--- title: Revolutionizing Azure integration with EmpowerID's SCIM Virtual Directory! description: Have you ever wondered how a single Azure account can be used to log in and access almost all the applications that you use at work? That's SCIM at work! image: https://blog.empowerid.com/hubfs/original@2x-Oct-23-2023-12-09-08-5303-PM.png --- [![empowerID-logo](https://blog.empowerid.com/hubfs/empowerID-logo.svg "empowerID-logo")](http://www.empowerid.com) **![phone](https://blog.empowerid.com/hubfs/images/phone.svg)   1-877-996-4276   **or**  +1 (614) 652-6825** [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/220903377569) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/company/85780) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/EmpowerID) [![Share on pinterest](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/pinterest-color.png?width=24&name=pinterest-color.png) ](http://www.youtube.com/user/empowerID) # All-In-One Identity Management and Cloud Security Emerging technologies are challenging old paradigms and unveiling new ways of approaching the security discipline that enables the right individuals to access the right resources at the right times for the right reasons. EmpowerID has embedded innovative technologies in every aspect, providing flexible and mature IAM capabilities in the cloud, on premise and in hybrid environments, addressing the mission-critical need across increasingly heterogeneous technology environments, and meeting increasingly rigorous compliance requirements. # Revolutionizing Azure integration with EmpowerID's SCIM Virtual Directory! Posted by [Aditya Taneja](https://blog.empowerid.com/blog-1/author/aditya-taneja) on Tue, Dec 19, 2023 ![Aditya Taneja](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) - [Tweet](https://twitter.com/share) In today's *"work from anywhere"* model, cloud-based identity management solutions are quickly becoming the norm. To enable interoperable cloud provisioning, Microsoft has embraced the System for Cross Domain Identity Management (SCIM) protocol in Azure. SCIM was created as a powerful means of standardizing, simplifying, and automating identity management for users, groups, and devices across cloud-based applications and services, and Microsoft is betting big on it. The challenge with SCIM is that it has *yet to become widely adopted*, and many applications simply do not support it. If you have custom applications with repositories of identity information or use an on-premise or cloud application like *SAP S/4 HANA or SAP Ariba*, or even a major HR system like UltiPro, you will not be able to integrate those systems with Azure unless you or the vendor builds a SCIM interface for each. This is no small task because, while the protocol is simple, building the interface is not. EmpowerID stepped into the gap and designed a Workflow-Driven SCIM Virtual Directory Server (VDS) that can sit between Azure and your non-SCIM applications. You simply connect those applications to EmpowerID and register the EmpowerID SCIM VDS in Azure. There is no need to wait for vendors or put in the time and effort needed to build a SCIM interface; EmpowerID takes care of everything for you.   ## Authentication Challenges: Unraveling the Complexity 1. **Diverse Directory Systems:** Organizations often deploy their directory systems, each with its set of permissions and administration controls. However, these systems fail to provide the granular level of access required, turning into additional entities for IT systems to manage. 2. **Privilege Abuse and Security Risks:** The adoption of multiple directory systems increases the surface area of attacks through privilege abuse. Without comprehensive controls, organizations face heightened security risks, leaving their systems vulnerable to exploitation. 3. **Slow Adoption of SCIM:** Despite the promise of standardization and simplification, the System for Cross Domain Identity Management (SCIM) has experienced slow adoption. Many applications lack support for SCIM, leaving organizations unable to leverage its benefits fully. ### Why SCIM? **Enjoy all the Advantages of SCIM without the Effort **– Created in 2011 as an open standard, lightweight provisioning protocol for the "Cloud age," SCIM provides a uniform way for applications to communicate identity information with each other. Although the adoption of SCIM has been slow, it is the way forward. With EmpowerID’s SCIM VDS, organizations can convert their applications to SCIM without waiting for vendors to come onboard or doing the heavy lifting of converting their legacy proprietary applications to SCIM.   **Seamlessly Integrate All Your Applications with Azure Provisioning Services** – The EmpowerID SCIM Virtual Directory is a *microservice and a SCIM server* that can be deployed as an *App Service* in any Azure tenant. Simply plug the VDS into any Azure environment, secure it with an Azure managed identity, and then register as many of your enterprise applications as needed. If the VDS knows about these applications, it will pass Azure provisioning commands to that system, SCIM compliant or not.   **Workflow-Driven Virtual Directory Services** – More than just a *"SCIM gateway,"* which is more than just an application that simply passes identity lifecycle commands like "provision this user" or "add this user to that group" from one system to another, the EmpowerID VDS treats everything as a workflow. This keeps your business logic in the process. Commands are evaluated by the VDS, which can trigger policies, invoke naming conventions, generate strong passwords, and send policy violations for human approval before any final provisioning action occurs. You determine what needs to happen when Azure makes a provisioning call.     [![FREE WHITEPAPER A Guide to Authorization Discover the ultimate guide to authorization and how applications make decisions in our 60-page white paper.  ](https://no-cache.hubspot.com/cta/default/174819/interactive-131064698192.png) ](https://blog.empowerid.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLf65vp6qBPctNsDztar%2FC9OXEGKKsWT7r9sKDbqaWmYDGkcg1P8bKQxwSFJF5LE21VA31bNpXGn1AMGpKoJrC8lqQftbzwTRqAVpbz8HQicioyl95jdWGts4WI8%2FgYT8BGClaVOIj3i98kCJzlea1JSqPt5H7YDXLXqDGcPEz%2FKCDWnZexegy4Np9bxvstCJa2HvoSug%3D%3D&webInteractiveContentId=131064698192&portalId=174819) #### HOW DOES THIS WORK? The SCIM Virtual Directory is a microservice and a SCIM server created by EmpowerID that can be deployed as an App Service in Azure tenants. This makes the SCIM VDS the intermediary between Azure and any applications registered in EmpowerID. Provisioning calls are made to the EmpowerID SCIM VDS, and the call is then directed to the appropriate system.   For example, if you have connected EmpowerID to Salesforce and an HR system, and a new user is provisioned in Azure AD, EmpowerID intercepts the call to provision the new user and directs it to the appropriate systems in EmpowerID.   This allows for any policies and other business logic to be evaluated first. Once your business logic completes, the account is provisioned in the appropriate systems, and everything is kept up to sync. The natural question arises as to how EmpowerID knows what system to update. The answer to the question is the URL you set for your applications in EmpowerID. Without going into detail, you simply specify the path to the application registered in EmpowerID. The image below depicts this.   ![](https://www.empowerid.com/img/solutions/scimazure01.png)   The last part of the path points to the application in the image. This is how EmpowerID knows where to direct the call made by Azure.   This allows you to SCIM-enable any system connected to EmpowerID without needing to create a specific SCIM connector for that system. EmpowerID does it for you, helping you leverage Azure AD provisioning quickly and easily for many systems with some advanced features.   #### WORKFLOW-DRIVEN VIRTUAL DIRECTORY SERVICES Traditional SCIM connectors operate on a "fire and forget" principle. They simply pass commands from one system to another without any intermediate layer of logic. In essence, they function more as a SCIM gateway. The EmpowerID SCIM VDS, on the other hand, takes a different approach. It not only passes commands from one system to another but also evaluates your business processes in the process.   We refer to this approach as "everything is a workflow," and it is at the core of the EmpowerID paradigm. Organizations need to inject their business logic into the process to maintain complete control.   ![](https://www.empowerid.com/img/solutions/scimazure02.png)   The image above illustrates the difference between the two approaches. In the first flow, Azure AD Provisioning Service sends commands to the EmpowerID SCIM VDS. EmpowerID then invokes the appropriate workflow for the command, allowing business processes to be executed before forwarding those commands downstream to a connected system. In the second, lower flow, Azure sends the same commands directly to a connected system, where they simply occur in that system with no control over the transactions. With EmpowerID acting as an intermediary, the entire process can be evaluated and interrupted if necessary.   Tags: [Active Directory](https://blog.empowerid.com/blog-1/topic/active-directory), [IAM](https://blog.empowerid.com/blog-1/topic/iam), [Virtual Directory](https://blog.empowerid.com/blog-1/topic/virtual-directory), [Access Governance](https://blog.empowerid.com/blog-1/topic/access-governance), [cloud security](https://blog.empowerid.com/blog-1/topic/cloud-security) ### About EmpowerID EmpowerID is the all-in-one Identity Management and Cloud Security platform designed for people.  Globally managing millions of identities in diverse enterprises, EmpowerID offers comprehensive provisioning, single sign-on and access governance coupled with an industry leading user experience.  Built on a single codebase for manageability and scalability, EmpowerID ships with a powerful API, a visual workflow designer and over 400 ready-to-use workflows for rapid deployment.   [![Free Evaluation of EmpowerID](https://no-cache.hubspot.com/cta/default/174819/daebe087-5275-487d-bf53-bb1d39fb9dc4.png)](https://cta-redirect.hubspot.com/cta/redirect/174819/daebe087-5275-487d-bf53-bb1d39fb9dc4) ### Latest Posts ### Posts by category - [2-Factor (2)](https://blog.empowerid.com/blog-1/topic/2-factor) - [Access Governance (36)](https://blog.empowerid.com/blog-1/topic/access-governance) - [Active Directory (46)](https://blog.empowerid.com/blog-1/topic/active-directory) - [Attestation (4)](https://blog.empowerid.com/blog-1/topic/attestation) - [authentication (6)](https://blog.empowerid.com/blog-1/topic/authentication) - [authorization (2)](https://blog.empowerid.com/blog-1/topic/authorization) - [azure (1)](https://blog.empowerid.com/blog-1/topic/azure) - [Azure security (2)](https://blog.empowerid.com/blog-1/topic/azure-security) - [azuread (1)](https://blog.empowerid.com/blog-1/topic/azuread) - [Cisco (1)](https://blog.empowerid.com/blog-1/topic/cisco) - [Citrix (1)](https://blog.empowerid.com/blog-1/topic/citrix) - [cloud (1)](https://blog.empowerid.com/blog-1/topic/cloud) - [cloud security (28)](https://blog.empowerid.com/blog-1/topic/cloud-security) - [consumers (2)](https://blog.empowerid.com/blog-1/topic/consumers) - [Data Governance (5)](https://blog.empowerid.com/blog-1/topic/data-governance) - [dataprivacy (1)](https://blog.empowerid.com/blog-1/topic/dataprivacy) - [DirSync (1)](https://blog.empowerid.com/blog-1/topic/dirsync) - [eic (1)](https://blog.empowerid.com/blog-1/topic/eic) - [Federation (6)](https://blog.empowerid.com/blog-1/topic/federation) - [Gartner (1)](https://blog.empowerid.com/blog-1/topic/gartner) - [GDPR (2)](https://blog.empowerid.com/blog-1/topic/gdpr) - [Governance and Regulatory Compliance (4)](https://blog.empowerid.com/blog-1/topic/governance-and-regulatory-compliance) - [GRC (3)](https://blog.empowerid.com/blog-1/topic/grc) - [Group Management (12)](https://blog.empowerid.com/blog-1/topic/group-management) - [IAG (4)](https://blog.empowerid.com/blog-1/topic/iag) - [IAM (34)](https://blog.empowerid.com/blog-1/topic/iam) - [IDaaS (1)](https://blog.empowerid.com/blog-1/topic/idaas) - [Identity and Access Management (IAM) (68)](https://blog.empowerid.com/blog-1/topic/identity-and-access-management-iam) - [Identity Management (6)](https://blog.empowerid.com/blog-1/topic/identity-management) - [iga (1)](https://blog.empowerid.com/blog-1/topic/iga) - [M365 security (1)](https://blog.empowerid.com/blog-1/topic/m365-security) - [Magic Quadrant (1)](https://blog.empowerid.com/blog-1/topic/magic-quadrant) - [O365 (1)](https://blog.empowerid.com/blog-1/topic/o365) - [Office 365 (3)](https://blog.empowerid.com/blog-1/topic/office-365) - [open policy agent (1)](https://blog.empowerid.com/blog-1/topic/open-policy-agent) - [Palo Alto (1)](https://blog.empowerid.com/blog-1/topic/palo-alto) - [Password management (13)](https://blog.empowerid.com/blog-1/topic/password-management) - [Privacy and EU-US Data Transfers (1)](https://blog.empowerid.com/blog-1/topic/privacy-and-eu-us-data-transfers) - [Privacy Shield (1)](https://blog.empowerid.com/blog-1/topic/privacy-shield) - [Radius (1)](https://blog.empowerid.com/blog-1/topic/radius) - [RBAC (2)](https://blog.empowerid.com/blog-1/topic/rbac) - [Role Based Access Control (RBAC) (40)](https://blog.empowerid.com/blog-1/topic/role-based-access-control-rbac) - [SAML (4)](https://blog.empowerid.com/blog-1/topic/saml) - [Separation of Duties (2)](https://blog.empowerid.com/blog-1/topic/separation-of-duties) - [SharePoint (8)](https://blog.empowerid.com/blog-1/topic/sharepoint) - [siemens (1)](https://blog.empowerid.com/blog-1/topic/siemens) - [Single Sign-on (1)](https://blog.empowerid.com/blog-1/topic/single-sign-on) - [Single Sign-on (SSO) (26)](https://blog.empowerid.com/blog-1/topic/single-sign-on-sso) - [social media (1)](https://blog.empowerid.com/blog-1/topic/social-media) - [SSO (3)](https://blog.empowerid.com/blog-1/topic/sso) - [User provisioning (28)](https://blog.empowerid.com/blog-1/topic/user-provisioning) - [VDS (1)](https://blog.empowerid.com/blog-1/topic/vds) - [Virtual Directory (28)](https://blog.empowerid.com/blog-1/topic/virtual-directory) - [WS-Fed (2)](https://blog.empowerid.com/blog-1/topic/ws-fed) ### Subscribe via E-mail Share This Page [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fscim-vds-virtual-directory-server-1%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fscim-vds-virtual-directory-server-1%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fscim-vds-virtual-directory-server-1%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fscim-vds-virtual-directory-server-1%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fscim-vds-virtual-directory-server-1%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fscim-vds-virtual-directory-server-1%3Futm_medium%3Dsocial%26utm_source%3Demail) ![](https://blog.empowerid.com/hubfs/images/logo-empowerid.svg) 4393 Tuller Road Dublin OH EmpowerID is a registered trademark and trade name of The Dot Net Factory, LLC. EmpowerID © 2021 EmpowerID ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Aditya Taneja", "url" : "https://blog.empowerid.com/blog-1/author/aditya-taneja" }, "dateModified" : "2024-01-12T15:41:20.826Z", "datePublished" : "2023-12-19T08:31:10.000Z", "headline" : "Revolutionizing Azure integration with EmpowerID's SCIM Virtual Directory!", "image" : [ "https://blog.empowerid.com/hubfs/original@2x-Oct-23-2023-12-09-08-5303-PM.png" ], "mainEntityOfPage" : { "@id" : "https://blog.empowerid.com/blog-1/scim-vds-virtual-directory-server-1", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.empowerid.com/hubfs/Asset%201.svg" }, "name" : "EmpowerID" } } ```