SCIM provisioning from Microsoft Entra ID

This builds on your Entra enterprise application — set up SAML sign-in first if you haven't, then add provisioning to the same application.

First, in Settings → Organization here, generate a provisioning token under Automatic provisioning and copy the SCIM base URL and bearer token — the token is shown once.

1. On the enterprise application, open Provisioning and set the mode to Automatic.
2. Paste our SCIM base URL as the Tenant URL and the bearer token as the Secret Token, then use Test Connection — Entra verifies it can reach us and authenticate.
3. Keep the default attribute mappings: userName mapped to the user's email address is what we expect, and the standard name mappings carry the display name through.
4. Turn provisioning On and assign the users or groups Entra should manage here.

Entra provisions on its own cycle (typically every forty minutes or so) rather than instantly, which is normal. Assigned people get accounts here — verified, enrolled, seated — and people Entra disables or removes are deprovisioned, keeping their account and certificate on record per our deprovisioning policy. Seat-limit refusals appear in Entra's provisioning logs and resolve themselves on the next cycle after you add seats.