Switch from JIT group sync to SCIM: Entra ID

• Prerequisites
• Backup your JIT group user assignments
• Delete JIT groups
• Switch your OpenID Connect app registration to an enterprise app

These instructions outline the necessary steps to switch from a previous SSO setup with JIT group synchronization to SCIM user provisioning. 

Prerequisites

• Admin access to DeepL
• Protocol: OIDC (Open ID Connect)
• Identity provider: Microsoft Entra ID (formerly AzureAD)
• Single sign-on with JIT group synchronization and groups, were previously setup

Backup your JIT group user assignments

If you are currently using Just-In-Time (JIT) group provisioning, we suggest backing up your group assignments before starting the configuration. These assignments were made during the JIT group synchronization setup. 

1. Go to the Users tab of your DeepL admin account
2. Click Export all users
   A list of all users and their current group assignments is exported

Delete JIT groups and disable JIT group synchonization

When you begin the SCIM provisioning process and a JIT group in DeepL has the same ID as a group that was provisioned via SCIM, the SCIM-provisioned group will overwrite the JIT group. This is the intended behavior, which allows you to manage the group from your Identity Provider (IdP).

However, if a JIT group is not in scope for SCIM provisioning, meaning it will not be assigned to the DeepL application in your IdP, that JIT group will not be overwritten. It will persist in your DeepL admin account even though it is no longer managed by your IdP. This can cause confusion when managing group assignments.

Therefore, to ensure that all your groups are managed solely by SCIM, we recommend deleting all previously created JIT groups.

As you delete JIT groups, your users may temporarily lose access to DeepL. Since they are being removed from groups associated with specific subscriptions or products, they will temporarily only belong to the default group. While their current SSO session may remain valid, they will only have access to products and subscriptions linked to the default group.

To minimize the impact on users, we recommend the following:

• Set your DeepL default group to a basic subscription to grant users continued access to core products during this brief configuration period.
• Notify your users in advance that they may experience a temporary loss of access while you perform maintenance on the application setup.

To delete groups, follow these instructions:

1. Go to Groups in your DeepL admin account
2. Click next to the group your want to delete
3. Select Delete group

To disable the JIT group synchronization follow, these instructions: 

1. Go to Settings in your DeepL admin account
2. In section Team and Single sign-on click Edit next to the SSO configuration
3. Uncheck JIT Group Sync, to disable JIT group synchronization

Switch your OpenID Connect app registration to an enterprise app

If you created your Enterprise application via the application registration method you cannot utilize SCIM provisioning directly. This limitation is unique to Microsoft Entra ID and only affects OpenID Connect applications. Other identity providers do not have this restriction.

If your existing enterprise application lacks provisioning capabilities and you want to enable SCIM, you'll need to create a new enterprise application. This will also generate a new OpenID Connect registration. 

To check your application, open your Enterprise application and select Provisioning from the left-side menu. 

• If you see the following, you can set up SCIM. Continue with the SCIM user provisioning setup process outlined in this article.
   

• If you see the following, proceed with the instructions. 

To minimize the impact on users, we recommend the following:

• Back up the user and group assignments before deleting the enterprise application so that you can reassign them later. For more information, see Backup your JIT group user assignments.
• Follow this procedure during a time of low activity

For now, keep the old DeepL SSO OpenID Connect application and following the instructions:

1. Create a new, non-gallery application and name it "DeepL 2".
2. Disable Make it visible to users in the application's properties to hide it from the My Apps dashboard. DeepL currently only supports SSO initiated by the service provider, so this setting is recommended.
3. Assign all users and groups to the new "DeepL 2" application, mirroring the existing assignments in the old DeepL application.
4. Configure SSO in your identity provider with OIDC using the new app registration automatically created for "DeepL 2," following the setup instructions in this article.
5. Go to Settings in your DeepL admin account and click on Advanced settings in section Team and User provisioning configuration

6. Click Delete SSO configuration

   Wait until you receive confirmation that the deletion was successful. This process may take a few minutes and you may need to refresh the page.
7. Continue setting up the SSO configuration in your DeepL admin account.
   Once saved, your users will begin authenticating via SSO through the new application in Entra ID.
8. Delete the old DeepL SSO application.
9. Rename "DeepL 2" to "DeepL." 

You are now ready to configure SCIM user provisioning in the newly created application outlined in this article.