Azure AD/ Entra ID SCIM provisioning

Set up Azure AD/ Entra ID to provision your team or district’s SCIM (System for Cross-domain Identity Management).

• Create users - Users in Azure AD/ Entra ID assigned to the Canva App are added as members of the organisation in Canva.
• Update user attributes - Updates made to the user's profile through Azure AD/ Entra ID will be pushed to Canva.
• Deactivate users - Deactivating the user through Azure AD/ Entra ID will lock the user in Canva.
• Create groups - Groups created in Azure AD/ Entra ID can also be created in Canva as a Group under the Canva brand.
• Update group - Updates made to the group’s profile or membership change through Azure AD/ Entra ID will be pushed to Canva.

Azure's built-in Canva application supports SCIM by default. To set up SCIM, complete the setup instructions in Azure AD/ Entra ID SAML configuration for Canva Enterprise or Azure AD/ Entra ID SAML configuration (For Education).

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose
   Settings.
4. From the side menu, select the
   SSO and provisioning tab.
5. Under Single Single Sign-On (SSO) section, click Manage.
6. Choose Configure Provisioning.
7. Under Provision Accounts for your team, select Add provisioning method.
8. Choose SCIM, then turn on Enable SCIM user provisioning.
9. Copy the access token.

1. Open the Canva app you’ve set up in Azure AD/ Entra ID.
2. From the side menu under Manage, select Provisioning.
3. Next to Provisioning Mode, select Automatic from the dropdown.
4. Under Admin Credentials, input the following:
   • Tenant URL: https://www.canva.com/_scim/v2
   • Secret Token: enter Canva’s access token from Step 2

5. To verify the connection, click Test Connection.
6. On top of the settings window, click Save.

If you need to test automated provisioning for a small number of users before rolling out to everyone, we recommend configuring scoping filters for users and groups first. See Scoping users or groups to be provisioned with scoping filters for instructions.

1. Under the Mappings, select Provision Azure Active Directory/ Entra ID Users.
2. Under the Target Object Actions, make sure to only select Create and Update.
3. Under Attribute Mappings, configure them as follows:

4. It’s important that the SAML nameId attribute matches the SCIM userName attribute above. Ensure that in the Single sign-on configuration, the Unique User Identifier is mapped to user.userprincipalname, like below:

5. Click Save.

1. Under Mappings, select Provision Azure Active Directory/ Entra ID Groups.
2. Under Attribute Mappings, configure them as follows:

3. Click Save.

Groups aren’t required and can be disabled if you don't want them. Otherwise, any group assigned to Canva will be created.

1. From the sidebar, go to the Monitor section.
2. Select Provisioning logs to see what SCIM actions have been run.

Azure’s/ Entra ID's provisioning cycle generally runs every 40 minutes. So there may be delays in propagating the changes in your Active Directory to relevant users and groups in Canva.

Ensure that your AD Users have the email property populated in their profiles.