SCIM provisioning is in beta. See SCIM provisioning (beta) for shared concepts, beta enrollment, how SCIM relates to SSO, team group naming, and general limitations.
Prerequisites
Meet the shared SCIM prerequisites, then confirm you have permission in Microsoft Entra ID to manage enterprise applications, automatic provisioning, and user and group assignments. See Microsoft Entra ID roles. Group sync requires Entra ID P1 or higher.Set up SCIM with Entra ID
1
Sign in to Semgrep AppSec Platform as an admin.
3
Click Set up to launch the Directory Setup Portal.
4
Select Entra ID as the identity provider.
- Create an Entra ID application
- Configure admin credentials
- Configure attribute mapping
- Assign users and groups
- Map groups to roles
- Test directory connection
Configure provisioning in Entra ID
After you connect the application in the portal, confirm these settings on the Semgrep enterprise application’s Provisioning page in the Microsoft Entra admin center:Set Scope to Sync only assigned users and groups and set Provisioning Status to On.
1
Sign in to the Microsoft Entra admin center.
2
Go to Entra ID > Enterprise applications and open your Semgrep application.
3
Open Provisioning, set Provisioning Mode to Automatic, and paste the tenant URL and secret from the Directory Setup Portal under Admin Credentials.
4
Click Test connection, then Save.
5
Under Settings, set Scope to Sync only assigned users and groups.
6
Set Provisioning Status to On, then click Save.
Understand group assignments
Entra ID uses group assignment to the Semgrep enterprise application for provisioning, deployment role mapping, and team creation. There is no separate push-groups workflow.Manage users
Assign users to the SSO connection as well as the SCIM application. SCIM can provision a user who isn’t assigned to SSO, but that user can’t sign in.Assign an individual user
1
In the Microsoft Entra admin center, go to Entra ID > Enterprise applications > All applications and open your Semgrep application.
2
Open Users and groups, then click Add user/group.
3
Under Users and groups, click None Selected and select the user.
4
Click Assign.
If your Entra application has defined app roles, Entra ID requires selecting a role to complete an assignment. If no custom app roles exist, Entra ID shows the built-in Default Access role. Select whichever role is available. Semgrep doesn’t use Entra ID’s app role value; deployment roles are controlled through group-to-role mapping in the Directory Setup Portal. See Microsoft’s documentation on assigning users and groups for details.
Assign users through a group
1
In the Microsoft Entra admin center, go to Entra ID > Enterprise applications > All applications and open your Semgrep application.
2
Open Users and groups, then click Add user/group.
3
Under Users and groups, click None Selected and select the group.
4
Click Assign.
Remove a user
1
Open your Semgrep enterprise application and go to Users and groups.
2
Select the user, then click Remove assignment.
3
Click Yes in the confirmation dialog.
Manage deployment roles
Create groups in Entra ID, assign them to the Semgrep application, map them to roles in the Directory Setup Portal, and assign users to those groups so they inherit the correct roles.Add role groups
1
In the Microsoft Entra admin center, go to Entra ID > Enterprise applications > All applications and open your Semgrep application.
2
Open Users and groups, then click Add user/group.
3
On the Add Assignment page, click None Selected under Users and groups.
4
In the drawer, select the groups you want to add, then click Select.
5
Click Assign.
Map groups to roles
You can map roles during setup, or later by reopening the portal:2
Under Identity management (SCIM), click View to open the Directory Setup Portal.
3
Click Configure role assignment.
4
Use the drop-down in the Role column for each group to select its role. Updating the role propagates to all Semgrep users in that group.
Role updates follow Entra ID’s 40-minute provisioning cycle unless you Provision on demand on the application’s Provisioning page.Team groups that use the
[team:<role>] naming convention also appear in the role mapping table. Don’t assign a deployment role to these groups.Change a user’s deployment role
- Remove the user from the role group in Entra ID, or assign them to a different role group.
- Wait for the next provisioning cycle, or use Provision on demand on the Provisioning page.
Manage teams
To create Semgrep teams from Entra ID groups, use the[team] naming convention described in Manage teams with SCIM. IdP directory groups map to two distinct Semgrep concepts: deployment role groups and Semgrep teams. Each concept has its own role groups. The naming convention tells Semgrep which is which.
Name the group with [team] or [team:<role>] before you assign it. A group without that suffix is treated as a deployment role group. Renaming a group that’s already assigned doesn’t trigger team creation. Create a new group with the naming convention, then assign it.
Assigning a group to the application provisions its members. Don’t use a team group as a user’s only assignment path into the application.
Create a team
1
In the Microsoft Entra admin center, go to Entra ID > Enterprise applications > All applications and open your Semgrep application.
2
Open Users and groups, then click Add user/group.
3
On the Add Assignment page, click None Selected under Users and groups.
4
In the drawer, select the
[team] or [team:<role>] named groups, then click Select.5
Click Assign.
Assign team-level roles
Create one group per role suffix ([team:manager], [team:member], [team:readonly]). Semgrep maps them to the same team.
- Assign a user to only one role-suffixed group per Semgrep team.
- When changing a member’s team permission level, remove them from the first role-suffixed group before adding them to a different one.
- Apply rename and delete operations to all role-suffixed groups for that team.
Add or remove team members
Add members
Users must already be assigned to the directory. Do not add deployment Admins to team groups. Because deployment Admins already have access to all teams, Semgrep does not add them to team groups.1
In the Microsoft Entra admin center, open your Semgrep enterprise application and go to Users and groups.
2
Click the team group.
3
Under Manage, click Members.
4
Click + Add members, search for the user, select them, and click Select.
Remove members
1
On the same Members page, select the user and click Remove in the top menu bar.
Rename a SCIM-managed team
If you have multiple role-suffixed groups for one team, update the name consistently across all of them.1
In the Microsoft Entra admin center, go to Entra ID > Groups > All groups.
2
Open the group assigned to your Semgrep SCIM application.
3
Under Manage, click Properties.
4
Under General settings, edit Group name, then click Save.
Delete a SCIM-managed team
Removing the group’s assignment from the Semgrep application also removes the corresponding Semgrep team.1
Open your Semgrep enterprise application and go to Users and groups.
2
Select the group you want to remove, then click Remove assignment.
3
Click Yes in the confirmation dialog.
Entra ID-specific behavior and limitations
For shared SCIM limitations, see Limitations. Entra ID-specific behavior:- Group sync requires Entra ID P1 or higher.
- If the Entra application has defined app roles, Entra ID requires selecting a role to complete an assignment. Semgrep doesn’t use the Entra app role value.
- Assigning a group to the application provisions that group’s users. Review membership before assignment.
- Users and groups are provisioned on a 40-minute cycle by default unless you use Provision on demand.
- Creating sub-teams through SCIM isn’t supported. Don’t create an Entra ID group whose name matches an existing sub-team in Semgrep.
- A group without a
[team]or[team:<role>]suffix is treated as a deployment role group. Renaming a group that’s already assigned doesn’t trigger team creation. - Do not add deployment Admins to team groups. Because deployment Admins already have access to all teams, Semgrep does not add them to team groups. They appear in the Entra ID group but not on the corresponding Semgrep team.
- Demoting an admin who was added to an Entra ID group to Member or Read-only can cause drift. Remove them from the group and re-add them after their role has changed.
- Mapping an Entra ID group to the default team and operating on that group has no effect in Semgrep.
- If a group spans multiple organizations, membership and team changes apply across all of them.
- Each SCIM application manages one Semgrep deployment. Multiple deployments can share an SSO connection, but each deployment needs its own SCIM application.
- Assign users to the SSO connection before the SCIM app. In a multi-app setup, Entra ID admins can assign directory users to the SCIM app even if they’re not assigned to the corresponding SSO connection. Those users can’t sign in through SSO.
- Disable social auth when using SCIM. If social auth (GitHub or GitLab) remains enabled, those users’ access is still controlled by their GitHub org or GitLab group membership.
- Removing a user from only one role-suffixed group removes them from the Semgrep team, even if they remain in other role-type groups for that team in Entra ID.
- Renaming or deleting only one role-suffixed group renames or deletes the Semgrep team and leaves other role-type groups in Entra ID unmapped. Always update all role types together.