Sync Azure Entra ID Users to Jericho via SCIM 2.0

Jericho Security supports SCIM 2.0 directory sync with Microsoft Entra ID (formerly Azure Active Directory). Once configured, Azure automatically provisions your users and groups into Jericho Security, keeping your phishing simulation and training campaign targets up to date without manual imports.

Before you begin

You will need the following values from Jericho Security during setup:

Field	Value
Tenant URL	https://app.jerichosecurity.com/scim_v2
Secret Token	Your SCIM API token from Jericho Security integration settings

Note

Use the Tenant URL exactly as shown above. The customer-specific part of the integration is the SCIM API key, not a tenant-specific URL or UUID path.

Setup steps

Open the Azure portal

Navigate to https://portal.azure.com/#home.

Go to Azure Entra ID > Enterprise applications

Click View on Manage Azure Entra ID (or navigate directly to Azure Entra ID), then click Enterprise applications.

Create a new application

Click New Application, then click Create your own application. Name it something recognizable, for example Jericho Security SCIM, then click Create.

Start user provisioning

On the application overview, click Get Started on the Provision User Accounts card, then click Get Started again on the next screen.

Set provisioning mode to Automatic

In the Provisioning settings, toggle Provisioning Mode to Automatic.

Enter the Tenant URL

In the Admin Credentials section, set the Tenant URL to:

https://app.jerichosecurity.com/scim_v2

Enter your SCIM API token as the Secret Token

Find your SCIM API token in your Jericho Security integration settings and paste it into the Secret Token field.

Test the connection and save

Click Test Connection and confirm it succeeds, then click Save.

Verify attribute mappings

After saving, expand the Mappings accordion that appears in the main content area. Confirm that both Groups and Users are enabled.

Update the Users attribute mapping

Click Users to open the attribute mapping. Map the source attribute mail to the SCIM target attribute userName, then save the mapping. Do not map mail to userPrincipalName; Jericho uses the SCIM userName field as the employee email identifier.

Set the provisioning scope

In the Settings accordion, set Scope to Sync only assigned users and groups.

Assign users and groups to the application

Go to the Users and groups section and assign the users and/or groups you want Jericho to receive.

Note

When you assign a group, Microsoft only provisions direct member users — users in nested groups are not included. This is a limitation of Microsoft’s provisioning behavior.

Start provisioning

Return to the Provisioning settings and set Provisioning Status to On, or click Start Provisioning.

Note

The initial provisioning cycle can take longer than later cycles. Subsequent cycles typically run about every 40 minutes; this is not a guaranteed initial-sync deadline. Check provisioning progress in Microsoft Entra and confirm the expected employees and groups in Jericho.

Before enabling the full scope, use Provision on-demand for an assigned test user and verify the email address in Jericho. Ensure mail is populated and unique for every in-scope user; it must match the intended Jericho employee email.

See Microsoft’s SCIM setup guide and provisioning behavior. Provisioning screens differ between the new and legacy Entra experiences.