Identity sources

Who can do thisTenant Admin

The SecurityIdentity sources page answers two questions: how people arrive in your workspace, and who keeps their profile accurate. It holds three independent choices. Directory sync (SCIM) decides who is here. HR Management can own employee identity. Write-back pushes profile changes out to Microsoft Entra ID or Google Workspace. How people prove who they are at sign-in is a separate page: see Authentication and single sign-on.

The main column has the cards Directory sync (SCIM), Attribute mapping (once SCIM is on), Identity governance, Directory provisioning (write-back) and Google Workspace provisioning (write-back). The right column, Flows, shows what is actually running.

Turn on directory sync (SCIM)

With SCIM 2.0, your identity provider creates, updates and deactivates people and groups in Juvaro for you.

1. In Directory sync (SCIM), switch on Automatic provisioning ("Sync users & groups from your IdP via SCIM 2.0."). More rows appear.
2. Copy the SCIM base URL into the provisioning settings of your identity provider.
3. Next to Bearer token, click Generate. The token is shown once, with the warning "Copy this token now - it won't be shown again." Click Copy, paste it into your identity provider, then click Done.

Provisioning starts once your identity provider is pointed at the base URL. Last synced shows the most recent user or group change received, or Never synced. Afterwards the token row shows only the last four characters. Rotate issues a new token, shown once in the same way; paste it into your identity provider.

Attribute mapping

The Attribute mapping card appears when SCIM is on. Each row maps an identity provider claim to a Juvaro field (IdP claim → Juvaro field) and is marked Required or Optional. A row badge says Syncing for the fields provisioning keeps up to date today (email, full name and active status) or With HR Management for fields that start syncing once HR Management is in your workspace.

1. Click + Add attribute mapping.
2. Type the claim (placeholder "IdP claim (e.g. employeeId)") and pick the field: Email, Full name, Job title, Department, Manager or Phone.
3. Tick Required if needed, and click Add.

An empty claim is refused with "claim is required". A required mapping cannot be removed ("Required mapping cannot be removed").

Identity governance

This card is the only place to change the HR Management identity settings. The Settings page only links here.

• HCM manages employee identity: employee names come from HR Management and cannot be edited in the portal or in your identity provider. Turn it off to let your identity provider or admins manage names. The other three switches appear only while this one is on.
• HCM removes access when an employee is terminated: terminating an employee removes their access to this workspace.
• Provision accounts on hire: creating an employee in HR Management creates or links their sign-in account and issues a temporary password.
• Require every employee to have an account: the employee directory flags anyone without a sign-in account and prompts HR to create one. It never blocks adding an employee.

What happens inside HR Management is covered in the HR Management articles.

Write-back to Microsoft Entra ID

Directory provisioning (write-back) pushes name, job title, department and manager changes from HR Management to Microsoft Entra ID.

1. Fill in Entra tenant ID, Provisioning app client ID and Client secret. When you edit later, leave the secret blank to keep the stored one.
2. Under Fields to sync, tick Name, Job title, Department and Manager as needed.
3. Optionally switch on Create missing employees in Entra. An employee with no matching Entra account is then created with a temporary password and completes sign-in through your Entra onboarding.
4. Click Test connection. Without a secret it says "Enter the client secret above to test the connection."
5. Switch on Enable write-back and click Save settings.

The status shows Enabled or Disabled, and Last run or Never run yet.

Write-back to Google Workspace

Google Workspace provisioning (write-back) works the same way for Google Workspace. Fill in Impersonated admin email, Workspace customer ID ("my_customer or C0xxxxxxx") and Service account key (JSON), choose the Fields to sync, optionally switch on Create missing employees in Google Workspace (new accounts get a temporary password and choose a new one at first sign-in), then Test connection, Enable write-back and Save settings. Without a key, the test says "Paste the service account key above to test the connection."

Flows

The Flows column lists only what is actually running: "SCIM is provisioning accounts into your workspace." when directory sync is on, "HCM is the source of truth for employee identity." when HR Management owns identity, or "Nothing is syncing in right now."

In the Integration Hub

The Integration Hub shows cards for Entra ID and SCIM too, but they are configured here, not in the Hub. See Single sign-on and directory sync cards.