People and groups through SCIM

In this tutorial, we connect your directory through SCIM. Microsoft Entra ID or Okta create, update and remove the organisation's people and groups, with no manual work. First, the token. Under Manage, SCIM tokens, choose Create token. Give it a name, for example Entra production, choose the users and groups scopes, and the validity. The console shows the organisation URL and the secret token.

The secret is shown only once: copy both into the identity provider. The service keeps only a fingerprint of the token. In Entra ID, create a non-gallery enterprise application and set provisioning to automatic. In Tenant URL, paste the organisation URL; in Secret Token, the token. Choose Test Connection. In the mappings, keep the principal name as userName, the object ID as externalId, the email, and the active state.

Assign the users and groups, try it with one person, and start provisioning. In Okta, create an integration with SCIM 2.0 provisioning. The base URL is the organisation URL, the unique identifier is userName, and authentication is by header, with the token. Turn on creating, updating and deactivating users, and push the groups. People appear under Manage, People, and groups under Manage, Groups, with their directory names.

In the console, the Last used column shows the provider is using the token. When someone leaves the company and is deactivated in the directory, the account is deactivated here, and their sessions end. SCIM doesn't set passwords: people sign in with a passkey or the phone. And it never creates or promotes administrators. To rotate the token, choose Rotate token and decide how long the old one keeps working.

Copy the new secret to the provider. Revoking is immediate. If the provider gets a 401 error, the token is wrong, expired or revoked. A 403 error when creating people usually means the licence has no free seats. And that's it: people and groups come from the directory, and leave when they leave the company.