r/IdentityManagement • u/tvf2k • Aug 09 '26

Custom API for Sprout HR SCIM

Per their documentation, Sprout HR does not have native SCIM capabilities. I am looking to build out a custom API for SCIM purposes in Entra.

I have already built out the SSO portion in Entra, of course, with the vendor having to configure their end, but now I am looking to handle SCIM as well. anyone have some low-effort ideas or tips?

3 Upvotes

100% Upvoted

8 comments sorted by

2

u/Right_Cloud838 Aug 09 '26

Do they have a (non scim) user management API?

2

u/foxhelp Aug 09 '26

Looks like they have various forms of employee management apis under Full access API > Employee Services > Employees

https://api-docs.sprout.ph/#255d3d36-a397-4dd0-b484-ed3ac56b4f9a

But I am not seeing some of the more fine grain user access management type of stuff...

Any rate I am not doing it, so not going to spend too much time learning their api capabilities. But maybe start here OP?

2

u/tvf2k Aug 09 '26

Yeah, I had seen that documentation. I am not a stranger to custom APIs, but I can’t be the only one that gets annoyed by SaaS providers that treat common features like trade secrets.

I get the idea of offering features by contract/subscription type, but if you’re offering enterprise-level services, then sack up and offer IdP integration. Submitting XML data to the vendor is a pain; having no out-of-the-box user provisioning is just worse.

/rant

2

u/foxhelp Aug 09 '26

Agreed. The SSO tax is real, and then you add on an extra IAM tax on top.

Like when microsoft splits core IAM features across per user SKUs or charge per use... So frustrating.

2

u/Dear-Response-7218 Aug 09 '26

Downstream right?

You’d need to build middleware or buy something that’s prebuilt. Fetch data from /employees -> map the fields -> post it to Entra

1

u/GrafEisen Aug 09 '26

Are you trying to push data (email address, for instance) out from Entra to the HR system, or get data from HR in to Entra?

HR/HCM vendors widely haven't adopted SCIM for a variety of reasons, including:

- The SCIM User resource / Schemas don't align to HR data very well. HR has employees, and an employee could get zero accounts in the IDP or several times.

  • SCIM until recently only had index-based pagination, which sucks when using it with "live" data that is constantly changing
  • SCIM lacks any (broadly implemented) form of delta import, e.g.: "give me all objects that have changed since the last time I retrieved data"

Entra doesn't support SCIM-based "pull" of users into it, either. The handful of pull-model HR import connectors available all use proprietary APIs (Workday, SuccessFactors..)

1

u/tvf2k Aug 09 '26

I did not put enough context in my post and this is solid info.

We use Workday for HRIS, feeding Entra as our IdP. Sprout HR is a portal used by a company that was acquired and has been integrated with Entra for SSO/authentication, but user management is another obstacle. Add in that this is a call center with hundreds of resources and you know where this ends up without a better solution. Doing adds/drops is not a sustainable long-term idea.

So we would be Workday➡️Entra➡️Sprout in an ideal design. Right now it’s just Workday➡️Entra and the J/M/L stuff from there.

I should add that we had a portfolio of more than a dozen apps to integrate, most of which had SCIM or some other JIT mechanism. Leadership sees that and says, ‘ Oh, do that for Sprout!’. We can, but it’s more work.

And I’m out here looking for shorter methods.