Setting up SCIM with Entra ID (Azure AD)

To enable SCIM, you must first set up SAML SSO with Entra ID (AAD). Read this article to find out how.

For an overview of how Whimsical supports SCIM, check out this article.

First, go to Workspace settings, which you'll find under your workspace name in the top left corner:

Enable SCIM provisioning and click "Reveal" to retrieve an OAuth token:

In the "Provisioning" tab in Entra ID (AAD), set "Provisioning Mode" to "Automatic", and paste the following URL into "Tenant URL":

https://api.whimsical.com/scim-v2/?aadOptscim0620200

Then, paste your OAuth token under "Secret Token", click "Test Connection", and Save:

User provisioningCopied!Link to this section

There are two cases to consider when provisioning a user.

Provisioning a new userCopied!Link to this section

When creating a new user, if editor is undefined or you do not provide a value, the user will have the default role set in your Whimsical workspace settings.

To set the role explicitly when provisioning:

  • true - provisions the user as an editor
  • false - provisions the user as a viewer

Updating an existing userCopied!Link to this section

When updating an existing user, if editor is undefined or you do not provide a value, there will be no change to the user's role in Whimsical.

To set the role explicitly when updating:

  • true - provisions the user as an editor
  • false - provisions the user as a viewer

Tip: If you're managing user roles with groups, we strongly recommend always having a true and a false group. Setting undefined may lead to undesired outcomes.

If you provision with SCIM but prefer managing user roles within your Whimsical workspace, do not specify a value for editor — then any roles defined in Whimsical will be maintained.


NoteCopied!Link to this section

  • To use SCIM, SAML has to be enabled and correctly configured.
  • After user creation, given name and family name fields can only be updated by the users themselves in Whimsical.
  • Provisioned users will receive an activation email and will have to log in through SAML to appear in your workspace in Whimsical.
  • If you disable SAML in your Whimsical settings, SCIM will also be disabled. After reenabling SAML and SCIM, you will have to import all users into Entra ID (AAD).
  • Once SCIM is enabled, please make any user role changes directly from Entra ID (AAD) since Entra ID (AAD) will overwrite the choices made within the Whimsical app.
  • To learn more about SCIM role provisioning with Groups in Entra ID please check out this article.

Written by:

  • Dārta

    Dārta