Documentation Index
Fetch the complete documentation index at: https://knowledge.goautonomous.io/llms.txt
Use this file to discover all available pages before exploring further.
Overview
SCIM lets your identity provider provision users and keep group membership in sync with Go Autonomous automatically. When a new person joins the right Entra group, they show up in the platform with the correct access — no manual intervention. This guide walks through the Microsoft Entra (Azure AD) setup. The same SCIM endpoint will work for other compliant IdPs, but the field-level configuration below is written specifically for Entra.What syncs and what doesn’t
Set the right expectation up front. The integration is deliberately scoped — it covers what most teams need without giving Entra control of everything in the platform.| Action | Synced from Entra? |
|---|---|
| New users created in Entra | Yes — provisioned into Go Autonomous |
| Group membership changes | Yes — Entra is the source of truth |
| User profile updates | No — change them in the platform |
| User deactivation or deletion | No — manage in the platform |
| Group creation, rename, or deletion | No — managed in the Go Autonomous UI |
PATCH to a group never reaches the platform, or all their groups are later removed), they’re automatically assigned to the Basic User group as a safety net so they keep baseline access.
Before you start
You’ll need:- An Enterprise Application for Go Autonomous in your Entra tenant.
- A service account API key from the Go Autonomous platform to use as the SCIM secret token.
If you don’t have an API key yet, see API keys to generate one. Use a dedicated service account so the key is easy to rotate.
Set up provisioning in Entra
Open your Enterprise Application's Provisioning settings
In Entra, go to Enterprise Applications → Go Autonomous → Provisioning and switch Provisioning On.
Set the Tenant URL and Secret Token
| Field | Value |
|---|---|
| Tenant URL | https://platformapi.qa.goautonomous.io/scim/v2 |
| Secret Token | The service account API key issued by Go Autonomous |
Configure the User attribute mapping
Open Mappings → Provision Microsoft Entra ID Users and adjust exactly one row:
Setting matching precedence to 1 is what tells Entra to use this attribute for user reconciliation. Leave every other row at its default.
| customappsso (target) | Microsoft Entra ID (source) | Matching precedence |
|---|---|---|
emails[type eq "work"].value | mail | 1 |
Restrict User Target Object Actions to Create only
Under the same Users mapping, set the Target Object Actions:
- ✅ Create
- ❌ Update
- ❌ Delete
/scim/v2/Users. In the same provisioning cycle, Entra issues PATCH /scim/v2/Groups/{id} to add the user to each assigned synced group.Configure the Group attribute mapping
Open Mappings → Provision Microsoft Entra ID Groups and adjust exactly one row:
This is how Entra reconciles its group with the matching platform group. Leave
| customappsso (target) | Microsoft Entra ID (source) | Matching precedence |
|---|---|---|
externalId | objectId | 1 |
members, externalId defaults, and every other row alone.Restrict Group Target Object Actions to Update only
Under the same Groups mapping, set the Target Object Actions:
- ❌ Create
- ✅ Update
- ❌ Delete
PATCH) only. Group creation and deletion happen in the Go Autonomous UI.Set up the matching group in the platform
For every Entra group you want synced, you need a corresponding platform group with the same External Group ID.Create or pick the platform-side group
Navigate to Administration → Access Control → User Groups and either create a new group or open an existing one you want to sync. Permissions on this group are what synced users will inherit.
Set the External Group ID
In Entra, go to Groups → [your group] → Properties and copy the Object ID. Paste it into the External Group ID field on the platform group’s SCIM/SSO tab.
Verify the sync
Force an initial sync
In Entra, go to Provisioning → Overview → Restart provisioning. Pick a user who’s assigned to the app and a member of a synced group, then confirm they appear in the platform UI within seconds.
Rotate the API key
Rotate the secret token periodically as part of your security hygiene.Issue a new key in the platform
Generate a new service account API key from the API keys page.
Update the Secret Token in Entra
Paste the new key into the Provisioning → Secret Token field on the Enterprise Application.
What’s next
- User Groups — configure permissions on the groups you sync.
- User Management — see synced users in the Users table and check their effective permissions.