Skip to Content
Configure VeriProofIdentity provisioning

Identity provisioning

Identity provisioning keeps VeriProof membership in step with your identity provider. Only Administrators can change it, and it is unavailable in demo, sandbox, and preview modes.

SCIM provisioning

With SCIM provisioning, your identity provider adds, updates, and deactivates people in VeriProof when they change there.

  1. Create a SCIM token. Choose how long it stays valid: 90, 180, 365, or 730 days. Copy it when it’s shown; it isn’t shown again.
  2. In your identity provider, enter the SCIM base URL and the token.
    • Microsoft Entra ID: in the enterprise application, open Provisioning and set the mode to Automatic. Enter the SCIM base URL as Tenant URL and the token as Secret Token.
    • Okta: enter the SCIM base URL as the SCIM connector base URL, use userName as the unique identifier field, choose HTTP Header authentication, and paste the token as the Bearer token.
  3. Choose the Baseline role. Every person the identity provider adds starts with this role. It can’t be Administrator.

Up to five tokens can be active at once. To replace a token, rotate it and paste the new token into your identity provider; provisioning pauses until you do. Revoking a token stops the identity provider from adding, updating, or deactivating people until you give it a new token.

Group mappings

Map an identity provider group to a role, its add-ons, and optionally an application group. Everyone in a mapped group gets that access.

  • Groups appear when your identity provider sends them through SCIM. Add a group yourself if it arrives only at sign-in. Microsoft Entra ID sends the group object ID; Okta sends the group name.
  • When someone leaves a mapped group, VeriProof removes only the roles and add-ons that came from that group. Roles granted directly in Members are never removed, and the last Administrator is always kept.

Group sync at sign-in

When Sync groups at sign-in is on, the groups in your identity provider’s group claim update a person’s group memberships each time they sign in. Microsoft Entra ID must be set to send group claims. If the provider leaves groups out because there are too many, memberships stay as they are.

When Entra ID leaves groups out

Microsoft Entra ID leaves the group claim out of the sign-in token when a person belongs to more groups than the token can hold. To keep memberships current for those people, turn on Read groups from Microsoft Graph when Entra ID leaves them out. VeriProof then lists the person’s groups from Microsoft Graph at sign-in, including groups they belong to through nested groups.

Before you turn it on:

  1. In Microsoft Entra ID, open the app registration your single sign-on uses.
  2. Add the Microsoft Graph GroupMember.Read.All application permission.
  3. Grant admin consent for your organization.

VeriProof reads only the signed-in person’s group memberships. If Microsoft Graph can’t return every group, for example because consent is missing, memberships stay as they are and sign-in continues with the access the person already has. The setting is available only while Sync groups at sign-in is on, and Administrators’ changes to it are recorded in the audit log.

When it’s off, memberships change only through SCIM or manual updates.

Last updated on
Service principalsOrganization controls