from the left-hand menu.
Find Enable SCIM provisioning and turn on the toggle.
In the pop-up window, copy the displayed secret value and store it securely.
Select Close.
Copy the displayed Tenant URL. You will need both the Tenant URL and secret value when configuring Microsoft Entra.

Create an enterprise application in Microsoft Entra

In Microsoft Entra, go to Enterprise applications > New application > Create your own application.
Enter a name for the application, for example LivionKey Register.
Select Integrate any other application you don't find in the gallery (Non-gallery).
Create the application.

Add the LivionKey roles

From the left-hand menu in Microsoft Entra, go to App registrations.
Select the application you created.
Select App roles.
Create the following roles. Enter each Value exactly as shown:
- Apps admin: apps-admin
- Apps user: apps-user
- Apps extended user: apps-extended-user

Important: The role values are case-sensitive and must match the values above exactly.

Configure the provisioning connection

Go to Enterprise applications and select your LivionKey application.
Go to Provisioning > Connectivity.
Select New configuration.
Set Authentication method to Bearer authentication.
In Tenant URL, enter the Tenant URL copied from LivionKey Register.
In Secret token, enter the secret value generated in LivionKey Register.
Select Test Connection and confirm that the connection works.
Select Create.

Configure user attribute mappings

LivionKey Register uses user provisioning only. Group provisioning must be disabled.

In the provisioning application, go to Provisioning > Mappings.
Open the Groups mapping and turn Enabled off.
Under Mappings, select Provision Microsoft Entra ID Users.
Select Show advanced options.
Select Edit attribute list for customappsso.
In the customappsso User Attributes list, set externalId as required.
Add a new attribute with Name set to roles and Type set to String.
Select Save.

Add the roles mapping

In the Attribute Mapping view, select Add New Mapping.
Set Mapping type to Expression.
Enter the following expression:

AppRoleAssignmentsComplex([appRoleAssignments])

Set Target attribute to roles.
Select OK.

Change the externalId mapping

In the Attribute Mapping list, find externalId and select Edit.
Change Source attribute to objectId.
Select OK.

Review all mappings

Remove unnecessary default mappings so that only the following mappings remain:

roles ← AppRoleAssignmentsComplex([appRoleAssignments]) — Expression
displayName ← displayName — Direct
name.givenName ← givenName — Direct
name.formatted ← Join(" ", [givenName], [surname]) — Expression
emails[type eq "work"].value ← mail — Direct
phoneNumbers[type eq "mobile"].value ← mobile — Direct
externalId ← objectId — Direct
name.familyName ← surname — Direct
active ← Switch([IsSoftDeleted], , "False", "True", "True", "False") — Expression
phoneNumbers[type eq "work"].value ← telephoneNumber — Direct
userName ← userPrincipalName — Direct

Before continuing, confirm that:

roles uses the AppRoleAssignmentsComplex([appRoleAssignments]) expression.
externalId is mapped from objectId.
Group provisioning is disabled.

Select Save when the mappings are correct.

Assign users and roles

In the provisioning application, select Users and groups.
Select Add user/group.
Select the users you want to provision.
Assign each user one of the LivionKey roles: apps-admin, apps-extended-user, or apps-user.
Complete the assignment.

Microsoft Entra will use the assigned app role when provisioning the user to LivionKey Register.

Troubleshooting

The SCIM provisioning setting is not visible

Confirm that Livion Support has enabled the SCIM feature for your organization.
Confirm that you are signed in with an Admin role.
Contact [email protected] to check feature availability and enablement. Additional fees may apply depending on your agreement.

The connection test fails

Confirm that the Tenant URL was copied from the correct LivionKey Register organization.
Confirm that the complete secret value was entered as the Secret token.
If the secret is no longer available or may have been exposed, contact Livion Support before continuing.

A user is provisioned with the wrong role or without a role

Confirm that the user has one of the three LivionKey app roles assigned in Microsoft Entra.
Confirm that each app role value matches the required value exactly.
Confirm that the roles attribute uses the AppRoleAssignmentsComplex([appRoleAssignments]) expression.

A user is not provisioned correctly

Confirm that externalId is required and mapped from objectId.
Compare the mapping list with this guide and remove unnecessary default mappings.
Confirm that user provisioning is enabled and group provisioning is disabled.

Need help?

If you encounter any issues or have questions, contact our support team at [email protected].