Applies to: OnCAFE, Microsoft Entra, SCIM provisioning

Summary

Group mapping controls which OnCAFE cardholder groups are applied when users are provisioned from Microsoft Entra ID.

When a provisioned user belongs to a mapped Microsoft Entra group, OnCAFE can assign that user to the corresponding OnCAFE cardholder group or groups. This allows organizations to manage user group membership in Microsoft Entra while applying the correct access group assignments in OnCAFE.

This article explains how to configure Microsoft Entra group mappings in OnCAFE.

IMPORTANT: Group mapping must be configured in OnCAFE. If group mapping 
is not configured, users may still be provisioned into OnCAFE, but they 
may not receive the expected cardholder group assignments.

Prerequisites

Before configuring group mapping, confirm the following:

• The Microsoft Entra integration has been enabled in OnCAFE.
   
• The Microsoft Entra Enterprise Application has been created.
   
• Users or groups have been assigned to the Enterprise Application in Microsoft Entra.
   
• Provisioning credentials have been configured in Microsoft Entra.
   
• The Microsoft Entra group intended for mapping already exists.

Configuring Group Mapping in OnCAFE

To configure group mapping:

1. Log in to OnCAFE.
    
2. From the left-side navigation menu, select Organization > Integrations.
   
   
    
3. Locate the Microsoft Entra integration card and click View details.
   
   
    
4. Click Configuration. 
   
   
    
5. Click the Group Mapping tab.
   
   
      
6. Select or enter the Microsoft Entra security group information.
    

7. Select one or more OnCAFE cardholder groups to associate with the security group.

   NOTE: The Cardholder Group field is selectable and is populated based
   on the Cardholder Groups configured in OnCAFE.

8. If additional mappings are required, click Add another row 
    
9. Click Save when done.
   
   The Microsoft Entra group is mapped to the selected OnCAFE cardholder group or groups. When users from the mapped Microsoft Entra group are provisioned into OnCAFE, they can be assigned to the configured OnCAFE cardholder groups.

Group Mapping Example

In this example, users in the Engineering-Team Microsoft Entra group can be assigned to multiple OnCAFE cardholder groups after provisioning runs.

NOTE: If users were provisioned before group mapping was configured, run
Provision On Demand or wait for the next provisioning cycle. This information
is configured within the Entra application and should be known to the user as
the security group associated with the corresponding Cardholder Group.