Configuring SCIM establishes a secure connection between your LogicMonitor portal and a supported identity provider (IdP). After you configure SCIM, your identity provider can automatically deprovision users in LogicMonitor. This automation helps ensure that user access is removed consistently when user accounts are disabled or deleted in the identity provider.

IDP Partners for SCIM

LogicMonitor supports SCIM integration with the following identity providers:

• Microsoft Entra ID
  For more information on configuring SCIM, see System for Cross-domain IdentiConfiguring the LogicMonitor Microsoft Entra ID SCIM Integration
• Okta
  For more information on configuring SCIM, see Create SCIM integrations with the App Integration Wizard.
• OneLogin
  For more information on configuring SCIM, see Create a SCIM application

Requirements for Configuring SCIM

To configure SCIM, you need the following:

• A LogicMonitor user with the Manage Single Sign On permissions to configure authentication and user management settings.
• Administrative access to your identity provider.

Configuring SCIM

Use the following procedure to configure SCIM in your LogicMonitor portal.

1. In LogicMonitor, navigate to Settings > Single Sign On.
2. On the Single Sign On page, select the Edit icon for the identity provider.
3. Toggle the Enable SCIM switch.

4. Select Save IDP.
5. Select Save.
   LogicMonitor saves the SSO configuration.
6. On the SCIM tab, select Add SCIM provisioning.
   The provisioning page displays.

7. From the IDP drop-down menu, select the identity provider.
8. Copy the SCIM Token.
   LogicMonitor generates a SCIM token for the selected identity provider.
   
   Note: Save the SCIM token in a secure location. You need the token to complete the configuration for your identity provider. If you lose the token, you must generate a new one.
9. In the Note field, enter a description for the SCIM configuration.
10. Select Save.
    LogicMonitor saves the SCIM configuration. 

Configuring the LogicMonitor Microsoft Entra ID SCIM Integration

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Enterprise applications and select + New application.
3. Select + Create your own application.
4. In the application name field, enter a descriptive name, such as LogicMonitor SCIM.
5. Select Integrate any other application you do not find in the gallery (Non-gallery).
6. Select Create.
7. On the Provisioning page, select + New configuration.
8. In the Admin Credentials section, enter the following information:
   • In the Tenant URL field, enter your LogicMonitor SCIM endpoint URL.
     Example: https://<companyname>.logicmonitor.com/santaba/rest/scim
   • In the Secret Token field, enter the LogicMonitor SCIM bearer token.
9. Select Test Connection to verify that Microsoft Entra ID can connect to the LogicMonitor SCIM endpoint.
10. If the connection test succeeds, select Save or Create, depending on your Microsoft Entra ID interface.
11. On the Provisioning page, expand Mappings, and then select Provision Microsoft Entra ID Users.
12. In the Target Object Actions section, ensure that Create, Update, and Delete are enabled.Microsoft Entra ID manages user deactivation by updating the SCIM active attribute to false.
13. Review the attribute mappings.
14. Remove any default attribute mappings that LogicMonitor does not support to prevent provisioning errors.
15. Configure the primary identifier mapping.
    • Map the Microsoft Entra ID userPrincipalName attribute to the LogicMonitor SCIM userName attribute.
    • If your SAML configuration uses a different unique identifier, map that same attribute to the SCIM userName attribute so that both SAML and SCIM use the same identity value.
16. Select Save after completing the attribute mappings.
17. Navigate to Users and groups.
18. Select + Add user/group.
19. Select the users or groups that you want Microsoft Entra ID to provision to LogicMonitor.
20. Select Assign.
21. Return to the Provisioning page.
22. Set Provisioning Status to On.Depending on your Microsoft Entra ID interface, you might need to select Overview, and then select Start provisioning.
23. Select Save.

Microsoft Entra ID automatically runs a provisioning synchronization cycle approximately every 40 minutes after provisioning is enabled.

If you want to validate the integration immediately, use the Provision on demand feature on the Provisioning page to synchronize a specific user without waiting for the next scheduled synchronization cycle.