CamperDocs
Open app

Directory

Entra ID setup

Entra ID (formerly Azure AD) provisions your workforce into Camper over SCIM. Users become identities, groups become team org units, and the roles attribute elevates dashboard operators.

1. Get your Camper SCIM endpoint

  1. In Camper, open Settings → Identity Providers.
  2. Copy the Base URL (https://api.…/scim/v2).
  3. Click Generate token and copy the bearer token — it is shown once.

2. Create the enterprise application

  1. In the Entra admin center, go to Enterprise applications → New application → Create your own application and pick Integrate any other application you don't find in the gallery.
  2. In the app, open Provisioning → Get started and set:
    • Provisioning Mode: Automatic
    • Tenant URL: the Base URL from step 1
    • Secret Token: the token from step 1
  3. Click Test Connection, then Save.

3. Scope who syncs

Under Provisioning → Settings, set Scope to Sync only assigned users and groups, then assign users/groups on the Users and groups tab.

Important — Assignment Required. On the app's Properties tab, set Assignment required? to Yes. Entra defaults it to No, which lets any user in your directory authenticate against the app even when they were never assigned to it. With SCIM this mostly governs later SSO behavior, but setting it now avoids surprises when sign-in (SSO) is layered on.

4. Attribute mappings

The default Entra SCIM mappings work with Camper out of the box:

  • userPrincipalName → userName, mail → emails[type eq "work"].value
  • displayName → displayName
  • department (and other org attributes) ride along in the profile and drive Camper's hierarchy placement via the Attribute map under Settings → Mappings. Enterprise-extension attributes (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department) are understood — plain keys or full paths both work.

Accounts without email. Entra allows users with no email address. Camper requires an email (it is the identity's stable contact and the operator login key) — users pushed without one are rejected and show up under recent rejected pushes under Settings → Identity Providers.

5. Elevate operators (optional)

Map an attribute to the SCIM roles field (values: Admin, Member, Viewer, Owner) for people who should operate the Camper dashboard.

6. Start provisioning

Set Provisioning Status to On. Entra's initial cycle can take up to 40 minutes; incremental cycles follow roughly every 40 minutes.

Verify

After the first cycle, check Camper:

  • People lists assigned users, placed on the hierarchy.
  • Settings → Identity Providers shows Last push received and identity/group counts.

Offboarding

Entra soft-deletes on unassign/disable (SCIM active=false → identity suspended) and hard-deletes ~30 days later (SCIM DELETE → identity deprovisioned). Either way, operator memberships and live dashboard sessions are revoked immediately when the push arrives. For faster revocation than Entra's cycle cadence, remove the user from Camper's People page too.

Gotchas

  • Entra sends group membership as incremental PATCH operations and group renames as displayName replaces — both are handled; renamed groups keep their unit, members, and resource links.
  • Restart provisioning in Entra clears its sync watermark and re-pushes everything; safe for Camper (upserts by externalId), just noisy.