Use Azure Active Directory (Azure AD) SCIM provisioning with Front to fine-tune control of your users in Front.

You can: 

• Automatically create users in Front.

• Automatically block users when the Azure AD profile is suspended.

• Sync Azure AD Groups to teammate groups in Front.

• Create a user from a teammate template.

To set up user provisioning with Azure AD, you must be a Front company admin.

You’ll need to create a Front API token to complete the setup process in your Azure portal.

Step 1

In Front, follow the steps on this article to create an API token.

Step 2

On Step 5 of creating a token, select the Provisioning and Auto-Provisioning Scopes.

Step 3

Click Create.

Step 4

Click Copy next to the API token field to add the token to your clipboard.

Step 5

Your token can now be pasted into your Azure portal.

Step 1

Follow these steps as defined by Microsoft to create a “non-gallery application” that will be able to provision from Azure AD.

Step 2

In Step 7 of Microsoft’s instructions, enter the URL for Front’s SCIM endpoint in the Tenant URL field: https://scim.frontapp.com/v2/

Step 3

In Step 8 of Microsoft’s instructions, paste your Front API token in the Secret Token field. 

Step 4

Click the Test Connection button to confirm Azure AD connects with Front. Click Save when finished.

Step 5

In your Azure portal, select Provisioning in the left panel, then click Edit attribute mappings.

Step 6

In the Mappings section, click Provision Azure Active Directory Users.

Step 7

You will see a list of Azure Active Directory Attributes and their corresponding Front SCIM API fields (customappsso Attributes). We recommend configuring your field mapping like the screenshot below. Delete any Attributes omitted from this list.

There are 4 main adjustments you will need to make that deviate from the defaults.

Adjustment 1: Add the ToLower function onto the active field mapping.

Adjustment 2: Change the mail Azure Active Directory Attribute to userPrincipalName.

Before

After

Adjustment 3: Click into the mailNickname mapping, and ensure the field is only applied on object creation.

Adjustment 4: Navigate to the advanced options section of the attribute mapping portal. Set externalId as required.

Step 8

In your Azure portal, select Users and Groups in the left panel.

Step 9

Select Add User/Group, then click None Selected.

Step 10

Identify a net new user to be added to Front. If the user already existed in Front and was deleted this will likely cause an error.

Step 11

Select the user, then click Assign at the bottom left of the screen.

Step 12

Click back to the Provisioning section of your Azure portal, then click Start provisioning.

Step 13

By default, the provisioning cycle runs once every 40 minutes. Check the provisioning logs to verify successful provisioning. Ideally we something like the screenshot below. 

You can also confirm whether a user was successfully provisioned in Front via the Teammates tab in your company settings.

You can apply teammate templates to a user or Group in Azure AD when they are provisioned in Front. Teammate templates allow you to set a new user’s default values for several fields including:

• Workspace and inbox access

• Custom fields

• User preferences

Teammate templates can only be used upon initial user creation. A template cannot be applied to an existing user, and users will not stay in sync with edits to the template.

It is assumed that user provisioning from Azure AD has already been set up per the steps in Parts 1-3.

Create teammate templates

Step 1

In Front, create at least two teammate templates as explained in this article. It is necessary to create two templates due to a limitation of Azure AD. If you only require one template, we recommend creating a dummy template just for the purpose of the integration.

Step 2

For each template, take a note of the template ID in the Overview tab.

Create app roles

Step 3

In Azure Active Directory, navigate to App registrations in the left panel and go to the All applications tab. Click on your Front application.

Step 4

In the left panel, navigate to App roles. You will need to create an app role for each teammate template. To do this, click Create app role.

Step 5

Enter the following values in the Create app role form:

1. Display name: Enter the name of the role followed by a colon and then the template ID, as described in Step 2. For example, if the template is called ‘Support squad’ and the template ID is tea_6nvkx, then enter the display name ‘Support squad: tea_6nvk’.

2. Allowed member types: User/Groups

3. Value: The template ID again

4. Description: Free text. We recommend including the name of the template given in Front as part of the description.

5. Do you want to enable this app role?: Yes

Step 6

Click the Apply button to finish creating the app role. Follow Steps 3-5 again for each template. You must create at least two app roles as explained in Step 1.

Set up attribute mappings

Step 7

Navigate back to the Azure Active Directory home. Click Enterprise applications and select your app. In the left panel, navigate to Provisioning, then click on Edit provisioning.

Step 8

In the Mappings section, click Provision Azure Active Directory Users.

Step 9

Scroll down the page, and select Show advanced options. Then click Edit attribute list for custommapsso.

Step 10

At the bottom of the table, add a new item:

1. Name: urn:ietf:params:scim:schemas:extension:frontapp:teammate:template

2. Type: String

3. All other fields: Leave blank

Step 11

Click Save to return to the attribute mapping page. At the bottom of the Attribute Mappings table, click Add New Mapping.

Step 12

In the Edit Attribute form, enter the following information:

1. Mapping type: Expression

2. Expression: SingleAppRoleAssignment([appRoleAssignments])

3. Default value: Leave blank

4. Target attribute: Select urn:ietf:params:scim:schemas:extension:frontapp:teammate:template

5. Match objects using this attribute: No

6. Apply this mapping: Only during object creation

Step 13

Save this new attribute and confirm. The attribute mapping is now complete.

Apply template to teammates

The final task is to apply the template to the desired teammates. This can be done be either applying the role created earlier to a user or to a Group. We recommend using Groups to assign templates, as new users added to the Group in Azure AD will automatically be provisioned with the correct template in Front.

Step 14

Navigate back to the Azure Active Directory home, then to Enterprise applications and select your app. In the left panel navigate to Users and Groups.

Step 15

Select the checkbox on the left of the users/Groups you want to assign the template to, and then click Edit assignment.

Step 16

Click on the text under Select a role (e.g. click None Selected). A panel will appear on the right hand side. Select the template ID of the template you want to assign to these users/Groups, then click Select at the bottom of this panel to confirm.

Step 17

Click on Assign at the bottom of the page. The template has now been assigned to the user/Groups.

You can test that the set up is successful by checking the logs after the next sync. You can also use Azure AD’s Provision on demand function, to test the provisioning immediately.

See this article for more information about syncing Groups from an Identity Provider, like Azure AD, to Front.

Warning: If you are pushing an Azure AD group to sync with an existing teammate group in Front, you must first check that all members of the teammate Group in Front are also members of the corresponding Azure AD group. This ensures that the group members will stay fully in sync following the initial override. It is fine if there are members of the Azure AD group who do not already belong to the Front teammate group.

Step 1

In Front, navigate to Company settings. Click on Teammates, then go to the User provisioning tab.

Step 2

Toggle on Enable Teammate Group Sync from your Identity Provider.

Step 3

From your Azure AD portal, navigate to Home then click Enterprise applications and select your app. In the left panel, navigate to Provisioning, then click on Edit provisioning.

Step 4

In the Mappings section, click Provision Azure Active Directory Groups.

Step 5

Make sure you have the following settings:

1. Enabled: Yes

2. Target object actions: Create, Update, Delete

Step 6

Once this is done, any Groups assigned to the Front application will not only provision access to Front for the members of that Group, but will also push the Azure AD Group to Front as a teammate group. See Part 3 of our Azure AD article, for instructions on assigning an Azure AD Group to your Front application.

If there already exists a teammate group in Front with the same name, that teammate group will now be synced to the Azure AD Group and will become an IdP-managed Group in Front, as described here. Otherwise, a new teammate group will be created in Front synced to the Azure AD group.

Step 1

Navigate back to the Azure Active Directory home. Click Enterprise applications and select your app. In the left panel, navigate to Provisioning, then click on Edit provisioning.

Step 2

Scroll down the page, and select Show advanced options. Then click Edit attribute list for custommapsso.

Step 3

At the bottom of the table, add a new item with the following fields:

1. Name: urn:ietf:params:scim:schemas:extension:frontapp:group:description

2. Type: String

3. All other fields: Leave blank

Step 4

Click Save to return to the attribute mapping page. At the bottom of the Attribute Mappings table, click Add New Mapping.

Step 5

In the Edit Attribute form, enter the following information:

1. Mapping type: Direct

2. Source attribute: description

3. Target attribute: urn:ietf:params:scim:schemas:extension:frontapp:group:description

4. Match objects using this attribute: No

5. Apply this mapping: Always

You can remove a user from your custom application portal in Azure AD. This will block the teammate account in Front.

Step 1

Open your Azure portal, then click Users and groups in the left panel.

Step 2

Check the box next to the user you’ve like to remove, then click Remove. 

This is effectively a soft delete, so the user will appear as Blocked in your instance of Front and their session will be immediately invalid once the next provisioning cycle completes.

This user’s Front license can now be assigned to someone else.

When you remove access to Front from Azure AD for a specific teammate, that teammate will be blocked. Should you re-authorize access to Front, the teammate will be unblocked automatically. Azure AD does not allow deleting via the integration, so users in Front are blocked, even if they are deleted in Azure AD.

Azure AD does not allow deleting via the integration, so users in Front are blocked, even if they are deleted in Azure AD.

SCIM provisioning is available on the Scale plan or above. Some legacy plans may also have this feature.