Update to the newest Dropbox for Business application using Azure AD

With the newest version of the Dropbox for Business application, you’ll be able to see your Azure AD groups in Dropbox, and when a user’s assignment of Dropbox is removed in Azure, the user will now go into a 30-day suspension period before being removed from the team.

This article describes how to set up the Dropbox SCIM-based application by configuring a new Dropbox Enterprise Application in Azure AD. There are two ways to do so:

• Standard update: Recommended for customers who can afford some downtime with their Dropbox application and don’t have a large number of active users.
• Advanced update: Recommended for customers who cannot afford any downtime with their Dropbox application and have a large number of active users.

Standard update

Step 1: Test the new application

We recommend you test the new application before migrating to the new Dropbox for Business application. To do so:

1. Sign in to the Azure portal.
2. In Azure Active Directory, click Enterprise Applications and select your existing Dropbox application.
3. Under Manage, click Provisioning.
4. Under Settings, toggle Provisioning Status to Off.

5. In Azure Active Directory, click Enterprise Applications.
6. Click New Application.
7. Add a new Dropbox application instance to your Azure tenant. This application will use the new Dropbox SCIM-based provisioning integration.
8. Configure the new Dropbox application for provisioning from your Azure tenant and enable provisioning to start the new Dropbox SCIM-based application.
9. Under Manage, click Users and groups.
10. Assign one or more users or groups to start your test of provisioning users.
11. Once you’re done testing, under Manage, click Properties, then Delete to remove the test application.

Step 2: Create a new application

Once you’ve finished testing you’ll need to create your new Dropbox for Business application. To do so:

1. In Azure Active Directory, click Enterprise Applications.
2. Click New Application.
3. Add a new Dropbox Enterprise Application to your Azure tenant. This application will use the new Dropbox SCIM-based provisioning integration. You may want to rename the application to differentiate from your old application.

Step 3: Configure the new application

Once you’ve created the new application, you’ll need to disable single sign-on for the old application and configure your settings and preferences to match the old application. It’s helpful to reference the old application as you do this.

To disable single sign-on for the old application:

1. In Azure Active Directory, click Enterprise Applications and choose your old Dropbox Business application.
2. Under Manage, click Single sign-on.
3. From the top, click Change single sign-on mode.
4. Click Disabled to turn off single sign-on.

To configure your new application:

1. In Azure Active Directory, click Enterprise Applications.
2. Choose your new Dropbox Business application.
3. Under Manage, click Users and groups. Mirror old application settings in new application. Keep in mind while configuring, the new application allows for provisioning of groups to Dropbox.
4. Under Manage, click Single sign-on. Reconfigure single sign-on settings.
   • Learn how to configure SSO, add users, and sync groups with Dropbox.
5. Under Manage, click Provisioning. Set mode to automatic.

6. Authorize the Dropbox connection and click Save.
7. Under Mappings, configure your user and group mappings to mirror old application. Under Settings keep Provisioning Status to Off.
8. Configure any other additional settings under Manage and Security.
9. Review and finalize all settings in new application.

Step 4: Switch provisioning to the new application

Once you’ve configured your new application, you can safely switch over to the newly created application by turning off provisioning on the old application and turning on provisioning on the new application. To do so:

1. In the Azure Active Directory, click Enterprise Applications and select your existing Dropbox application.
2. Under Manage, click Provisioning.
3. Under Settings, toggle Provisioning Status to Off.  

4. Navigate to your newly created and configured application.
5. Under Manage, click Provisioning.
6. Under Settings, toggle Provisioning Status to On. 

How to switch back to the legacy Dropbox application

If you experience any issues or need to switch back to the legacy Dropbox application, you can pause provisioning on the new connector and restart provisioning on the legacy application.

Advanced update

Step 1: Test the new connector before migration

We recommend you test the new connector before migrating to the new version of the Dropbox for Business application. 

1. Sign in to the Azure portal.
2. In the Azure Active Directory, click Enterprise Applications and select your existing Dropbox application.
3. Under Manage, click Provisioning.
4. Under Settings, toggle Provisioning Status to Off.

5. In the Azure Active Directory, click Enterprise Applications.
6. Click New Application.
7. Add a new Dropbox application instance to your Azure tenant. This application will contain the new Dropbox SCIM-based user provisioning job.
8. Configure the new Dropbox application for provisioning to your current Azure tenant and enable provisioning to test the new Dropbox SCIM-based user provisioning job.

Step 2: Pause the old synchronization job

To pause the old synchronization job:

1. In the Azure Active Directory, click Enterprise Applications and select your existing Dropbox application.
2. Under Manage, click Provisioning.
3. Under Settings, toggle Provisioning Status to Off.

You can also pause the old synchronization job with Microsoft Graph Explorer.

Step 3: Create a new SCIM-based synchronization job using the Graph Explorer

1. In the Azure Active Directory, click Enterprise Applications and select your existing Dropbox application.
2. Under Manage, click Properties.
3. Copy the Object ID.

4. In a new web browser window, go to Graph Explorer and log in as the administrator for the Azure AD tenant where your app is added.
5. Run the command below with the Object ID copied from step 3 to create a new SCIM-based synchronization job.

Note: You can pause and restart synchronization jobs associated to your application whenever needed. To do so:

1. Run the command below to see a list of all the existing synchronization jobs which can either be disabled, activated or paused.

2. In the results, copy the full "ID" string that belongs to the job.
   • Jobs starting with DropboxOutDelta belong to the old synchronization job
   • Jobs starting with DropboxSCIMOutDelta belong to the SCIM-based synchronization job 
3. Run either of the following commands using the same [object-id] as before, and replace [job-id] with the provisioning job ID from step 2.

To pause a job:

Step 4: Reconfigure mappings

User and group mappings will not automatically import when you update. To reconfigure mappings:

1. In the Azure Active Directory, click Enterprise Applications and select your existing Dropbox application.
2. Under Manage, click Provisioning.

3. Under Mappings, configure your user and group mappings.
4. Verify your provisioning configuration and re-enable provisioning.

How to switch back to the legacy Dropbox provisioning job

If you’d like to switch back to the legacy Dropbox provisioning job, you need to pause the SCIM provisioning job and restart the old sync job.  If this doesn’t work, you may need to delete the SCIM provisioning job by running the following script: