Microsoft Entra SCIM Setup

In order to set up SCIM Provisioning, you must first set up Single Sign On.

Please note that enabling SCIM in your environment will remove all existing users and their permissions from the CLEAR1 Console. In addition, you will see this banner indicating that all user management will be handled via Entra, not the CLEAR Console.

Enable SCIM in the CLEAR Dashboard

Log into the CLEAR Dashboard and click on User Management, then Single Sign-On.

Click Enable.

Next, you will need to generate your SCIM token which can be done by clicking Generate API Key.

Make sure the Environment is Production, and give it a name, then click Add.

Note: This will be the only time you can copy your API key. Please make a copy for later use.

Register the Application in Microsoft Entra

Sign in to Microsoft Entra

Go to https://entra.microsoft.com/#home and log in with your Entra administrator account.

Navigate to Microsoft Entra ID

In the left-hand menu, select Microsoft Entra ID.

Create a New Enterprise Application

From the Microsoft Entra admin center Home screen, go to Enterprise apps in the left side menu bar.

Click New application and then click Create your own application.

Provide a name for your application (e.g., "MyApp SCIM") and select the Integrate any other application you don’t find in gallery (Non-gallery) radio button.

Click Create.

Create a New Configuration to connect your application

This is under the Provisioning side bar menu option.

1. Enter the Tenant URL (which is CLEAR’s URL for SCIM): https://verified.clearme.com/scim/v2

2. Enter the Secret Token created above in step 1.

   

3. Click the Test Connection button

4. The provisioning configuration must pass the test connection step in order for the Create button to be enable.

5. Click the Create button, once it is enabled.

Assign Users and Groups

Assign groups or individual users to the newly created application:

Make sure to to assign all users and groups that need to be provisioned here before you advance any further.

Test Provisioning using Provision on Demand

Before we test out provisioning using Provision on Demand, ensure that the user does not currently exist in your CLEAR Console:

Then, navigate back to Entra and click Provision on demand in your app. Select the user for testing provisioning. Note: If no roles are set up then the user will be created with the Agent role.

Click Provision.

Messages from Provision on Demand:

The user you just provisioned should now be in your CLEAR Console under Authorized users:

Note: All users created through SCIM will be granted the Agent role by default. You can define roles below.

If you do not wish to provision users with roles or groups, go to Provisioning --> Overview and click Start Provisioning. If you do wish to establish roles and Entra groups, do not Start Provisioning and continue to CLEAR Roles / Provisioning Entra Groups section below.

Please allow 40 minutes for Provisioning to commence given Entra's fixed time interval.

CLEAR Roles

CLEAR Roles can be specified when using SCIM to provision users.

The following CLEAR Roles are defined: Agent, Verification Checks Viewer, Verification Table Viewer, Selfie Match Reviewer, No Org-Level Access, Admin, Manager

Note: Agent is the default role if no role is specified

Custom Roles can also be defined.

Specifying the Custom CLEAR Role in Entra

Define App Roles for CLEAR Default Roles and Custom Roles.

Enter the Display Name. NOTE: This has to be the Role ID from the User Roles in CLEAR.

Select the User/Groups radio button.

The Value should be the Role ID from above. For example, Verification Table Viewer role above would be strongly_limited_access. For Developer, it would be Dj2pm6gB982Gj9Rx.

Please ensure that the Display Name Matches the Value.

To Assign App roles to group or user, click the Add user/group button.

Then, select a user or group and add an assignment and then click Assign button.

Adding Customer Attributes

To add custom attributes, you will want to go to the Provisioning Attribute Mapping Screen by clicking Attribute mapping (Preview).

Then Users:

Click the Show advanced options check box and then click the Edit attribute list for customappsso.

Scroll to the bottom of the screen and in a blank box add the following attribute: urn:ietf:params:scim:schemas:extension:clear:2.0:User:cv_role and set the type to String.

Click Save.

Click Add New Mapping on the Attribute Mapping Screen:

• Mapping type: Expression
• Expression: SingleAppRoleAssignment([appRoleAssignments])**
• Default value: (leave it empty)
• Target attribute: urn:ietf:params:scim:schemas:extension:clear:2.0:User:cv_role
• Matching precedence: (leave it empty)
• Apply this mapping: Always

So now your User Attributes should look like:

Test Provisioning using Provision on Demand

This test verifies that role assignment is set up correctly.

Choose a user to test provisioning. If no roles are configured, the user will be created with the default Agent role. Then click Provision.

Messages from Provision on Demand:

CLEAR Authorized Users before Provision on Demand:

CLEAR Authorized Users after Provision on Demand (note the new CLEAR role assigned):

Provisioning Entra Groups

CLEAR does not accept Groups to be provisioned via SCIM. However, assigning Groups to your CLEAR SCIM app in Entra will allow users in the assigned group to be added to the CLEAR Console via Standard Provisioning. Given this, we must first turn off Group Provisioning. Do this by going to Provisioning --> Mapping.

Group provisioning should now be disabled and you can continue setting up Group assignment.

To assign Groups to your CLEAR SCIM app, go to Users and Groups in your Enterprise app, then click Add user/group.

Click None Selected under Users and groups.

Search for the group you want to add, click the check mark next to the group name, and then hit Select at the bottom.

Then click Select a role and click the role you want the Group assigned to on the right, then hit Select again.

Click Assign and you are good to go. If you don't wish to assign them a particular role, then click User above.

Finally, go to Provisioning --> Overview, and click Start Provisioning.

Please allow 40 minutes for Group Provisioning to initiate given Entra's fixed time interval. Do not provision Groups on Demand.

After 40 minutes, all added users and users in assigned groups are provisioned with appropriate access.

Troubleshooting

If SCIM provisioning is not working as expected, check the following:

• Users not provisioning:
  Ensure users are assigned to the Enterprise App and the provisioning status is enabled in Azure AD.

• Connection issues:
  Verify the SCIM Base URL and Bearer token are correct, and the Entra provisioning service can reach CLEAR.

• Roles or group claims missing:
  Confirm attribute mappings include role or group claims and that values align with CLEAR roles.

• No updates applied:
  Check provisioning logs for errors and ensure Azure AD is configured to push updates and not just initial creates.

• Deprovisioning not reflected:
  Confirm “Send delete notifications” is enabled in Entra provisioning settings and CLEAR supports the action.

• Provisioning Groups on Demand
  Since CLEAR does not support Group Syncing, you will need to "Start Provisioning" to provision users in Entra Groups - Provisoning on Demand will NOT provision the users.

If issues persist, provide CLEAR Solutions Engineering with your Entra app name and example user email.