# Entra ID
To set up SCIM in Entra ID for BirdCRM, you first need to establish the SCIM connection and settings. After that, you’ll configure Push Groups to link BirdCRM Groups with that assigned role(s) roles for user provisioning.
This section is divided into four parts:
1. [BirdCRM Steps for SCIM Configuration](#birdcrm-steps-for-scim-configuration)
2. [Entra ID configuration](#entra-id-configuration)
3. [Group-based Role Assignment](#group-based-role-assignment)
4. [BirdCRM Final step](#birdcrm-final-step)
### BirdCRM Steps for SCIM Configuration
1. Navigate to the **SCIM Settings** page which is available [here](https://app.bird.com/settings/security/scim-settings) or go by visiting **Settings** > **Security** > **SCIM Settings**.
2. Copy the **SCIM Base URL** by clicking “Copy” next to it. You’ll need this URL for the Entra ID setup in the next section.
3. Click on **Add new access key** and fill out a meaningful **Name** and **Description** and click **Save**.
4. Once your Access Key appears, copy it and save it securely. You won’t be able to view it again, and you’ll need it to configure Entra ID later.
### Entra ID configuration
1. To enable SCIM provisioning of users, you’ll need to set up an **Enterprise Application** in Entra ID. If you haven’t created this application yet, please refer to the [Entra ID SSO section](https://docs.bird.com/applications/~/changes/SidqSnOUVNHmcp2wkLG7/account-and-billing/account/organization-settings/single-sign-on-sso/entra-id).
2. From the Overview page of your BirdCRM Enterprise Application, click on **3. Provision User Accounts** followed by **Get Started**.
3. Change the **Provisioning Mode** to **Automatic** and copy the SCIM Base URL from **Step 2** and paste into the **Tenant URL**.
4. Copy the **Access Key** you created in the previous section into the **Secret Token**. Click on **Test Connection** to make sure the setup works. If the data entered is correct you will receive a success message and be able to click **Save**.
4. Once the settings have saved you will be able to expand the **Mappings** section. Click on **Provision Microsoft Entra ID Users**.
5. Scroll to the **Attribute Mappings** and remove all attributes except for **userName, active, and displayName** as shown in the screenshot below:
6. Click on **Save** and return to your **Enterprise Application**. You can now turn **Provisioning Status** to **On** and assign users and groups to the application which will be created in your BirdCRM organization.
{% hint style="info" %}
At this stage SCIM is technically set up and users can be assigned the application via an **Individual** or **Group assignment** and will be created in your organization. They will not be assigned with a role though and would need one manually applied to be able to login. In order to automatically assign a role or roles to your users you can setup **Push Groups** and **Groups** in BirdCRM.
{% endhint %}
### Group-based Role Assignment
Group-based Role Assignments offer flexibility in managing users’ access to BirdCRM. \
You can scope roles to one or more workspaces and create granular access which is automatically managed via Entra ID.
In order to set up Group-based Role Assignment, you first need to push any groups to BirdCRM Groups and then assign the roles you would like per Group. Once you have the roles setup any users you add to the synced Entra ID groups will automatically receive the roles defined on the BirdCRM Groups.
#### Entra ID Steps
1. First, verify that you have the **Provision Microsoft Entra ID Group**s enabled under Mappings.
2. Any groups that are assigned access to the application in **Entra ID** will have a synced BirdCRM Group created. As an example below, the BirdCRM Marketing Team group in **Entra ID** is assigned to the BirdCRM Enterprise Application with SCIM enabled.
3. A group with the same name is created in BirdCRM
4. You can assign multiple groups to the application in **Entra ID** depending on your access control needs.
### BirdCRM Final step
1. Navigate to the **Groups** section of the Organization tab in Settings which is available [here](https://app.bird.com/settings/organization/groups).
2. Click on the **Group** you would like to assign a role or multiple roles to and click **View group**.
3. Here you will see the Group overview including roles and group members. In order to add a role to the **Group**, click on **Add new role**, select a **Role** from the available choices and optionally select one or more **Workspaces** to restrict the role access to.
4. You can add multiple roles to the Group by continuing to click **Add new role** and selecting a **Role** and optionally one or more Workspaces to restrict the access to.
5. Click on **Update** and the roles will then be assigned to any Users of the Group.
{% hint style="success" %}
Any new users that are added to the linked Entra ID group will then get added to the BirdCRM Group and receive the associated roles.
{% endhint %}
