skills.rest
mbadali25
mbadali25COMMUNITY
Explore all skills by this author →
WebsiteGitHub

knowbe4-admin

Diagnose KnowBe4 SCIM sync failures and query the Reporting API for user reconciliation.

2|Updated Jul 28, 2026
Search Tags:#api#reconciliation#security awareness#scim#entra id#user provisioning#knowbe4
One-click install
npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill knowbe4-admin-mbadali25
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: knowbe4-admin
Source: https://github.com/mbadali25/useful-claude-add-ons/tree/main/skills/knowbe4-admin
Command: npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill knowbe4-admin-mbadali25

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? KnowBe4 splits reads and writes across four different surfaces (Reporting API, SCIM, ADI, Graph API) with separate credentials, so admins routinely script against an API that physically cannot do what they want, or chase SCIM sync failures across two disconnected log surfaces. This Skill routes every task to the correct surface first, then diagnoses provisioning problems and audits account data. ## Core Features & Use Cases - SCIM/Entra troubleshooting: Symptom-indexed diagnosis of sync failures — Test Mode left on, ADI toggle conflicts, quarantined provisioning jobs, scope misconfiguration, and the ADI-to-SCIM duplicate-account failure mode, with an ordered recovery runbook. - Reporting API client: A stdlib-only Python script (scripts/kb4.py) that handles offset pagination, manual 429 backoff, and regional base URLs to export users, groups, phishing results, and training enrollments as CSV/JSON/table. - Reconciliation and drift detection: Compare KnowBe4 against an IdP or HR export to find orphaned accounts, unprovisioned users, duplicate identities, and per-field attribute drift after a sync. - Use Case: After an ADI-to-SCIM migration doubles the user count, run duplicates to find the split records, fix the userName source attribute in Entra, verify with reconcile and drift in Test Mode, then merge records without losing phishing history. ## Quick Start Ask the assistant to diagnose why KnowBe4 SCIM sync from Entra is creating duplicate users, providing your Reporting API token and region.

Frequently Asked Questions about knowbe4-admin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix duplicate users in KnowBe4 after migrating from ADI to SCIM?▼

Duplicates happen because SCIM matches on userName (default userPrincipalName) while ADI typically used primary SMTP, so where UPN differs from mail a second record is created. Enable Test Mode, align the SCIM userName source attribute with the address ADI used, then merge records in the console rather than deleting the ADI-side record, which holds the phishing and training history.

How do I export KnowBe4 users and phishing results via the API?▼

Use the Reporting API with a token created under Account Settings > Account Integrations > API. The included kb4.py script handles pagination, 429 backoff, and regional base URLs, exporting users, groups, campaigns, security test recipients, and training enrollments to CSV or JSON.

Can the KnowBe4 Reporting API create or update users?▼

No, the Reporting API is strictly read-only. User creation, updates, and archiving go through SCIM 2.0, ADI sync, the Diamond-tier GraphQL Product API, or the console, each with its own separate credential.

Why does KnowBe4 SCIM sync say success but nothing changes?▼

The most common cause is Test Mode still enabled in KSAT, which runs sync cycles and generates healthy-looking reports without adding or archiving anyone. Also check that the account is not still on the ADI toggle, that users are actually assigned in Entra, and that the provisioning job is not quarantined.

Why do my KnowBe4 console edits keep reverting?▼

If users show adi_manageable: true in the Reporting API, AD Integration owns those records and overwrites console changes at the next sync. The fix belongs upstream in AD or the IdP, not in KnowBe4, and re-applying changes by script only creates a loop.

Does KnowBe4 support Provision on demand from Entra?▼

No, on-demand provisioning is not supported by the KnowBe4 integration and fails misleadingly as a diagnostic. Force a cycle from KSAT under SCIM Settings > Force Sync Now, or wait for the automatic 40-minute cycle.

Related Skills

Explore More Software Engineering Skills→
TheViziusGroupTheViziusGroup
1

okta-workflows-connectors

Documents ten quirks of Okta and Microsoft Entra ID connectors in Okta Workflows.

Official
Intermediate
cockroachdbcockroachdb
3

configuring-sso-and-scim

Configure SSO and SCIM integration for CockroachDB across Cloud Console, DB Console, and SQL/Cluster.

Official
Advanced
AxxxxxxaaannAxxxxxxaaann

building-identity-governance-lifecycle-process

Automate identity governance lifecycles across HR, directories, and applications.

Community
Advanced
KohlexKohlex

ac-trace

Analyze plan-time acceptance criteria for traceability to Foundation directives.

Official
Advanced