Once Single Sign-on (SSO) is set up, you can configure Udemy for Cross-domain Identity Management (SCIM 2.0) provisioning in Entra ID (formerly known as Azure AD) with Udemy Business. You can also refer to Microsoft’s own configuration guide for SCIM Provisioning with Entra ID for further guidance.
SCIM provisioning enables you to provision, deprovision, create groups, manage group membership, manage licenses, and change user profile details like name and email address in Entra ID, which automatically updates Udemy Business. You will no longer need to update both Entra ID and Udemy Business separately with these actions as it will all be synced from Entra ID.
Please note:
- SSO must be enabled prior to activating SCIM.
- Single sign-on and provisioning are available to Udemy Business Enterprise Plan customers.
- Users provisioned through Entra ID won't take up a license until they log into the Udemy Business application for the first time.
- SCIM provisioning changes can only be synced from Entra ID to Udemy Business, not the other way round.
- Users and Groups managed by SCIM in Entra ID can't be changed within the Udemy Business app; SCIM is the single source of truth for user and group data.
- You can still create groups manually in Udemy Business if you have users that you don’t need or want to push from Entra ID, such as contractors or temporary staff.
- Note: SCIM API tokens for Udemy Business last for approximately two years. Admins will be sent a notification informing them of:
- 30 days before the token expiry
- After the token expiry
Table of Contents
Configure SCIM Provisioning with Entra ID
1. In your Udemy Business account, go to Manage > Settings > Provisioning (SCIM).
2. Click Start Setup, choose Azure and then Generate Token. A Secret Token (Bearer token) will appear which you then need to input into Entra ID.
3. Access your Entra ID account and go to your Udemy Business SSO app, then go to the Provisioning tab in your Entra ID portal.
4. In the Provisioning Mode screen, click on New Configuration.
5. In the Admin Credentials section:
Select Authentication method: Bearer authentication
Tenant URL is: https://domain.udemy.com/scim/v2 (replace “domain” with the url for your Udemy Business account)
Secret Token: This is a Bearer token that you generated in your Udemy portal in step 2.
6. Click Test Connection to check that it’s working correctly. If successful, click create.
7. Once the connection is saved go to Attribute Mappings on the left side tab. We will be updating the User Attribute Mappings.
Once inside you should see the attribute mappings list
Supported attributes
Confirm that the required attributes below are added in the customappsso Attributes as these fields are required for SCIM provisioning to function within Udemy.
| SCIM attribute | Required? | Description |
emails[type eq "work"].value |
Yes | Email of the user. Must be unique |
userName |
Yes | The userName from the IdP. Must be unique. |
active |
Yes | Flag to deactivate/reactivate users |
externalId |
Yes | The externalId of the user from IdP. Must be unique. |
urn:ietf:params:scim:schemas:extension: enterprise:2.0:User:employeeNumber |
Yes | Returns employeeNumber field from EnterpriseSchema and store it as external_id field. Should match the attribute you want sent to externalId. |
name.givenName |
No | Given name of user. Even though they are not required, we recommend always specifying those attributes since it’ll make it easier to identify users. |
name.familyName |
No | Family name of user. Even though they are not required, we recommend always specifying those attributes since it’ll make it easier to identify users. |
name, { givenName, familyName } |
No | Given name and family name of the user. Even though they are not required, we recommend always specifying those attributes since it’ll make it easier to identify users. |
title |
No | User’s job title, i.e. “Senior Engineer”. |
urn:ietf:params:scim:schemas:extension: udemy:2.0:User:licensePoolName |
No | The license pool name. |
urn:ietf:params:scim:schemas:extension: udemy:2.0:User:licenseTypes |
No |
A comma-separated list of license types. Accepted values:
|
urn:ietf:params:scim:schemas: extension:udemy:2.0:User:lmsUserID |
No |
The lms User ID value typically used as a main identifier for an LMS connection |
urn:ietf:params:scim:schemas:extension: enterprise:2.0:User:costCenter |
No |
The name or code identifying the user's cost center. |
urn:ietf:params:scim:schemas:extension: enterprise:2.0:User:organization |
No |
The name of the organization the user belongs to. |
urn:ietf:params:scim:schemas:extension: enterprise:2.0:User:department |
No |
The name of the department the user belongs to |
urn:ietf:params:scim:schemas:extension: enterprise:2.0:User:division |
No |
The name of the division the user belongs to. |
8. Make sure the Microsoft Entra ID attribute for emails[type eq "work"].value matches the value you configured in your SSO email attribute and claims. (I.E. mail or userPrincipalName)
9. Confirm the attribute Switch([IsSoftDeleted], , "False", "True", "True", "False") is mapped to active which allows the deactivation of users to be passed over.
10. Once you added the attributes, update the Matching precedence to have emails[type eq "work"].value set to 1. You might have to go into userName and update the value to 2 or 3 first.
To set Matching precedence for an attribute, select the attribute and enable “Match Object using this attribute”.
11. Go back to the User Attributes Mapping and click on Advanced options. Select Edit customappsso user attributes and enable Exact case for both id and userName.
12. Return to the provisioning Overview tab and select Start provisioning.
13. Click Users and groups.
14. Click on Add User, which will give you the option to add both Users and Groups.
Select all users or the groups you want to add to the application and click Select.
Troubleshooting
For any errors provisioning users, you can view more details by looking into the provisioning logs.
- You can obtain this log by going to the Udemy App on Azure > Provisioning > Provisioning Logs > Search for the affected user > Troubleshooting & Recommendations.
- If needed, open a support ticket and provide a screenshot of the Azure provisioning logs so we can take a look at what failed.