Microsoft 365 SCIM

Microsoft Entra ID (Microsoft 365) can keep people on the platform in sync via SCIM Bridge (recommended) or Native Use the tabs below to follow the path that matches the way you want to sync.

SCIM Bridge

Recommended

Pentru Microsoft Entra ID, preferaţi SCIM BridgeEntra’s output SCIM support is limited in practice; the bridge reads Microsoft Graph in one program and reliably reconciles the people of the organization.

This guide guides you through the configuration of the Bridge platform for automatic synchronization of Microsoft 365 users (Entra ID) into the platform via SCIM.

Prerequisites

• Microsoft Entra ID administrator access (to register an application and give administrator consent)
• the platform organization administrator access
• The ability to create an application record in your tenant Enter

How it works

Microsoft 365 Bridge connects to Microsoft Graph using OAuth2, retrieves your organization’s directory users and synchronizes them with the platform via the SCIM endpoint.

• New usersCreates platform accounts for tenant members found in Entra ID
• Updated usersSyncs changes to attributes (name, title, department, and so on)
• Removed or disabled usersDisable platform accounts when members leave or are disabled
• Excluded usersSkips users you have explicitly excluded by email
• GuestsB2B invited users (userType Guest) are not provided

Mapped attributes

Microsoft Graph field	SCIM Attribute
mail (fallback userPrincipalName)	userName, emails
displayName	displayName
givenName	name.givenName
surname	name.familyName
accountEnabled	active
jobTitle	title
department	enterprise:department
companyName	enterprise:organization
employeeId	enterprise:employeeNumber
preferredLanguage	preferredLanguage
id	externalId

Step 1: Register an Entra ID application

1. Signed to Microsoft Entra admin center

2. Go to Identity → Applications → App registrations → New registration

3. Configure the application:

   Field	Value
   Name	Probo SCIM Bridge
   Supported account types	Accounts in this organizational director only
   Redirect URI	Platform Web, URI https://your-probo-domain.com/api/console/v1/connectors/complete

4. Click Register

5. in the application Overview, copy the Application (client) ID

6. Go to Certificates & secrets → New client secret, create a secret, and copy its Value (shown only once)

Step 2: Grant Microsoft Graph permissions

1. In the recording application, go to API permissions → Add a permission → Microsoft Graph → Delegated permissions

2. Add:

   Permission	Purpose
   openid, profile, offline_access	Sign-in and refresh token
   User.Read.All	Read directory user profiles
   Directory.Read.All	Read organizational directory data

   If you use Microsoft 365 as access review source, the platform connector may request additional Graph permissions, such as AuditLog.Read.All and RoleManagement.Read.Directory during authorization.

3. Click Giving consent to the owner and confirm

Step 3: Configuring the bridge on the platform

1. Log in to the platform as an organization administrator

2. Go to Organization Settings → Authentication → Auto-Provisioning

3. Click Add Connector and select Microsoft 365

4. Enter your OAuth credentials:

   Field	Value
   Client ID	Your application ID Enter (client)
   Client Secret	The Customer’s Secret Value in Step 1

5. Click Authorize to complete the OAuth stream – you will be redirected to Microsoft to grant access

6. After authorization, the Bridge connector will appear as Pending

Step 4: Configure exclusions (optional)

If you have service accounts, shared mailboxes or other users that should not be provided on the platform:

1. In the Bridge Connector settings, access Excluded Users
2. Add user email addresses to exclude (insensitive case)
3. Click Save

Excluded users will be ignored during synchronization.If an excluded user was previously envisaged, it will be removed in the next synchronization cycle.

Step 5: Verify synchronization

Once Bridge is set up, it will begin to synchronize in its regular schedule (approximately every 30 seconds for surveys, with a synchronization time of 5 minutes).

1. Go to Organization Settings → Authentication → Auto-Provisioning
2. Check the state of the bridge - it should pass from Pending to Syncing Şi apoi la Active
3. Go to People to verify users have been provisioned
4. Check the Event Log for detailed sync activity

Setting a user’s role

the platform membership roles (Owner, Adminand so on) are assigned in People or mapped with SAML Role Attribute. SCIM creates people as Employee by default.

Separately, synchronizing a job title helps the platform assign policies and perform meaningful access assessments.Without these profile fields, a user can still register, but it is harder to evaluate for access with the least privileges.

Microsoft Graph syncs Job title (jobTitle) to the platform via the SCIM bridge. Job informationThen wait for the next synchronization cycle.

Sfat

Keep job titles consistent throughout the team (avoid free-form variations such as Eng, SWE, Engineer for the same role) so that access to group reviews is clean.

Troubleshooting

Bridge stuck in “Pending”

• CauseOAuth authorization has not been completed, administrator consent is missing or the token has expired
• SolutionConfirm administrator consent for User.Read.All and Directory.Read.All, then authorize the Microsoft 365 connector again

Bridge in “Failed” state

• Cause: A synchronization error occurred (network problem, Graph rate limit, invalid credentials)
• Solution: Check the event log for error details. The bridge will automatically resume with exponential downgrading. If the problem persists after 10 consecutive failures, the bridge will be disabled – solve the underlying problem and activate it manually.

Users not appearing

• CauseUsers are B2B guests, a mail/UPN is missing or Graph permissions are incomplete
• Solution: The bridge only synchronizes with tenant members (userType eq 'Member'). Confirms that the user has a mail or userPrincipalName and that the administrator's consent has been given

Stale users not deactivated

• CauseUsers may be in the exclusion list or synchronization has not yet completed a full cycle
• Solution: Check the exclusion list and wait for the next synchronization cycle

OAuth token expired

• Cause: The refresh token has been revoked or has expired
• SolutionBridge automatically updates OAuth tokens, but if the update token itself is revoked (for example, the secret has been turned or consent has been withdrawn), you will need to authorize again

Native

Prefer the Bridge when you can

The native push from Entra ID works, but the output SCIM behavior of Entra is limited in practice. SCIM Bridge unless you specifically need Native push provisioning.

This guide guides you through configuring Microsoft Entra ID’s Native SCIM provisioning so that allocated users are pushed into the platform.

Prerequisites

• Microsoft Entra ID Administrator Access (Global Administrator or Application Administrator)
• the platform organization administrator access
• A Microsoft 365 subscription with Entra ID P1 or higher (required for automatic provisioning)

How it works

In native mode, Microsoft Entra ID pushes user changes to the platform’s SCIM 2.0 endpoint. When you assign users or groups to the platform’s Enterprise app in Entra ID, it:

• Creates Platform accounts for newly allocated users
• Updates user attributes when switching to Entra ID
• Deactivates Platform accounts when users are not assigned or deactivated
• Deletes Platform accounts when users are permanently removed (if they are configured)

Mapped attributes

Core User attributes:

Entra ID Field	SCIM Attribute	Notes
userPrincipalName	userName	Required, unique
displayName	displayName
givenName	name.givenName
surname	name.familyName
ImmutableId	name.formatted
honorificPrefix	name.honorificPrefix
honorificSuffix	name.honorificSuffix
mailNickname	nickName
accountEnabled	active
mail	emails[type eq "work"].value	Multi-valued
telephoneNumber	phoneNumbers[type eq "work"].value	Multi-valued
streetAddress, city, state, postalCode, country	addresses	Multi-value, with streetAddress, locality, region, postalCode, country sub-attributes
jobTitle	title
userType	userType
preferredLanguage	preferredLanguage
usageLocation	locale
preferredDataLocation	timezone
mysiteUrl	profileUrl

Enterprise User Extension attributes:

Entra ID Field	SCIM Attribute
employeeId	enterprise:employeeNumber
companyName	enterprise:organization
department	enterprise:department
division	enterprise:division
costCenter	enterprise:costCenter
manager	enterprise:manager.value

Step 1: Generate SCIM credentials in the platform

1. Log in to the platform as an organization administrator

2. Go to Organization Settings → Authentication → Auto-Provisioning

3. Click Add Connector and select SCIM

4. Copy the SCIM Endpoint URL and Bearer Token

   Attention

   The carrier token is displayed only once. Store it securely - you will need it in the next step.

Step 2: Creating an enterprise application in Entra ID

1. Signed to Microsoft Entra admin center

2. Go to Identity → Applications → Enterprise applications

3. Click + New application → Create your own application

4. Enter the following:

   Field	Value
   Name	Probo
   What are you looking to do?	Integrate any other application you don't find in the gallery (Non-gallery)

5. Click Create

Step 3: Configure provisioning

1. In the Enterprise Platform application, access Provisioning in the left sidebar

2. Click get Started

3. Set Provisioning Mode to Automatic

4. Under Admin Credentials, enter:

   Field	Value
   Tenant URL	The endpoint URL of the SCIM platform (for example https://your-probo-domain.com/api/connect/v1/scim/2.0)
   Secret Token	The Token of the Carrier in Step 1

5. Click Test Connection to verify Entra ID can reach the SCIM platform

6. Click Save

Step 4: Configure attribute mappings

Default attribute mappings work for most settings. To review or customize them:

1. In the Provisioning page, expand Mappings
2. Click Provision Microsoft Entra ID Users
3. Attribute mapping review - Default map of platform-supported SCIM attributes
4. Adjust maps if necessary (e.g. maps employeeId to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber)
5. Click Save

Sfat

You can remove the mapping of attributes that you do not use. Only userName, displayName and active are required by the platform.

Step 5: Assign users and groups

1. In the Enterprise Platform application, access Users and groups
2. Click + Add user/group
3. Select the users or groups you want to provide to the platform
4. Click Assign

Only assigned users (or members of assigned groups) will be provided. This gives you fine control over who receives a platform account.

Step 6: Start provisioning

1. Go back to Provisioning
2. Set Provisioning Status to On
3. Click Save
4. Entra ID will start an initial delivery cycle – this can take a few minutes, depending on the number of users

After the initial cycle, Entra ID runs incremental synchronization approximately every 40 minutes to push any changes.

Step 7: Verify provisioning

1. In Entra ID, go to Provisioning → Provisioning logs To view the synchronization activity
2. On the platform, go to People to verify users have been provisioned
3. Check Organization Settings → Authentication → Auto-Provisioning → Event Log for detailed SCIM events

Setting a user’s role

the platform membership roles (Owner, Adminand so on) are assigned in People or mapped with SAML Role Attribute. SCIM creates people as Employee by default.

Separately, job title and employee type synchronization helps the platform assign policies and carry out significant access revisions:

• Job title → profile title (for example, Software Engineer)
• Employee type → employment type context (for example, Full-time, Contractor)

1. In the Microsoft Enter Admin Center, go to Identity → Users → All users
2. Select the user you want to update.
3. Click Edit properties, then open the Job information tab
4. Set the Job title field
5. Set the Employee type field if you use it
6. Click Save
7. Wait for the next Entra supply cycle (or resumption of supply) for the values to appear on the platform

Sfat

Keep job titles and job types consistent throughout the team (avoid free-form variations such as Eng, SWE, Engineer for the same role) so that access to the group of people is clean.

Troubleshooting

Test Connection fails

• CauseThe SCIM endpoint URL or carrier token is incorrect or a firewall blocks the connection
• SolutionCheck the endpoint URL that includes the entire route (which ends in /scim/2.0). Re-generate the carrier token in the platform if necessary. Make sure your network allows HTTPS output from Entra ID to your platform instance.

Users not being provisioned

• CauseUsers or groups are not assigned to the Enterprise application or provisioning is not enabled
• Solution: Verify that users are assigned under Users and groups Şi aceasta Provisioning Status It is established to On

Provisioning errors in logs

• Cause: Attribute mapping conflicts or missing required attributes
• Solution: Check the Provisioning logs • Make sure that userName is mapped to a unique value that is not empty (usually userPrincipalName or mail)

Users not deactivated after removal

• CauseEntra ID may still process the change or the user has been deleted
• Solution: Check provisioning logs for the deprovisioning event.Entra ID processes changes during the next synchronization cycle (approximately every 40 minutes).For immediate effect, trigger a manual synchronization by clicking Restart provisioning in the Provisioning page.

Duplicate users

• Cause: userName in Entra ID does not match an existing e-mail address of the platform user
• Solution: Make sure that the attribute mapped to userName matches the email format used on the platform. You may need to adjust the mapping to use mail instead of userPrincipalName.

Combining with SSO

For the best experience, combine SCIM provisioning with SAML SSO:

1. SCIM user life cycle management – automatic creation and deactivation of accounts
2. SAML SSO Manages authentication – users log in with Microsoft credentials

This means that users automatically get platform accounts when they join your organization and lose access when they leave, without the need for manual account management.

Microsoft Entra ID SSO Set up SAML SSO alongside SCIM provisioning

SCIM Overview Compare Native and Bridge synchronization modes