SCIM provisioning
Settings → SSO & provisioning is also where your organisation generates the SCIM token Entra ID uses for automatic joiner/mover/leaver sync — see SCIM provisioning end to end for the full identity-provider setup.
What it is
SCIM user provisioning sits in the same card group as SSO, just below it, with one action: Generate SCIM token. The endpoint is /scim/v2/Users, following the SCIM 2.0 standard your identity provider already speaks. It’s an Enterprise-plan feature and a different job to SSO — SSO governs how someone signs in, SCIM governs whether their account exists here at all.
Before you start
SCIM requires the Enterprise plan and organisation-admin access to Settings, a level higher than most other Settings sections.
How to do it
- Open Settings → SSO & provisioning and scroll to SCIM user provisioning.
- Click Generate SCIM token. The tenant URL and secret token are both shown once — copy them now.
- In Entra ID, go to Enterprise applications → Provisioning, and paste the tenant URL and secret token there.
- New users provisioned this way arrive as surveyors, with your seat limits still enforced.
How it integrates
Generating a new token immediately invalidates the previous one, so rotating it deliberately cuts off a retired or compromised connection without disrupting SSO sign-in itself — the two are configured independently even though they share a settings card group. Deactivating a user through SCIM disables their access instantly; it never deletes their evidence, notes or audit history.
Common problems
- The token I just copied doesn’t work. It’s shown once at generation time and can’t be retrieved again — generate a new one and update your identity provider’s configuration with it.
- I regenerated the token and provisioning stopped. That’s expected — the previous token is invalidated the moment a new one is minted; update your identity provider’s provisioning configuration with the new one.
- The whole card group shows an upgrade notice. SCIM, and SSO alongside it, is an Enterprise-plan feature — the rest of Settings is unaffected below that tier.