Applies to: OnCAFE, Microsoft Entra

Summary

Microsoft Entra ID can be integrated with OnCAFE using SCIM provisioning to automatically create and maintain cardholder identities and cardholder group assignments.

This article provides an overview of the Microsoft Entra integration workflow and the required configuration tasks. Complete each task in the order shown before enabling production provisioning.

Deployment Considerations

Consider the following before deploying the integration:

• Entra provisioning may take up to 40 minutes to synchronize changes into OnCAFE.
   
• Mapped identity fields are controlled by Entra and should be updated in Entra, not manually in OnCAFE.
   
• If the Integration Token is regenerated, update the provisioning credentials in Microsoft Entra.
   
• Users must have valid OnCAFE access permissions through cardholder groups before access is granted.
   
• If users are provisioned but are not assigned to cardholder groups, review the group mapping configuration.

IMPORTANT: When using Microsoft Entra, identities are added as card holders,
not administrators. Identity roles must be configured manually after provisioning.

Refer to OnCAFE: How to Create and Manage System Roles

Integration Workflow

To integrate Microsoft Entra with OnCAFE:

1. Enable the Microsoft Entra integration in OnCAFE and open the integration settings.
   
   Refer to: Entra: How to Enable Integration
    
2. Generate and securely store the Integration Token. The token is required when configuring SCIM provisioning in Microsoft Entra. 
   
   Refer to: Entra: How to Generate an Integration Token
    
3. Create a Non-Gallery Enterprise Application. 
   
   Refer to: Entra: How to Create a Non-Gallery Enterprise Application
    
4. Assign the users and groups that should be provisioned into OnCAFE. Only users and groups assigned to the Enterprise Application are provisioned into OnCAFE. 
   
   Refer to: Entra: How to Assign Users or Groups to the Microsoft Entra Enterprise Application
    
5. Configure the provisioning credentials to connect Microsoft Entra to the OnCAFE SCIM endpoint. 
   
   Refer to: Entra: How to Configure Provisioning Credentials
    
6. Review the default Microsoft Entra user attribute mappings used during provisioning.
   
   Refer to: Entra: How to Review Microsoft Entra User Attribute Mapping
    
7. If credential import mapping is required, add the required credential attributes in Microsoft Entra and configure the appropriate attribute mappings. 
   
   Refer to: Entra: How to Add Identity Credential Attributes to Attribute Mapping
    
8. Configure group mappings between Microsoft Entra groups and OnCAFE cardholder groups. 
   
   Refer to: Entra: How to Configure Group Mapping in OnCAFE
    
9. If credential import mapping is used, configure the corresponding import mappings within OnCAFE. 
   
   Refer to: Entra: How to Configure Import Mapping in OnCAFE
    
10. Validate the integration by running Provision on demand to verify that users, attributes, credentials, and group assignments are imported correctly. 
    
    Refer to: Entra: How to Manually Provision a Microsoft Entra Group