Brief Overview

WalkMe supports SCIM (System for Cross-domain Identity Management) provisioning through Microsoft Entra ID (formerly Azure AD). Entra ID acts as the identity source, and WalkMe automatically creates, updates, and removes assigned users and groups based on your provisioning settings.

Access

Access SCIM Integration in the console:

1. Open the WalkMe Console:
   • US Data Center
   • EU Data Center
   • SAP US Data Center
   • SAP EU Data Center
2. Go to the Admin category
3. Select Security & Audit
4. Choose SCIM Integration

How It Works

Setting up SCIM with Entra ID takes four steps:

1. Create a non-gallery enterprise application in Entra ID
2. Connect Entra ID to WalkMe with your SCIM credentials
3. Review the attribute mappings
4. Assign users and groups, and start provisioning

Before you start

Create a SCIM integration in the WalkMe Console (see Access) and copy the SCIM base URL and credentials. Learn more.

Step 1: Create the application in Entra ID

1. Sign in to the Microsoft Entra admin center
2. Go to Entra ID > Enterprise applications > All applications
3. Select New application
4. Select Create your own application
5. Add a descriptive name, for example: WalkMe SCIM Integration
6. Select Integrate any other application you don't find in the gallery (Non-gallery)
7. Select Create

Step 2: Connect Entra ID to WalkMe

1. In the app's left menu, select Provisioning
2. Select Get started
3. Change Provisioning Mode from Manual to Automatic
4. Expand Admin Credentials and add the following:
   • Tenant URL: The SCIM base URL for your WalkMe data center
   • Secret Token: The authentication value for the authorization type set in WalkMe:
     1. Basic Authentication: Convert the WalkMe-generated Username:Password value to Base64 and add it as Basic <your_base64_string>
     2. Bearer Token: Paste the token generated by WalkMe
5. Select Test Connection
6. When the test succeeds, select Save

WalkMe data centers:

• US Data Center:
  • Tenant URL (SCIM base URL): https://papi.walkme.com/deepui/api/scim/v2
• EU Data Center:
  • Tenant URL (SCIM base URL): https://eu-papi.walkme.com/deepui/api/scim/v2
• SAP US Data Center (US01):
  • Tenant URL (SCIM base URL): https://papi-us01.walkme.cloud.sap/deepui/api/scim/v2
• SAP EU Data Center (EU01):
  • Tenant URL (SCIM base URL): https://papi-eu01.walkme.cloud.sap/deepui/api/scim/v2
• FedRAMP Data Center:
  • Tenant URL (SCIM base URL): https://papi.walkmegov.com/deepui/api/scim/v2
• Canada Data Center:
  • Tenant URL (SCIM base URL): https://papi-ca1.walkmedap.com/deepui/api/scim/v2

Step 3: Review attribute mappings

1. On the Provisioning page, expand Mappings
2. Select Provision Microsoft Entra ID Users
3. Make sure the required WalkMe attributes are mapped:

• WalkMe attribute: UserName

• • Requirement: Must map to a stable, unique identifier, typically userPrincipalName  or mail

• WalkMe attribute: emails

• • Requirement: Must include at least one email address marked primary: true

To sync groups:

1. In Mappings, select Provision Microsoft Entra ID Groups
2. Make sure displayName is mapped
3. Select Save if you made changes

Step 4: Assign users and start provisioning

1. In the app's left menu, go to Users or Groups
2. Select Add User or Group
3. Select the users or groups to sync to WalkMe
4. Go back to the Provisioning tab
5. Select Start provisioning

Troubleshooting

Connection test fails

• Make sure the Tenant URL matches your WalkMe data center
• Make sure the Secret Token format matches the authorization type set in WalkMe

Users or groups not syncing

• Make sure the app was created as a non-gallery enterprise application
• Make sure Provisioning Mode is set to Automatic
• Make sure the users or groups are assigned to the app
• Wait for the first provisioning cycle to complete before checking results

Attribute mapping issues

• Incorrect mappings can cause failed user creation, incomplete profile data, or group sync issues
• Go to Provisioning > Mappings and make sure userName, emails, and group displayName are mapped correctly

Technical Notes

• Only users and groups assigned to the enterprise application are provisioned. Other Entra ID users don't sync to WalkMe.
• Changes made in Entra ID sync to WalkMe in later provisioning cycles