User Provisioning with Entra ID

This document provides step-by-step instructions to create a Netskope SCIM app on Microsoft Entra ID for provisioning users to your Netskope tenant.

Before You Begin

Ensure that you have the following before you begin creating the Netskope SCIM app.

• If your Netskope tenant is hardened using IP Allowlist (Settings > Administration > IP Allowlist), then ensure that you add the respective source IP addresses of your IdP to the Custom IP list.

• Global admin access to Microsoft Entra ID admin console.

• Obtain the SCIM Base URL and SCIM token from your tenant.

Creating Netskope SCIM App on Microsoft Entra ID

Log in to your Microsoft Entra admin center (https://entra.microsoft.com) with global admin credentials and follow these steps:

1. Go to Applications > Enterprise Applications. Click New Application.

   

2. Search for Netskope User Authentication.

   

3. Enter a Name, for example, Netskope User Provisioning, and click Create.

   

4. Click Provision User Accounts.

   

5. Click Get Started.

   

6. Click New Configuration.

   

7. Select Provisioning Mode as Automatic and enter the following:

   • Tenant URL: Enter  https://<tenant-name>.goskope.com/api/v2/scim

   • Secret Token: Enter the RBAC v3 token generated via a Service Account.

     See the SCIM Settings for User Provisioning topic for steps to generate token and get the REST API v2 URL.

   • 

     Test the connection before saving the configuration; otherwise, an error will occur during the save process.

8. In the Entra admin center, Click Save.

9. Next set Provisioning Status to ON and click Save.

   The Default SCIM Mappings and Provisioning Scopes are listed under Mappings. You can click on the mappings to view details.

   

10. Under the Settings tab, if required select the option to send email notifications (optional) and set the scope to Sync only assigned users and groups.

    

11. Next, add users and groups to provision to the Netskope tenant. Select Users and Groups and select Add user.

    

12. Select Users and Groups and then select the users and groups from the list and click Select.

13. Go back to the SCIM app Overview section to monitor the provisioning status.

    

    Entra initial sync, for SCIM Provisioning interval, is 40 minutes

14. Click View Audit Logs to view all account related events and click Provisioning Logs to view account provisioning status.

    

15. Check Microsoft Entra ID provisioned users in the Netskope UI under Settings > Security Cloud Platform > Users.

16. Check Microsoft Entra ID provisioned groups in the Netskope UI under Settings > Security Cloud Platform > Groups.

17. The Microsoft Entra ID provisioned Users & Groups will also be available for selection in Real-time Protection

    The SCIM configuration is complete.