Microsoft Entra ID SCIM provisioning for authors

KnowledgeOwl supports two forms of author account management, also known as author provisioning:

1. Manual account management or provisioning, in which you manually create, update, and delete authors in Account > Authors. Refer to Author management for more information.
2. SCIM account management or provisioning, in which your company's identity provider (IdP) handles the account creation, updates, and deletions. This page details how to set up SCIM provisioning for Microsoft Entra ID. Refer to Okta SCIM provisioning for authors or SCIM provisioning for authors generic instructions if you want to set up SCIM provisioning for another IdP.

Supported features

KnowledgeOwl's SCIM 2.0 endpoint supports these provisioning features:

• Create users: When Entra users are assigned to your SCIM app in Entra, they're created as authors in KnowledgeOwl in Account > Authors, as long as you have available author seats.
• Update user attributes: When user attributes are updated in Entra, they can be updated in the author's profile details in KnowledgeOwl.
• Deactivate users: When a user is removed from the app in Entra, their KnowledgeOwl author account can be removed. Refer to What happens when I delete an author? for how this impacts content attributed to the author.
• Groups: KnowledgeOwl's SCIM endpoint accepts groups. Groups your IdP sends appear in Account > Authors > SCIM > Group provisioning profiles, where you can set a provisioning profile for each group.

This integration supports Entra to KnowledgeOwl provisioning only. Updates you make in KnowledgeOwl are not recommended and may be overwritten by Entra changes at any time.

Before you begin

Before you begin setup, you'll want to make one key decision: what login type you want authors provisioned by SCIM to use.

• With the Username and password author login type: In this setup, Entra creates, updates, and deletes author accounts in KnowledgeOwl, but authors have a separate KnowledgeOwl password that is still reset and managed by KnowledgeOwl admins. Authors log in through app.knowledgeowl.com.
• With the SAML SSO author login type: In this setup, Entra creates, updates, and deletes author accounts in KnowledgeOwl and also handles the username and password processing. Authors log in through your SAML SSO login URL using their Entra password. Refer to Set up SAML SSO for authors for more information on how this login type works and Author login type for more information on the types broadly. If you use this approach, you'll need to have SAML SSO set up for readers in at least one of your knowledge bases.

Refer to the SCIM overview for a more detailed breakdown of the differences between these setups and for an introduction to SCIM overall.

How to set up Entra SCIM provisioning for authors

Setting up Entra SCIM provisioning for authors is a multi-step process.

Step 1: Set up reader SAML SSO

If you plan to use SAML SSO to log your authors in, you'll first need to configure SSO with Microsoft Entra ID for readers.

Verify that setup is working before you move on to Step 2.

Step 2: Turn on SCIM author provisioning

First, enable SCIM author provisioning in KnowledgeOwl and copy some information:

1. Go to Account > Authors (or Security and access > Authors). The Authors page opens to the Authors tab.
2. Select the SCIM tab.
3. In the SCIM author provisioning section, check the box to Enable for author provisioning:
   The SCIM author provisioning section
4. Save. Once you save, the page updates to include all the SCIM settings you'll need to get set up.
5. In the SCIM settings section, copy the SCIM base URL and save it somewhere. You'll need it in Step 5.
6. Select Generate token to generate a bearer token for SCIM provisioning.
7. Copy this token and save it somewhere. You'll need it in Step 5.

Step 3: Set up your default provisioning profile in KnowledgeOwl

Next, set up your Default provisioning profile. KnowledgeOwl applies this profile to all newly SCIM-provisioned authors who don't match a group provisioning profile. Once applied, it doesn't affect existing authors.

1. In the SCIM tab, scroll to the Default provisioning profile section:
   The Default provisioning profile section
2. If you want your default profile to grant any type of Admin rights, check the box or boxes to grant the appropriate rights:
   1. Full account admin: Check this box to give authors with this profile the ability to manage Billing, Authors, Readers, API Keys, and so on.
   2. Admin access to readers: Check this box to give authors with this profile the ability to manage Readers but no other account admin functions. Choose whether they Can purge readers, too.
   3. Refer to Author permissions for a more detailed explanation of these settings.
3. Choose the Login type you want to use with this profile:
   1. Choose Username and password if you want your authors to log in through app.knowledgeowl.com using a password stored within KnowledgeOwl.
   2. Choose SAML SSO if you've already set up Entra reader SAML SSO and you want that integration to handle their login and password. Then:
      1. Select the SAML KB. Authors are sent to that knowledge base's SAML login URL.
      2. Choose the SSO ID source: Author email (most common) or SCIM external ID. This must match the SSO ID your Entra SAML app sends in the SAML assertion.
4. Choose the KB access you want this profile to have:
   1. Select the Knowledge base and Role.
   2. Editor and Writer are default roles built into all knowledge bases. Refer to Default author roles for more information on what permissions each role grants.
   3. All other roles listed here are custom author roles.
   4. Select Add KB to grant access to additional knowledge bases.
5. Be sure to Save your changes.

Step 4: Create a custom app in Entra

Next, head over to Microsoft Entra and create a custom app for SCIM provisioning:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Enterprise apps > New application. The Browse Microsoft Entra App Gallery page opens.
3. Select Create your own application. The Create your own application panel opens.
4. In What's the name of your app?, enter a name such as KnowledgeOwl SCIM.
5. Select Integrate any other application you don't find in the gallery (Non-gallery):
   The Create your own application panel
6. Select Create. Entra adds the app and opens its Overview page.

Step 5: Connect your Entra app to KnowledgeOwl

Once Entra creates your app, give it the information it needs to connect to your KnowledgeOwl account:

1. In your Entra app, select Manage > Provisioning.
2. Under Create configuration, select Connect your application. The New provisioning configuration page opens.
3. For Select authentication method, choose Bearer authentication.
4. In Tenant URL, paste the SCIM base URL you copied from KnowledgeOwl in Step 2.
5. In Secret token, paste the bearer token you copied from KnowledgeOwl in Step 2:
   The New provisioning configuration page, ready to test
6. Select Test connection. Entra confirms when the connection test is successful, and Create becomes available after that.
7. Select Create. Entra creates the provisioning configuration and opens the app's provisioning Overview page.

Step 6: Assign users to your Entra app

Assign users to your Entra app. These users get author accounts in KnowledgeOwl in Account > Authors, so you may want to start with a single test user:

1. In your Entra app, select Manage > Users and groups.
2. Select Add user/group. The Add Assignment page opens.
3. Under Users, select None selected, check the users you want to assign, and select Select.
4. Select Assign.

Step 7: Test and start provisioning

Test your setup with one user before you start provisioning for everyone:

1. In your Entra app, select Provision on demand.
2. Under Select a user or group, search for an assigned user by name, user principal name, or email. Select the user, then select Provision.
3. Entra shows the attributes it sent, under Modified attributes (successful), and a message that the user was created.
4. In KnowledgeOwl, go to Account > Authors and confirm the author exists with the access you expect from your provisioning profile.
5. When the test works, go back to Overview in your Entra app, select Start provisioning, and select Yes to confirm.

Step 8: Test logging in

Test logging into the knowledge base as one of the assigned users:

• If you used the SAML SSO login type, open the knowledge base SAML SSO login URL and test logging in with the user's Entra credentials. Make sure the account gets the permissions you expect.
• If you used the Username and password login type, open app.knowledgeowl.com and test logging in with the author's KnowledgeOwl password. Make sure the account gets the permissions you expect.

Troubleshooting

If an Entra user isn't automatically created in KnowledgeOwl, the most likely causes are:

1. No available author seats.
   Check the Authors tab and be sure you have available author seats. If you have no available author seats, new Entra users can't be created as KnowledgeOwl authors. Refer to Add and remove author seats for instructions on adding author seats.
2. Provisioning hasn't started.
   Provision on demand works before you start provisioning, but Entra doesn't sync assigned users automatically until you select Start provisioning on the app's Overview page. Refer to Step 7.
3. The user isn't assigned to the app.
   Check Manage > Users and groups in your Entra app. Refer to Step 6.

If you run into any issues setting up Entra SCIM provisioning for authors, please contact us.