Configuring SAML SCIM for Entra ID

Overview

SCIM (System for Cross-domain Identity Management) lets your identity provider (IdP) manage Brilliant accounts automatically. Once it's configured with Microsoft Entra ID:

Assigning a user to the Brilliant app in Entra creates their Brilliant account.
Unassigning or disabling the user deactivates their Brilliant account. Accounts are never deleted, and order history is kept.
Entra group membership controls which Team Stores each user can access.

Before you begin

You'll need:

An Entra role that can manage enterprise applications, such as Application Administrator.
Admin access to Brilliant.
Brilliant SSO already set up in Entra. If it isn't, follow our SSO guide first. Provisioning is configured on that same enterprise application.

How stores map to groups

Brilliant has two types of stores:

Company Store: available to every user in your company. Users get access automatically, whether they're provisioned through SCIM or created at first SSO sign-in. No special access is needed to browse or buy.
Team Store: limited to a specific team, department, or region. Examples include an HR store for new-hire or anniversary gifts, or a regional sales store for North America or Asia-Pacific.

Each Entra group assigned to the Brilliant app corresponds to a Team Store. Adding a user to the group gives them access to that store, and removing them revokes it.

The group's name in Entra must exactly match the Team Store's name in Brilliant, and the match is case-sensitive. For example, "HR Gifting" and "HR gifting" won't match.

If your Entra license includes Discover identities, you can use it in the Provisioning panel to find existing Brilliant accounts and groups.

Step 1: Get your SCIM token from Brilliant

In Brilliant, go to Azure SAML Integration settings.
Copy the SCIM Bearer Token. Treat it like a password.

If the token is regenerated, the old one stops working immediately. Paste the new token into Entra's Secret Token field right away, or provisioning will fail.

Step 2: Connect Entra to Brilliant

In the Microsoft Entra admin center, go to Enterprise applications, open your Brilliant app, and select Manage → Provisioning.
Set Provisioning Mode to Automatic.
Under Admin Credentials:
- Tenant URL: https://app.brilliantmade.com/scim/
- Secret Token: paste the token from Step 1.
Click Test Connection. You should see a success message.
Click Save.

Step 3: Configure user mappings

Under Mappings, open Provision Microsoft Entra ID Users and make sure these attributes are mapped:

Brilliant (SCIM) attribute	Entra source attribute	Notes
`userName`	`mail` or `userPrincipalName`	Must be the user's email address. It must also match the email your SSO app sends.
`externalId`	`objectId`	Entra's default source is `mailNickname`. Edit the mapping and change the source to `objectId`.
`active`	(keep the default)	Controls whether the account is active or deactivated.
`displayName`	`displayName`

About userName: if your users' UPNs aren't their email addresses (for example [email protected]), change the source attribute to mail. Keep userName set as the matching attribute.

Brilliant ignores all other attributes, so you can delete them from the mapping.

Step 4: Configure group mappings

Open Provision Microsoft Entra ID Groups and make sure these attributes are mapped:

Brilliant (SCIM) attribute	Entra source attribute
`displayName`	`displayName`
`externalId`	`objectId`
`members`	`members`

Step 5: Assign users and groups, then turn on provisioning

In the Brilliant app, go to Users and groups. Assign the users who need Brilliant access, plus the groups that correspond to your Team Stores.
Back in Provisioning, open Settings and set Scope to Sync only assigned users and groups.
Set Provisioning Status to On and click Save.

The first sync starts shortly after that. Later syncs run automatically about every 40 minutes. To test with a single user right away, use Provision on demand.

Existing Brilliant users

Users who already have Brilliant accounts, for example from SSO sign-in, are matched by email address and won't be duplicated.

Troubleshooting

Test Connection fails: check that the Tenant URL is exact. If the token was regenerated in Brilliant, paste the new one into Entra.
Users aren't appearing: check Entra's Provisioning logs. The usual causes are users not assigned to the app, or the scope being set to all users.
Team Store access isn't applied: confirm the Entra group is assigned to the app and that its name matches the Team Store name exactly, including capitalization.

Questions?

Email [email protected] for help with SSO or SCIM.