Configure SCIM Provisioning

Admin account users can enable and configure System for Cross-Domain Identity Management (SCIM) provisioning using the SCIM tab of the Account Settings page. This will allow you to provision users and groups from Microsoft Entra ID or Okta.

Once enabled, you cannot disable SCIM provisioning from the UI. You will need to contact Forescout Support to disable SCIM provisioning. Provisioning is one-directional; you will not be able to update or delete provisioned users or groups from Forescout Cloud. This helps ensure that data remains accurate for your user groups as well as the data in Forescout Cloud.

To enable and configure SCIM provisioning:

  1. In Forescout Cloud, go to Account Settings > SCIM tab.
  2. Click the Enable SCIM button.
  3. Once enabled, a Base URL will be displayed that will be used to establish the connection between your SCIM Client (Entra ID or Okta) and Forescout Cloud. Copy the base URL.
  4. Click Generate API Key.
    1. Provide a name for the new API Key.
    2. Click Set Expiry to set an expiry date and notification window for the API Key, or click Never Expires.
    3. Select the user(s) to receive email notifications regarding the API Key.
    4. Click the Generate button and copy the API Key and API Endpoint URL that appears. Store the key in a secure and memorable location; you will need to provide the API Key to your SCIM client.
      This API key is unique and non-retrievable once the window is closed.
  5. To configure group-based access controls, see the section on Roles and Permissions Management.
  6. Provide the Base URL, API Key, and Attribute Mappings for your SCIM client: