CamperCamperDocs
Open app

Directory

Entra ID setup

Microsoft Entra ID (formerly Azure AD) provisions your workforce into Camper over SCIM. Users become identities, groups become team org units, and the roles attribute elevates dashboard operators.

Directory vs Microsoft 365 target. This page is about people entering Camper. Connecting Microsoft 365 under Connections is a separate step for Teams / SharePoint / channel membership downstream — not Entra security groups.

Prerequisites

  • Owner or admin in Camper
  • Permission to create enterprise applications and manage provisioning in Entra
  • Users you sync should have an email Camper can use as identity contact

Summary of steps

  1. Copy SCIM Base URL and token from Camper
  2. Create an enterprise application and enable automatic provisioning
  3. Assign users/groups and set Assignment required
  4. Confirm attribute mappings (and optional custom attributes)
  5. Optionally map roles for operators
  6. Turn provisioning on and verify

1. Get your Camper SCIM endpoint

  1. In Camper, open Settings → Identity Providers.
  2. Copy the Base URL (https://api.…/scim/v2).
  3. Click Generate token and copy the bearer token — shown once.

2. Create the enterprise application

  1. In the Entra admin center, go to Enterprise applications → New application → Create your own application and choose Integrate any other application you don't find in the gallery.
  2. Open Provisioning → Get started and set:
    • Provisioning Mode: Automatic
    • Tenant URL: the Base URL from step 1
    • Secret Token: the token from step 1
  3. Click Test Connection, then Save.

3. Scope who syncs

Under Provisioning → Settings, set Scope to Sync only assigned users and groups, then assign users/groups on the Users and groups tab.

Assignment required. On the app’s Properties tab, set Assignment required? to Yes. Entra defaults it to No, which lets any directory user authenticate against the app even when they were never assigned. With SCIM this mostly governs later SSO behaviour — set it now to avoid surprises.

4. Attribute mappings

Default Entra SCIM mappings work with Camper out of the box:

  • userPrincipalName → userName, mail → work email
  • displayName → displayName
  • department drives the default Department axis on a new workspace

Enterprise-extension attributes are understood with plain keys or full paths.

To slice the org by anything else, add the attribute to Entra’s target list and map a value into it: Custom attributes → Microsoft Entra ID. Then build the axis from Catalog → New axis.

Accounts without email. Entra allows users with no email. Camper requires one — those pushes are rejected and appear under recent rejected pushes on Settings → Identity Providers.

5. Elevate operators (optional)

Map an attribute to SCIM roles:

WhoValue
People who run CamperAdmin
Everyone elseViewer or leave empty

Do not map Owner. Details: Roles.

6. Start provisioning

Set Provisioning Status to On. Entra’s initial cycle can take up to 40 minutes; incremental cycles follow on a similar cadence. Use Provision on demand to test a single user immediately.

Verify

After the first cycle:

  • People lists assigned users, placed on the hierarchy when attributes match
  • Settings → Identity Providers shows Last push received and identity/group counts

Offboarding

Entra soft-deletes on unassign/disable (active=false → identity suspended) and hard-deletes later (SCIM DELETE → deprovisioned). Operator memberships and live dashboard sessions for this workspace are revoked when the push arrives.

Gotchas

  • Group membership often arrives as incremental PATCH operations; renames keep the same unit, members, and resource links.
  • Restart provisioning in Entra re-pushes everything — safe for Camper (upserts), just noisy.
  • If you later connect Microsoft 365 as a target, keep exclusive ownership of membership on objects Camper manages — see Microsoft 365.