Configure SCIM in Microsoft Entra ID

Once you have set up SCIM within Riverside, continue to the steps below to enable it in Microsoft Entra ID.

Who: Account owners
Plan: Some Business plans, contact your CSM
Device: Computer browser

Create the enterprise application in Entra ID

Enable SCIM provisioning for the Riverside app in Microsoft Entra ID.

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com.
  2. Go to Identity → Applications → Enterprise applications.
  3. Select New application → Create your own application.
  4. Name it Riverside, choose Integrate any other application you don't find in the gallery (Non-gallery), then select Create.

Connect Entra to Riverside

Set up the SCIM integration between Microsoft Entra ID and Riverside, so user provisioning can be managed automatically.

  1. In your new application, go to Provisioning and select Get started.
  2. Set Provisioning Mode to Automatic.
  3. Under Admin Credentials, enter the base URL and bearer token.
  4. Select Test Connection. You should see a success message.
  5. Select Save.

Turn off group provisioning

Entra enables a group mapping by default. Riverside doesn't support it, and leaving it on will cause repeated provisioning errors.

  1. Under Mappings, select Provision Microsoft Entra ID Groups.
  2. Set Enabled to No.
  3. Select Save.

Configure your user attribute mappings

This step creates a custom attribute in Microsoft Entra ID to assign users to productions in Riverside. Riverside returns an error if a user is created or updated with no productions.

Under Mappings, select Provision Microsoft Entra ID Users.

Supported attributes

Riverside accepts only the attributes below. Set your mappings to match this list:

Entra attribute Riverside SCIM attribute Notes
userPrincipalName or mail userName Used as the Riverside login email. Riverside lowercase emails rather than comparing case-insensitively. A mixed-case UPN will work, but the email displays lowercase in Riverside.
objectId externalId Keep this. It's Entra's primary matching attribute, and Riverside supports filtering on it.
givenName name.givenName  
surname name.familyName  
displayName displayName  
mail emails[type eq "work"].value  
Switch([IsSoftDeleted]...) active Controls deactivation
See Add required productions attribute productions Required

Delete every other mapping

Delete all mappings that aren't in the table above, then select Save.

Add the attribute to Entra's schema

  1. In Provision Microsoft Entra ID Users, scroll to the bottom and check Show advanced options.
  2. Select Edit attribute list for customappsso.
  3. Add a new attribute:
    • Name: urn:ietf:params:scim:schemas:extension:riverside:2.0:User:productions
    • Type: String
    • Multi-Valued: unchecked
  4. Select Save.

Map a value

Two approaches work:

  • All users get the same productions: use a Constant mapping with a comma-separated list of production slugs, for example weekly-show,marketing-podcast.
  • Productions vary by user: map an Entra user attribute (such as extensionAttribute1) containing that user's comma-separated production slugs.

These must be production slugs exactly as they appear in the production URL, not production display names, and every production must already exist in this Riverside account.

Assign users and start provisioning

This step defines which users are provisioned into Riverside and which productions they are assigned to. You can assign users individually or assign an Microsoft Entra ID group to provision all members of that group at once.

  1. Go to Users and groups and assign the users who should have Riverside access.
    • You can assign an Entra group here to control who gets provisioned. The group itself isn't synced to Riverside, and its name has no effect on the user's Riverside role.
  2. Return to Provisioning → Overview.
  3. Under Settings, set Scope to Sync only assigned users and groups.
  4. Set Provisioning Status to On, then select Save.

New user roles

Riverside roles can't be set through SCIM. A new user is provisioned according to the following defaults:

Situation Role in Riverside
New user Director
Account owner Admin
User who already has a role Their existing role is kept

Icon.svg Good to know

  • Password changes are not managed through SCIM.

Learn more