Automatically create users in xAssets with SCIM provisioning

Introduction

SCIM provisioning allows employee data to flow from your Identity Provider such as Microsoft Entra into other applications like xAssets. xAssets supports this protocol for both Custodian records and for User records.

xAssets supports SCIM from version 7.3.56. Many identity providers (IdPs) support SCIM including Entra ID, Okta, OneLogin, and DUO. These IdPs can now push users and groups into xAssets directly. There is now no need for a daily directory integration. Custodian records appear automatically when people join, are deactivated when they leave, and group memberships stay in sync as they change in the directory.

This article covers actions including creating a token, providing the identity provider with an xAssets API endpoint link, choosing the provisioning frequency, and viewing the actual results. The documentation for the process can be found in the SCIM Provisioning configuration guide.

Automating User Creation

Most xAssets customers already have user auto-provisioning. xAssets SSO auto-provisioning creates a Custodian and UserOptions row the moment a permitted user signs in for the first time, and the daily integration keeps department and manager fields in sync. SCIM is not really a replacement for these, instead it covers these specifics:

• Staff who never log in. All staff are synchronised into xAssets making xAssets a mirror image of your Entra (or other IdP) data.
• When a person is removed from Entra, they are automatically flagged as "left" within xAssets.
• When group membership changes, even during a logged in session, the user's user group changes and their permissions are set instantly
• The audit trail evidence required by SOC 2 and ISO 27001 is completely satisfied.
• The Custodian status workflow that runs on every "Left" transition can be triggered automatically the moment SCIM signals that the person has left.

Using SCIM alongside existing SSO setups

SSO auto-provision already creates users when they first login, so SCIM isn't needed for granting users access to your xAssets instance via SSO. Instead, SCIM covers the lifecycle from joining to leaving and de-provisioning. When a SCIM-provisioned user later signs in via SSO, the SSO path finds the Custodian (matched by email or UPN) and creates the User record linked to it. There is no conflict between these processes, so customers can run all three paths — SSO auto-provision, directory integration, and SCIM, at the same time.

Step 1 - Create a SCIM Token

SCIM tokens are bearer tokens scoped to /scim/v2/. They cannot be used against the standard API endpoints, and standard API tokens cannot be used against SCIM.

• Log in with an admin account
• Visit the Admin > Users screen
• Ensure that the user SCIMPROVISIONINGWRITE exists, if not create it in the user group "API WRITE"
• In the same users screen, click "Manage API Keys"
• In the header bar of the "Manage API Keys" screen, click on "Get a SCIM Token"

To revoke a token:

• Log in with an admin account
• Visit the Admin > Users screen
• Click "Manage API Keys"
• In the header bar of the "Manage API Keys" screen, click on "Revoke a SCIM Token"

Step 2 - Verify the Endpoint

Before changing the identity provider, test that the endpoint responds using CURL:

    curl -sS https://customername.domain.xassets.net/scim/v2/ServiceProviderConfig 
            -H "Authorization: Bearer <your-token>" 
            -H "Accept: application/scim+json"
        

Step 3 - Configure the Identity Provider

The setup is similar across all identity providers — paste the SCIM URL, paste the token, assign users and groups, and then switch provisioning on. The Microsoft Entra ID flow is the most common and looks like this:

1. In the Entra admin centre, open Enterprise applications and select or create the xAssets application.
2. Open Provisioning and set the provisioning mode to Automatic.
3. 
   
   In the "Admin Credentials:" section:
   
   
   • Tenant URL: https://customername.domain.xassets.net/scim/v2
   • Token: Use the GUID created in Step 1
   
   
4. Click the "Test Connection" button. You should see a HTTP 200 response code
5. Leave the default Mappings unchanged unless you have a specific reason to customise
6. Assign the users and groups you want provisioned to the enterprise application
7. Turn provisioning on

Entra will run the integration within a few minutes, and then repeat on a schedule at approximately every 40 minutes.

Step 4 - View User Records

Within a few minutes of switching provisioning on, Custodian rows appear in xAssets. Each row is populated from the SCIM resource:

• CustodianName from name.givenName + name.familyName
• EMail from the work email address
• PostTitle from Title
• DepartmentID from the enterprise extension department (the department row is auto-created if it does not exist)
• ManagerCustodianID resolved from the enterprise extension manager.value (optional)
• ADSPath set from the SCIM "externalId" (prefixed with "entra:")
• UserGroups populated from group memberships as a CSV

When the identity provider deactivates a user (Entra sets active = false, or sends a SCIM DELETE), xAssets sets the custodian status to "Left" and user's "Disabled" flag to true. This means that historical assignments and audit history are retained.

User Groups

xAssets stores SCIM groups in one of two tables depending on the displayName, which keeps a tenant with hundreds of Entra groups from polluting the xAssets user group tables.

• A group whose displayName starts with xAssets (configurable via the SCIMGroupPrefix SpecialOption) lands in the UserGroup table — a full permission group that drives access to forms, queries and menus.
• Any other group lands in the SCIMVirtualGroup> table — an informational group tracked on the Custodian record only. It does not affect permissions but stays round-trippable through the SCIM API.

A user in two permission groups (ADMINS, SAMMGRS) and two informational groups (VG-47, VG-103) ends up with Custodian.UserGroups = "ADMINS,SAMMGRS,VG-47,VG-103", and the alphabetically-first permission code (ADMINS) becomes their effective UserOptions.UserGroup.

Automatically Create Login Accounts

By default, a SCIM POST creates a Custodian row only — not a UserOptions login account. The existing SSO logon process creates the User record on first login and links it to the Custodian by matching the email address.

For deployments where SCIM is the primary identity feed and users must have a usable login account before their first sign-in — set the xAssets "SCIMCreateMode" option to value Both.

With Both set, a SCIM POST creates the Custodian and a paired User record in one operation. The systen maps UserID from userName, FullName from displayName, the password is auto-generated, and the DisabledFlag field in xAssets mirrors the SCIM "active" flag. The user can then login with SSO.

Compliance

Every SCIM action is tracked into an audit trail. The system complies with SOC 2 and ISO 27001 evidence for granting and removing access. For example, a leaver removed in Entra at 09:00 has a corresponding "active set to false" entry in the xAssets audit log, with the timestamp and SCIM token's username attached. This provides auditors with a chain of events, from the initial directory event through to the xAssets custodian/user record update.

Testing Without an Identity Provider

SCIM endpoints accept curl or Postman queries directly using the bearer token. A test can typically create a user, list users with a filter, patch the user to active = false, or confirm the Custodian status flipped to "Left". For documentation on testing SCIM provisioning without an identity provider, the SCIM Provisioning covers using CURL and Postman to test.

Summary

SCIM provisioning accommodates provisioning users who do not login to xAssets, deactivating leavers in instantly, keeping group memberships in sync between sessions, and producing the audit trail for compliance. It also makes your xAssets instance a source-of-truth for employee data. Setup is simple and removes (or makes optional) the need to sync users with Entra or other identity providers.

Further Reading

• SCIM Provisioning - configuration guide
• SSO Introduction and Setup
• Maintaining User Identities
• Entra Auto-Permissions
• SSO with Azure / Entra ID
• SSO with Okta
• SSO with OneLogin