User provisioning with Azure Active Directory (Azure AD)
Use Azure Active Directory (Azure AD) SCIM provisioning with Front to fine-tune control of your users in Front.
- Automatically create users in Front.
- Automatically block users when the Azure AD profile is suspended.
To set up user provisioning with Azure AD, you must be a Company Admin.
Create a Front API token
You’ll need to create a Front API token to complete the setup process in your Azure portal.
In Front, follow the steps on this article to create an API token.
On Step 5 of creating a token, select the Provisioning and Auto-Provisioning Scopes.
Click Copy next to the API token field to add the token to your clipboard.
Your token can now be pasted into your Azure portal.
Part 1: Connect Front to Azure AD
Follow these steps as defined by Microsoft to create a “non-gallery application” that will be able to provision from Azure AD.
In Step 7 of Microsoft’s instructions, enter the URL for Front’s SCIM endpoint in the Tenant URL field: https://scim.frontapp.com/v2/
In Step 8 of Microsoft’s instructions, paste your Front API token in the Secret Token field.
Click the Test Connection button to confirm Azure AD connects with Front. Click Save when finished.
Part 2: Edit attribute mappings
In your Azure portal, select Provisioning in the left panel, then click Edit attribute mappings.
In the Mappings section, click Provision Azure Active Directory Users.
You will see a list of Azure Active Directory Attributes and their corresponding Front SCIM API fields (customappsso Attributes). We recommend configuring your field mapping like the screenshot below. Delete any Attributes omitted from this list.
There are 4 main adjustments you will need to make that deviate from the defaults.
Adjustment 1: Add the ToLower function onto the active field mapping.
Adjustment 2: Change the mail Azure Active Directory Attribute to userPrincipalName.
Adjustment 3: Click into the mailNickname mapping, and ensure the field is only applied on object creation.
Adjustment 4: Navigate to the advanced options section of the attribute mapping portal. Set externalId as required.
Part 3: Select users or groups to sync
In your Azure portal, select Users and Groups in the left panel.
Select Add User/Group, then click None Selected.
Identify a net new user to be added to Front. If the user already existed in Front and was deleted this will likely cause an error.
Select the user, then click Assign at the bottom left of the screen.
Click back to the Provisioning section of your Azure portal, then click Start provisioning.
By default, the provisioning cycle runs once every 40 minutes. Check the provisioning logs to verify successful provisioning. Ideally we something like the screenshot below.
You can also confirm whether a user was successfully provisioned in Front via the Teammates tab in your company settings.
Part 4: Provisioning with templates (optional)
You can apply teammate templates to a user or Group in Azure AD when they are provisioned in Front. Teammate templates allow you to set a new user’s default values for several fields including:
- Team and inbox access
- Custom fields
- User preferences
Teammate templates can only be used upon initial user creation. A template cannot be applied to an existing user, and users will not stay in sync with edits to the template.
It is assumed that user provisioning from Azure AD has already been set up per the steps in Parts 1-3.
Create teammate templates
In Front, create at least two teammate templates as explained in this article. It is necessary to create two templates due to a limitation of Azure AD. If you only require one template, we recommend creating a dummy template just for the purpose of the integration.
For each template, take a note of the template ID in the Overview tab.
Create app roles
In Azure Active Directory, navigate to App registrations in the left panel and go to the All applications tab. Click on your Front application.
In the left panel, navigate to App roles. You will need to create an app role for each teammate template. To do this, click Create app role.
Enter the following values in the Create app role form:
- Display name: The template ID, as described in Step 2
- Allowed member types: User/Groups
- Value: The template ID again
- Description: Free text. We recommend including the name of the template given in Front as part of the description.
- Do you want to enable this app role?: Yes
Click the Apply button to finish creating the app role. Follow Steps 3-5 again for each template. You must create at least two app roles as explained in Step 1.
Set up attribute mappings
Navigate back to the Azure Active Directory home. Click Enterprise applications and select your app. In the left panel, navigate to Provisioning, then click on Edit provisioning.
In the Mappings section, click Provision Azure Active Directory Users.
Scroll down the page, and select Show advanced options. Then click Edit attribute list for custommapsso.
At the bottom of the table, add a new item:
- Name: urn:ietf:params:scim:schemas:extension:frontapp:teammate:template
- Type: String
- All other fields: Leave blank
Click Save to return to the attribute mapping page. At the bottom of the Attribute Mappings table, click Add New Mapping.
In the Edit Attribute form, enter the following information:
- Mapping type: Expression
- Expression: SingleAppRoleAssignment([appRoleAssignments])
- Default value: Leave blank
- Target attribute: Select urn:ietf:params:scim:schemas:extension:frontapp:teammate:template
- Match objects using this attribute: No
- Apply this mapping: Only during object creation
Save this new attribute and confirm. The attribute mapping is now complete.
Apply template to teammates
The final task is to apply the template to the desired teammates. This can be done be either applying the role created earlier to a user or to a Group. We recommend using Groups to assign templates, as new users added to the Group in Azure AD will automatically be provisioned with the correct template in Front.
Navigate back to the Azure Active Directory home, then to Enterprise applications and select your app. In the left panel navigate to Users and Groups.
Select the checkbox on the left of the users/Groups you want to assign the template to, and then click Edit assignment.
Click on the text under Select a role (e.g. click None Selected). A panel will appear on the right hand side. Select the template ID of the template you want to assign to these users/Groups, then click Select at the bottom of this panel to confirm.
Click on Assign at the bottom of the page. The template has now been assigned to the user/Groups.
You can test that the set up is successful by checking the logs after the next sync. You can also use Azure AD’s Provision on demand function, to test the provisioning immediately.
Remove a user
You can remove a user from your custom application portal in Azure AD. This will block the teammate account in Front.
Open your Azure portal, then click Users and groups in the left panel.
Check the box next to the user you’ve like to remove, then click Remove.
This is effectively a soft delete, so the user will appear as Blocked in your instance of Front and their session will be immediately invalid once the next provisioning cycle completes.
This user’s Front license can now be assigned to someone else.
What happens when I remove access to Front from Azure AD?
When you remove access to Front from Azure AD for a specific teammate, that teammate will be blocked. Should you re-authorize access to Front, the teammate will be unblocked automatically. Azure AD does not allow deleting via the integration, so users in Front are blocked, even if they are deleted in Azure AD.
What happens when someone is deleted from Azure AD?
Azure AD does not allow deleting via the integration, so users in Front are blocked, even if they are deleted in Azure AD.
SCIM provisioning is available on the Scale plan. Some legacy plans with different names may also have this feature.