User provisioning with SCIM

Automatically provision and deprovision Soda Cloud users and user groups from Microsoft Entra ID with SCIM

Soda Cloud supports user provisioning through SCIM (the System for Cross-domain Identity Management). With SCIM enabled, your identity provider manages Soda Cloud users for you: when someone joins your organization, Entra ID creates their Soda Cloud account, and when they leave, their access is revoked in the same sync. Your IT team administers Soda Cloud access from the identity provider they already use, with no manual user management in Soda Cloud.

SCIM provisioning is an opt-in feature available to organizations with a Soda Enterprise plan. To enable it, contact Soda Support at [e-mail].

Prerequisites

• A Soda Cloud organization (Enterprise license) with SCIM provisioning enabled.
• The Manage organization settings permission. See Global and dataset roles.
• Administrator access to your tenant in Microsoft Entra ID.

Generate a SCIM token in Soda Cloud

Entra ID authenticates against Soda Cloud with a bearer token that you generate in your organization settings.

1

Open the SCIM tab

In Soda Cloud, navigate to your avatar→ Organization Settings, then open the SCIM tab.

Navigate to the SCIM tab on your org settings to see all available actions and configurations.

2

Generate the token

Click Generate token. Soda Cloud generates a new token and displays it once.

After clicking on "Generate token", Soda will display a randomly generated token.

3

Copy and store the token

Copy the token and store it securely, then click Done.

After you click Done, Soda Cloud never displays the token again. If you lose the value, you can regenerate the token (see below).

Regenerate token

Soda Cloud never displays a generated token after leaving the bearer token screen. If you lose the value, click Regenerate token; this deletes the previous token and replaces it with a new one, so any existing SCIM connection that uses the old token stops working until you update it.

Click on "Regenerate token" to delete previous token and replace it with a new one.

Configure SCIM in Entra ID

This step must be performed by an Azure Entra ID administrator in your organization.

1

Open provisioning for the application

In the Microsoft Entra admin center, navigate to Enterprise applications, then select the application that represents your Soda Cloud organization.

2

Start the connection flow

Select Provisioning, then start the flow by selecting Connect your application.

3

Configure the provisioning connection

Configure the provisioning connection as follows:

Authentication method	Bearer authentication
Tenant URL	Soda EU: https://cloud.soda.io/scim/v2 Soda US: https://cloud.us.soda.io/scim/v2
Secret token	Paste the SCIM token you generated in Soda Cloud.

4

Test the connection

Click Test connection and verify that the connection test succeeds.

Verify that provisioning works

This step must be performed by an Azure Entra ID administrator in your organization, and a Soda Cloud user with Manage organization settings permission.

Verification using provision on demand

The quickest way to confirm the integration is Entra ID's provision on demand, which syncs a single user immediately instead of waiting for a scheduled provisioning cycle.

1

Provision a test user

Provision a test user on demand on Entra ID.

2

Confirm user

Confirm in Soda Cloud that the user appears in Organization Settings under the Users tab.

Verification using the full provisioning

Once regular provisioning runs, you can observe synced users and their actions, such as "Create" or "Disable", in the Entra ID provisioning logs.

Entra ID runs provisioning on its own schedule, so changes to users and user groups in your identity provider can take some time to appear in Soda Cloud; refer to Microsoft's documentation for details on the provisioning cycle.

The Entra ID provisioning logs will expose the actions taken for each user

In Soda Cloud, the Users and User Groups tabs in Organization Settings display a Managed by SCIM column that identifies which users and user groups are provisioned through your identity provider.

The column managed by SCIM appears when SCIM provisioning is enabled and working.

For single sign-on setup, refer to User and user group management with SSO.

For details on the roles and permissions of provisioned users, refer to Global and dataset roles.

---

Limitations

Soda has tested and documented SCIM provisioning with Microsoft Entra ID. It is currently the only supported identity provider for SCIM.