How to set up SCIM with Azure

Calendly supports SCIM provisioning with Azure Active Directory. From Azure, you can create users, update user attributes (like name and email), deactivate users, and delete users. These changes will automatically sync to Calendly.

Note: SCIM is only available on the Enterprise plan. Because of changes to our Enterprise plan, some early Enterprise plans may include SAML but not SCIM. Please contact your Account Executive or our sales team to learn more.

Before you start…

• You must set up SAML single sign on (SSO) before you can can set up SCIM.

• To configure SCIM, you must be a Calendly owner or admin.

• During setup, you’ll switch between Calendly and Azure. It’s best to keep each platform open in a separate browser window.

Setting up SCIM

1. Go to the Calendly SSO configuration page and enable SCIM

1. In Calendly, go to your Admin center, select Login, then select Single sign-on.

2. Under Optional: Connect SCIM, select SCIM provisioning.

2. Go to Provisioning in Azure

1. In a separate window, sign in to the Azure Portal and select Enterprise Applications from Azure services.

2. From All Applications, search for Calendly, and select it from the list.

3. In the left sidebar, select Provisioning.

4. Select Get Started.

5. For Provisioning Mode, select Automatic.

6. Under Admin Credentials, paste the Base URL from Calendly into the Tenant URL field in Azure.

7. In Calendly, select the appropriate value for When do you want this token to expire? Then select Generate new bearer token, Copy token, and paste it in the Secret Token field in Azure.

3. Test connection in Calendly

1. Select Test Connection. If the connection fails, try paste in the Base URL and Copy token again.

2. Select Save.

4. Go to Mappings in Azure

1. Under Mappings, select Provision Azure Active Directory Groups. Toggle Enabled to No. Calendly does not support Group provisioning.

2. Select Save, then select X in the top right to exit this view and return to Mappings.

3. Under Mappings, select Provision Azure Active Directory Users.

4. For Target Object Actions, leave Create and Update checked.

   Choose to keep Delete checked or unchecked with caution. ⚠️ If a user is deleted in Azure, Calendly will delete their Calendly account and all their data. This is a non-reversible action.

5. For Attribute Mappings, keep the userName, active, and displayName attributes. Delete all other attributes.

6. Select the userName attribute. Under Source attribute, select mail. Select Ok.

7. The end result of the Attribute Mappings should look like this:

8. Select Save, then Yes. Select X in the top right to exit this view and return to the Provisioning page.

5. Enable provisioning in Azure

1. Open the Settings section. If you want to be notified if provisioning fails, check Send an email notification when a failure occurs. Enter the email of a person or group who should receive provisioning error notifications.

2. Under Scope, ensure Sync only assigned users and groups is selected.

3. To enable provisioning, toggle Provisioning Status to On. Select Save.

Note: The provisioning sync is every 40 minutes.

6. Assign users the Calendly app

In Azure, assign users access to the Calendly application.

1. In Azure, return to the Calendly application page.

2. Select Users and groups from the lefthand sidebar.

3. Select + Add user/group.

4. Select None Selected.

5. Search for the users you want to add. Select Select, then Assign.

Assigning users to groups

For larger organizations, managing group membership in Calendly may require some level of automation. This can be achieved through SCIM by utilizing existing attributes of a user’s profile and mapping that value to a Calendly group. Read more about how to use groups here.

NOTE: Once you configure Map to groups, you will no longer be able to manage groups manually. This assumes user group membership is sourced from your identity provider.

• Save and return to the mapping table
• Click Add new mapping on the Attribute Mappings table
• Select a source attribute that will represent the user’s group in Calendly

1. Modify attribute mappings for Provisioning and create a new attribute for users.
   • Click Show advanced options
   • Click Edit attribute list
   • On a new row, add the following:
     • urn:calendly:scim:schemas:2.0:User:group
     • String
     • Leave the rest unchanged
   • Save and return to the mapping tablE

2. Click Add new mapping on the Attribute Mappings table

• Select a source attribute that will represent the user’s group in Calendly

3. Once the mapping has been saved, provision a user to Calendly using your typically provisioning process.

4. Inside your Calendly application, under Organization setting -> Single sign-on, click the optional Map to groups button.

5. In the left column, type in the exact value(s) from your identity provider’s profile. 

6. In the right column, either select an existing Calendly group or start typing to create a new group on the flow.

You can then Preview and Save your new provisioning!