Configure Alteryx Server for SCIM with Microsoft Entra ID

SCIM requires that Alteryx Server is configured to support SAML single sign-on.

For a new environment, follow the steps outlined in Configure Alteryx Server Authentication to set up SAML.

Sign in to Alteryx Server as a Curator (Server admin) and navigate to Admin > Settings > Configuration > SCIM.

Select Edit.

Turn on the switch to enable SCIM.

Select the Token Lifetime based on your needs. Please consult your company's security team for guidance.

Select Save.

Make note of the Base URI and Token as you will need these to configure the connection in Microsoft Entra ID.

Sign in to Microsoft Entra ID.

If you do not already have an Application created for Alteryx Server, select Enterprise applications.

1. Select +New application.

2. Select +Create your own application.

3. In the right-hand panel, enter a name for the application, such as “Alteryx Server”.

4. Select Integrate any other application you don’t find in the gallery (Non-gallery).

5. Select Create.

6. Once the app is created, select Single sign-on and configure the app for SAML. Use Configuring SAML 2.0 on Alteryx Server for Azure AD for details.

Once you have an application created for Alteryx Server, navigate to that application.

Select Provisioning.

1. Select Automatic for the Provisioning Mode.

2. For Tenant URL, enter the Base URI you noted in the Enable SCIM Support section (for example, https://host.domain.tld/webapi/scim/v2).

3. For Secret Token, enter the Token you noted in the Enable SCIM Support section.

4. Select Test Connection to confirm Microsoft Entra ID can connect to Alteryx Server.

   1. If the connection test fails:

      Note

      While SAML sign in might work by default as this involves internal to public communication from a user, this does not mean that your Microsoft Entra ID instance has direct line-of-site to your Alteryx Server instance (which requires successful communication from Microsoft Entra ID’s public cloud to a private network) required for SCIM to function properly.

      If you get the error "An error occurred while sending the request.", please review the below options to ensure proper communication between these systems.

      • Ensure you have entered the correct URL and Token.

      • Consult your network and security teams to ensure network connectivity between Alteryx Server and Microsoft Entra ID is allowed.

      • If you cannot allow Microsoft Entra ID to connect directly to Alteryx Server, you might be able to use the Microsoft Entra ID's provisioning agent instead of this configuration. Please consult with your Microsoft Entra ID administrator and Microsoft Entra on-premises application provisioning to SCIM-enabled apps for details.

        

Log in to Microsoft Entra ID.

Navigate to the application you created for Alteryx Server in the Configure Microsoft Entra ID section.

Select Users and Groups.

Select +Add user/group.

In the right-hand panel, use search to find and select the users and groups you want to add.

The selected users and groups appear in the lower section of the panel.

To finalize your selection, choose the Select button at the bottom of the panel.

This returns you to the Users and Groups page with a list of the users and groups associated with the application.

Select Provisioning.

Select Start provisioning to enable provisioning. This starts the incremental provisioning cycle with which Microsoft Entra ID synchronizes users and groups with Alteryx Server. Any changes to users or groups in Microsoft Entra ID are reflected in Server when this sync completes. Microsoft Entra ID can take up to 40 minutes to synchronize changes.

Wait at least 40 minutes to ensure Microsoft Entra ID goes through a provisioning cycle.

Sign in to Alteryx Server as a Curator (Server admin).

Navigate to Admin > Users.

Confirm that the users and groups provisioned in Microsoft Entra ID have been successfully created or updated in Server.