SCIM vs IFS & M3 roles

Hi,

I have understood the steps to follow to set up and configure SCIM between IFS and AzureAD through the documentation and tutorials available.
However, I have not found any documentation that explains how users are assigned IFS roles through this synchronization mechanism.
I am aware of the existence of SCIM groups.
But I don't understand the mapping logic that needs to be implemented.

Thank you for your help.

Find more posts tagged with

Accepted answers

Matthew Trigg

It's using the Entra User Provisioning mechanism so you can change the mappings for what attributes go where.

IFS doesn't have too many details to play with, only things like Name, Department, Title, Email Address, they will all come through out of the box.

The only thing I really changed was taking the UPN from AD and mapping it to the username in IFS.

Is there something in particular you are trying to achieve?

Matthew Trigg

Yes you are right, you can't map the SCIM groups to the security roles until you have done the initial sync.

You can however configure all of your security roles prior to this and have them all ready to go, then just add the SCIM groups and the users will flow through nicely.

All comments

Matthew Trigg

Hi Denis,

in IFS, within each Security group you are able to assign the sync’d SCIM group(s).

Or you can do it the other way and find your SCIM group and assign in IFS security group.

The users you assign in AD will flow though.

Hope that helps.

Thanks,

Matt

Denis MARETTE

Thanks, Matt.
I'll explore that solution.

Denis

Denis MARETTE

Beyond IFS roles, what user profile attributes are synchronized between Azure AD and IFS?

Regardless of the default configuration (synchronized attributes), is it possible to adjust it?

Matthew Trigg

It's using the Entra User Provisioning mechanism so you can change the mappings for what attributes go where.

IFS doesn't have too many details to play with, only things like Name, Department, Title, Email Address, they will all come through out of the box.

The only thing I really changed was taking the UPN from AD and mapping it to the username in IFS.

Is there something in particular you are trying to achieve?

Denis MARETTE

I didn't know that the attributes you listed were already supported as standard.
So, in principle, that should be sufficient, as you say. 🤞
And I understand that implementing the mechanism will automatically create SCIM groups. After the initial synchronization, all that remains is to match them with IFS or M3 roles. I guess this can't be anticipated? We have to wait for the SCIM agent to create them and then do the mapping.

Matthew Trigg

Yes you are right, you can't map the SCIM groups to the security roles until you have done the initial sync.

You can however configure all of your security roles prior to this and have them all ready to go, then just add the SCIM groups and the users will flow through nicely.

Denis MARETTE

Thank you, Matth, for all your input.
I appreciate it.I think I now have everything I need to implement this integration.

Copyright © 2025 Infor. All rights reserved.