SCIM provisioning with Groups in Entra ID (Azure AD)

Groups offer an easier way to manage provisioning and deprovisioning in Entra ID. This guide will run you through the step-by-step set up for creating Entra ID groups for the editor and viewer roles in Whimsical.

For an overview of how Whimsical supports SCIM, check out this article.

Setting up groupsCopied!Link to this section

Create two groups in the Entra admin center, called Whimsical Viewers and Whimsical Editors:

Add users to the correct group as members.

Creating app rolesCopied!Link to this section

Open Whimsical under App registrations:

Click Create app role to create two app roles, with the following information:

Display name

Value

Description

Editor

editor

Editors can create and edit files in Whimsical.

Viewer

viewer

Viewers can read and comment on files in Whimsical, but cannot edit existing content, or create new files.

Assigning app roles to groupsCopied!Link to this section

Still in Entra ID, go to Users and groups in the Whimsical app under Enterprise applications.

Add the Whimsical Editors group and assign it the role of Editor.

Add the Whimsical Viewers group and assign it the role of Viewer.

You should see this setup:

Set up attribute mappingCopied!Link to this section

Now, go to Provisioning in the Whimsical app under Enterprise applications, and click Edit attribute mappings:

Open Mappings and click Provision Microsoft Entra ID Users:

Click Add New Mapping:

Create a new attribute with the following settings:

  • Mapping type: Expression
  • Expression: Switch(SingleAppRoleAssignment([appRoleAssignments]), , "Editors", "true", "Viewers", "false")
  • Default value: leave blank
  • Target attribute: urn:ietf:params:scim:schemas:extension:whimsical:2.0:User:editor
  • Match objects using this attribute: No
  • Apply this mapping: Always

Important: In the expression above, it is crucial that “Editors” and “Viewers” match the Display name, not the Value that you configured for the App role.

You can now enable SCIM provisioning.

If you already have SCIM provisioning enabled, wait for the next refresh (max 40 minutes), or you can click Stop provisioning and Start provisioning to make it run immediately.