SCIM provisioning with Entra ID (Azure AD) – SqlDBM - Support

SCIM provisioning keeps your SqlDBM users in sync with Microsoft Entra ID. Users you assign in Entra are invited to SqlDBM automatically, users you unassign lose access, and Entra groups decide each user's roles.

Before you start

SSO must already be working. Set it up first with Setup SSO with Entra ID (Azure AD). SCIM uses the same enterprise application.
The SSO Name ID must be the user's object ID. In the SqlDBM app, open Single sign-on → Attributes & Claims → Unique User Identifier (Name ID). Set Source attribute to user.objectid and Name identifier format to Unspecified. The default, user.userprincipalname, won't work with SCIM.
Every user needs a value in the Mail field in Entra ID.
You need an Entra admin with the Cloud Application Administrator role or higher.
Decide which Entra groups map to SqlDBM roles (optional; see Groups and roles).

Why the Name ID matters: SqlDBM links the person who signs in with SSO to the person Entra provisions by matching the SSO Name ID to the SCIM externalId. Both must be the object ID, which never changes. Emails and UPNs change when people are renamed.

Already using SSO with a different Name ID? Contact SqlDBM support before you change it. Users who have already signed in are linked to the old value and need to be moved over.

Step 1: Request SCIM from SqlDBM

Go to https://support.sqldbm.com/hc/en-us/requests/new and log in.
Open a ticket with:
- Subject: Enable SCIM
- IdP Admin Email: your Entra admin's email address
- Description: the Entra group display name for each SqlDBM role you want to manage (Modeler, Governance, Alternative admin, AI), and your credential type. Static token is the simplest for Entra; also give a lifetime in days (1 to 3650). OAuth also works.
SqlDBM turns on SCIM and sends you these values securely:

Value	Where it goes in Entra ID
SCIM base URL: `https://provisioning.sqldbm.com/scim/v2`	Tenant URL
Static token (static token only)	Secret Token
OAuth token URL: `https://provisioning.sqldbm.com/oauth/token` (OAuth only)	Token Endpoint
Client ID and client secret (OAuth only)	Client Identifier, Client Secret

The token or client secret can't be retrieved later. Store it in your password manager. If it's lost, SqlDBM issues a new one.

Step 2: Connect Entra ID to SqlDBM

In the Microsoft Entra admin center, open the SqlDBM enterprise application you created for SSO.

Go to Provisioning → Get started and set Provisioning Mode to Automatic.
Under Admin Credentials, enter one of these:
- Static token: Authentication Method = Bearer authentication, Tenant URL = SCIM base URL, Secret Token = your static token.
- OAuth: Authentication Method = OAuth2 Client Credentials Grant, Tenant URL = SCIM base URL, Token Endpoint = OAuth token URL, plus your Client Identifier and Client Secret.
Click Test Connection. When it succeeds, click Save.

Step 3: Map attributes and start provisioning

Open Mappings → Provision Microsoft Entra ID Users and check these rows:

SqlDBM attribute (target)	Entra attribute (source)	What to do
`externalId`	`objectId`	Change it. The default source is `mailNickname`, which breaks the link with SSO.
`userName`	`userPrincipalName`	Keep the default as the matching attribute.
`emails[type eq "work"].value`	`mail`	Keep. Users without a Mail value fail.
`active`	`Switch([IsSoftDeleted], ...)`	Keep the default.
`displayName`	`displayName`	Keep.

Other default attributes, such as job title, phone numbers and addresses, are accepted and ignored.

Open Mappings → Provision Microsoft Entra ID Groups. Set Enabled to Yes, with displayName from displayName and members from members.
In Settings, set Scope to Sync only assigned users and groups. Optionally add a notification email for provisioning failures.
In Users and groups, assign the users and the role groups. Entra doesn't provision members of nested groups, so add users directly to the role groups.
Set Provisioning Status to On and click Save.

Entra syncs about every 40 minutes. To test right away, use Provision on demand for one user, then for each group (up to five members per group).

Groups and roles

Each SqlDBM role is granted through one Entra group, using the display name you gave SqlDBM. A role with no group is never granted by SCIM.

SqlDBM role	What being in the group gives the user
Modeler	A Modeler seat. Users not in this group get a Consumer seat.
Governance	The Governance role.
Alternative admin	Alternative admin of your SqlDBM account.
AI	Access to AI features.

Assigned, in no role group: invited with a Consumer seat and no extra roles.
Roles add up: a user in both the Modeler and Governance groups gets both. Removing them from a group removes that role at the next sync.
Invite not yet accepted: the invite carries the roles. The user gets them after signing in with SSO and entering a one-time email code.
Unassigned or disabled in Entra: the user loses access to your SqlDBM account. Their SqlDBM user and data are kept, and reassigning restores their roles.
Out of seats: the user waits until a seat is free, then is added automatically.
Members from before SCIM: they stay members. A Modeler seat granted by hand is kept.
Your account admin: SCIM never removes the primary account admin.
Group names must match exactly. Once linked, renaming the group in Entra doesn't break the link. To change which names SqlDBM expects, contact support; this resets the connection and issues new credentials.

While SCIM is on, Add user and the revoke buttons are hidden in the SqlDBM admin console. Make all membership changes in Entra ID.

Verify and troubleshoot

Run these checks with one test user. Allow about a minute after each sync.

Connection: Test Connection succeeds.
One user, no role group: after Provision on demand, the user appears in SqlDBM as a Consumer invite or member.
Role group: add the user to the Modeler group and provision the group. The user now shows Modeler.
Accept the invite: the user signs in with SSO and lands in your account with the right roles.
Remove a role: take the user out of the group. The role is removed at the next sync.
Confirm with support: reply to your ticket so SqlDBM can confirm each role group is linked and no users failed.

Symptom	Likely cause	Fix
Test Connection returns 401	Wrong, expired or replaced token or secret	Ask SqlDBM for a new credential. Static tokens expire after their set lifetime.
Test Connection times out	Your tenant can't reach SqlDBM through its firewall	Contact SqlDBM support.
One user fails, others work	That user's SSO Name ID and `externalId` differ	Check both use the object ID, then provision the user again. Don't change their email to work around it.
Error 400: `externalId is missing or invalid`	No externalId mapping	Map `externalId` from `objectId`.
Error 400: `emails[type eq "work"].value is missing or invalid`	User has no Mail value	Fill in Mail for the user.
Error 400: `externalId is immutable`	The externalId source changed after the user was provisioned	Restore the original mapping, or contact support.
Error 400: `work email is immutable`	The user's email changed after provisioning	Not supported yet. Contact SqlDBM support.
Error 409: `userName conflicts with an existing user`	Two users share a UPN	Make the UPN unique.
A user doesn't get a role	Group name doesn't match, or the group isn't assigned	Assign the group, check group provisioning is enabled, and match the name exactly.
A user isn't added	No free seats	Free a seat or contact SqlDBM to add seats.

New credentials and turning SCIM off

New credentials: open a support ticket to rotate. You get a new static token, or a new client secret with the same client ID. The old one stops working immediately, so update Entra right away and run Test Connection again.

Turning SCIM off: open a support ticket, then set Provisioning Status to Off in Entra.

Existing members keep their memberships and roles.
Add user returns to the SqlDBM admin console.
Turning SCIM back on starts fresh, with new credentials and role group names.

SSO can't be changed or turned off while SCIM is on.