Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

SCIM Integration with Microsoft Entra ID and Okta

The HPE Mist cloud uses OAuth 2.0 to integrate with Microsoft Entra ID (Azure AD) and Okta for secure user authentication and authorization. System for Cross-domain Identity Management (SCIM) integration enhances the authorization performance by enabling the Access Assurance cloud to maintain a locally synchronized repository of users and groups, reducing latency and dependency on external IdPs. Follow these steps to integrate SCIM with Entra ID or Okta.

The HPE Mist cloud integrates with external Identity Providers (IdPs) such as Microsoft Entra ID (Azure AD) and Okta using OAuth 2.0. With this integration, HPE Mist Networking Access Assurance manages the:

  • Authentication for EAP-TTLS and Admin-Auth

  • Authorization (retrieving user group information) for EAP-TLS, EAP-TTLS, and Admin-Auth through OAuth 2.0 connections to the IdPs

As the authentication and authorization operations involve real-time communication with external IdPs, each control-path call can introduce additional latency, affecting the overall response time for authentication and policy evaluation. It also adds a potential bottleneck and failure domain in cases where the IdP service is degraded.

To optimize the authorization process, HPE Mist Networking Access Assurance supports System for Cross-domain Identity Management (SCIM)-based integration with IdPs. A key benefit of SCIM-based integration is reduced latency during the authorization process.

The HPE Mist cloud utilizes SCIM to maintain a locally synchronized repository of user and group information for each customer organization. This repository enables the policy service to assess user group memberships and enforce authorization rules without requiring real-time lookups to the external IdP.

Note:

If the HPE Mist cloud encounters any error while retrieving group mapping from the SCIM data, it automatically reverts to the existing OAuth-based authorization by connecting to the external IdP.

Disabling SCIM will remove all synchronized user and group data and prevent any further synchronization from the IdP.

Prerequisites

Before you integrate SCIM, ensure to complete the following tasks:

  1. Integrate HPE Mist with the Microsoft Entra ID or Okta IdP. See Microsoft Entra ID Integration and Okta Integration for detailed instructions.

  2. Ensure that at least one client is onboarded with HPE Mist Networking Access Assurance before proceeding with the SCIM configuration.

  3. Enable SCIM provisioning in the IdP configuration. The SCIM Authentication Token and SCIM Base URL are automatically generated when you enable SCIM provisioning. These parameters are required for synchronizing user and group information from the IdP to HPE Mist Networking Access Assurance.

    HPE Mist management portal configuration interface for Azure OAuth setup and SCIM provisioning, showing fields for OAuth credentials, SCIM integration settings, and navigation options.

How to Integrate SCIM with Microsoft Entra ID

To Integrate SCIM with Microsoft Entra ID:
Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.
  1. Sign in to Microsoft Entra Admin Center, navigate to Enterprise applications, and then click New application.
    Enterprise applications section in Azure portal showing tools to manage applications including search, filters, and a highlighted New application button.
  2. Click Create your own application. Enter a name for the application and click Create.
    Microsoft Entra App Gallery interface for creating and managing applications, with options for SSO apps, cloud platforms, on-premises proxies, and a custom app form for integration.
  3. After the application is created, navigate to Provisioning under the Manage section and click New Configuration.
    Microsoft Azure portal interface for managing the Mist-AA-SCIM-Integration enterprise application, showing overview details, navigation menu, and provisioning highlighted.
    Microsoft Azure portal screenshot showing Mist-AA-SCIM-Integration provisioning overview with options to configure, manage, and start provisioning in preview mode.
  4. Enter the following details from the HPE Mist Networking Access Assurance IdP configuration:

    • Tenant URL—SCIM Base URL

    • Secret Token—SCIM Authentication Token

    Click Test Connection and verify that the test is successful. Then, click Create.

    Microsoft Azure interface for setting up provisioning configuration with fields for Tenant URL and Secret token. Notification indicates successful test connection for Mist-AA-SCIM-Integration. Options to test connection, create, or cancel configuration.

  5. Select Users and groups under Manage, and click Add user/group to assign groups for provisioning.
    Azure portal Users and groups section for Mist-AA-SCIM-Integration application, showing navigation path, no assignments found in the table, and Add user/group button highlighted.
  6. Add the groups that need to be provisioned on the HPE Mist cloud.
    Users and groups section in Azure AD portal showing provisioning settings for an application with three listed groups: Device_group_testing, Employee, and device_admin_group.
  7. Click Start Provisioning.
    Note: The provisioning interval in Microsoft Entra ID is approximately 40 minutes. You must wait for the next sync cycle to verify the provisioning status.
    Microsoft Azure portal screenshot showing the provisioning overview page for Mist-AA-SCIM-Integration, with navigation options, highlighted Start provisioning button, and basic information including name, provisioning interval, and configuration status.
  8. Verify that the provisioning status shows as Completed in Entra ID after the 40-minute provisioning interval. The setup for SCIM provisioning with Entra ID is now complete.
    Provisioning dashboard showing current cycle status as 100 percent complete with 3 groups provisioned, completion time 9/30/2025, and duration 4.231 seconds.

How to Integrate SCIM with Okta

To integrate SCIM with Okta:
Note:

Some of the screenshots included in this topic are sourced from third-party applications. Be aware that these screenshots might change over time and might not always match the current version of the applications.

  1. Log in to the Okta Admin Console and navigate to Applications>Create App Integration.
  2. Select the Sign-in method as SWA - Secure Web Authentication and click Next.
    User interface for selecting a sign-in method in app integration setup. SWA option is selected. Buttons: Learn More, Cancel, Next.
  3. Enter a name for the application and specify the login page URL for the app. Select the options for App Visibility and App Type, then click Finish.
    Okta Admin Console page for creating a Secure Web Authentication Integration, showing app settings like name, login URL, logo upload, visibility, and app type options.
  4. Switch to the General tab and click Edit Settings. Set the Provisioning Type as SCIM and click Save.
    Okta Admin Console configuration page for MIST NAC SCIM Integration under Applications section. Settings include application label, visibility, provisioning SCIM highlighted, auto-launch, and notes fields. Navigation menu lists Dashboard, Directory, Customizations, Applications, Security, Workflow, Reports, and Settings. Bottom shows Integrator Free Plan with 2 of 10 active users and last update timestamp. Save button visible for changes.
  5. In the Provisioning tab:

    1. Enter the following details:

      • SCIM Connector Base URL—SCIM Base URL from the IdP configuration
      • Unique Identifier Field for Users—userName
      • Authentication Mode—HTTP header

      • Authorization—SCIM Authentication token from the IdP configuration

    2. Enable the Push New Users, Push Profile Updates, and Push Groups checkboxes.

      Admin Console Applications section showing SCIM connector configuration with base URL, userName as unique identifier, provisioning actions, HTTP header authentication, test configuration button, and save or cancel options.

    3. Click Test Connector Configuration. If you see a success message, click Save.

      Test Connector Configuration dialog in Okta Admin Console showing Connector configured successfully with a green checkmark. Lists provisioning features with checkmarks for enabled features and red Xs for unsupported ones.

  6. In the Provisioning Settings tab, enable the first three provisioning options and click Save.

    • Create Users

    • Update User Attributes

    • Deactivate Users

    Admin Console showing provisioning settings for an Okta-integrated app. Create Users, Update User Attributes, and Deactivate Users are enabled, Sync Password is not enabled. Integrator Free Plan with 2 of 10 active users displayed.

  7. Select the Assignments tab and select Assign>Assign to Groups. Select and assign the groups that need to be provisioned for HPE Mist Networking Access Assurance.
    Okta Admin Console showing the Assignments tab of MIST NAC SCIM Integration application, with Assign dropdown open to assign to people or groups.
    Okta Admin Console interface showing the Applications section, Assignments tab, with a list of groups like Contractors, Employees, and Guests, and options to assign or delete groups.
  8. Navigate to the Push Groups tab and click Push Groups > Find groups by name. Push all the required groups for provisioning.
    Okta Admin Console interface showing Push Groups section under Applications, with options to find groups by name or rule, refresh app groups, bulk edit, and a table for group synchronization with HPE Mist NAC SCIM integration.

    Verify that the Push Status shows as Active. The setup for SCIM provisioning with Okta IdP is now complete.

    Push Groups to HPE Mist Networking NAC SCIM Integration interface showing group synchronization tools, including Push Groups button, search bar, group list with sync status, and last push details.

Client Connection and Verification

When a client is connected, you'll see the client events on the Insights page on the management portal. In the following examples, clients were connected using both EAP-TLS and EAP-TTLS authentication methods. In both cases, the authorization (that is, user group retrieval and mapping) was performed through the HPE Mist Networking Access Assurance SCIM database. This behavior can be verified in the event description, where the source of group information is shown as the SCIM repository.

Example 1: Client connected using the EAP-TLS authentication

client events, network activity, and authentication details, including timeline graph, navigation menu, and detailed event data such as MAC address and authentication type.

Example 2: Client connected using the EAP-TTLS authentication

Network management dashboard showing client events and network activity, including data usage graph, navigation menu, event list with statuses, and detailed authentication info.