SCIM provisioning with Microsoft Entra ID, step by step

With SCIM provisioning, Microsoft Entra ID automatically creates, updates, disables and removes your organization's people and groups. Entra's menus change over time; also follow Microsoft's current documentation.

Before you start

Create a token with both scopes under «Manage» › «SCIM tokens» and keep the «Tenant URL» and the «Secret token» at hand. See SCIM tokens.

Step 1: create the application in Entra

1. In the Entra admin center, open Enterprise applications and create a non-gallery application.
2. Under Provisioning, set the mode to Automatic.

Step 2: connect it to the service

1. Tenant URL: the «Tenant URL» (https://<organization address>/scim/v2).
2. Secret Token: the «Secret token».
3. Choose Test Connection.

Step 3: user mappings

Keep:

• userPrincipalName → userName (the sign-in name; stored lowercase);
• objectId → externalId;
• mail → emails[type eq "work"].value;
• the IsSoftDeleted to active mapping.

Remove attributes you do not need.

Step 4: group mappings

Keep displayName → displayName, objectId → externalId and members → members.

Step 5: assign and start

1. Assign the users and groups to the application.
2. Use Provision on demand with one person to check.
3. Start provisioning.

New Entra applications send standard PATCH requests; older ones can be moved with the aadOptscim062020 flag in the Tenant URL. The service accepts both forms.

Check

People appear under «Manage» › «Users» and groups under «Manage» › «Groups» (named scim-…). People then sign in with a passkey or phone; SCIM sets no passwords.

Problems

• Test Connection fails with 401: wrong, expired or revoked token.
• 403 when creating people: the licence has no free seats.

See SCIM behaviour.