Set Up SCIM for Azure Entra

Integrating Microsoft Entra ID with Backblaze allows for automated user provisioning.

Generate an API Token

1. Sign in to your Backblaze organization.
2. In the left navigation menu under Access Control, select Org Users.
3. Select the Identity Provider tab.
4. Click Import Users.
5. Click Generate Key.
6. Copy and save the Base URL.
7. Copy and save the API Key (API token).

Create an Enterprise Application

1. Navigate to https://entra.microsoft.com and sign in.
2. In the left navigation menu under Identity, select Applications.
3. Select Enterprise applications.
4. Click New application, then click Create your own application.
5. Enter a name for your app (for example, Backblaze SCIM).
6. Select Integrate any other application you don't find in the gallery (Non-gallery). 
7. Click Create.

Configure Provisioning

1. Sign in to your Azure Entra admin center.
2. In the left navigation menu under Identity, select Applications.
3. Select Enterprise applications.
4. Under Manage, click Provisioning.
5. Click Get started.
6. For Provisioning Mode, select Automatic.
7. Enter Admin Credentials.
   1. Tenant URL: Enter the Base URL that you copied in the “Generate an API Token” task.
   2. Secret Token: Enter the API Key that you copied in the “Generate an API Token” task. 
   3. Click Test Connection to ensure Microsoft Entra ID can successfully connect to the Backblaze SCIM endpoint.
      If the connection is successful, the Mappings section will appear.
8. Configure Mappings.
   1. Ensure that Provision Microsoft Entra ID Users is enabled.
   2. Click Provision Microsoft Entra ID Groups.
   3. Set the Enabled toggle to No.
   4. Click Save, then click Yes to confirm.
9. In the Settings menu, Backblaze recommends that you select Sync only assigned users and groups as the Scope.
10. Set the Provisioning Status toggle to On.
11. Click Save.

Assign Users to the SCIM Configuration

1. Sign in to your Azure Entra admin center.
2. In the left navigation menu under Identity, select Applications.
3. Select Enterprise applications.
4. Select the application for which SCIM provisioning is configured.
5. Select Users and groups.
6. Click Add user/group.
7. Click Users to open the list of available users.
8. Select the user(s) or user group(s) you want to assign to the SCIM configuration.
9. Click Select.
10. Click Assign.

Rotate a SCIM Key

1. Sign in to your Backblaze organization.
2. In the left navigation menu under Access Control, select Org Users.
3. Select the Identity Provider tab.
4. Click Edit.
5. Click Generate Key.
6. Repeat step 6 in the "Configure Provisioning" task to update the API in Azure Entra.
7. Click(delete) to remove the old key.
8. Click OK.