> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM with Microsoft Entra ID

> Automatically provision users and groups from Microsoft Entra ID (formerly Azure AD) into TrueFoundry using SCIM 2.0.

This guide explains how to push users and groups from Microsoft Entra ID into TrueFoundry automatically using SCIM 2.0. With SCIM enabled, assigning a user to your Entra application creates them in TrueFoundry; removing the assignment deactivates them. Entra group memberships sync as TrueFoundry teams.

## Prerequisites

* Single sign-on between TrueFoundry and Entra is already configured. Follow [SAML with Microsoft Entra ID](/docs/platform/sso/entra/saml) or [OIDC with Microsoft Entra ID](/docs/platform/sso/entra/oidc) first.
* You have **Admin** access in both TrueFoundry and Entra.
* You're on TrueFoundry **v0.143** or higher. (On earlier versions, SCIM is configured directly inside the SSO form.)

<Warning>
  Entra's SCIM implementation has a few well-known quirks. If sync behaves unexpectedly, see the [Troubleshooting](#troubleshooting) section below and Microsoft's [SCIM compatibility flags](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility) reference.
</Warning>

## Step 1 — Generate the SCIM credentials in TrueFoundry

<Steps>
  <Step title="Enable SCIM provisioning">
    In TrueFoundry, go to **Settings → Security & Access → Provisioning** and turn on the **SCIM** toggle.
  </Step>

  <Step title="Open View Config">
    On the **Provisioning** page, click **View Config** on the **SCIM** row.

    <Frame caption="Provisioning — click View Config on the SCIM row">
      <img src="https://mintcdn.com/truefoundry/OlEFjoHwZJ0edSjd/images/sso/entra/scim-provisioning-view-config.png?fit=max&auto=format&n=OlEFjoHwZJ0edSjd&q=85&s=7283f1e2d8c8b237ea0942a7eda2d75e" alt="TrueFoundry Provisioning settings with the SCIM row and View Config button highlighted" width="713" height="294" data-path="images/sso/entra/scim-provisioning-view-config.png" />
    </Frame>
  </Step>

  <Step title="Copy the SCIM URL and token">
    In the **SCIM configuration** dialog, copy both values using the copy icons next to each field:

    * **SCIM URL** — this is the value Entra calls the **Tenant URL**.
    * **Token** — this is the value Entra calls the **Secret Token**.

    <Frame caption="SCIM configuration — copy the SCIM URL and Token">
      <img src="https://mintcdn.com/truefoundry/OlEFjoHwZJ0edSjd/images/sso/entra/scim-configuration-modal.png?fit=max&auto=format&n=OlEFjoHwZJ0edSjd&q=85&s=8ee946d3c0985f739e0bb1e5732c3c2f" alt="TrueFoundry SCIM configuration dialog showing SCIM URL and Token fields with copy buttons" width="529" height="233" data-path="images/sso/entra/scim-configuration-modal.png" />
    </Frame>

    <Warning>
      Store the token somewhere safe and treat it like a password. If you lose it, open **View Config** again to generate a new token — which invalidates the previous one.
    </Warning>
  </Step>
</Steps>

## Step 2 — Open the Entra Enterprise Application

If you don't already have an Entra Enterprise Application for TrueFoundry, create one first by following the [SAML SSO guide](/docs/platform/sso/entra/saml). SCIM provisioning is configured inside the same application.

<Steps>
  <Step title="Open Enterprise applications">
    Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) and go to **Identity → Applications → Enterprise applications**.
  </Step>

  <Step title="Select your TrueFoundry application">
    Click the row for the TrueFoundry application you created for SSO.
  </Step>
</Steps>

## Step 3 — Create a provisioning configuration

<Steps>
  <Step title="Open Provisioning and create a configuration">
    In the application's left sidebar, click **Provisioning**, then click **+ New configuration** at the top of the page.

    <Frame caption="Provisioning — click + New configuration">
      <img src="https://mintcdn.com/truefoundry/OlEFjoHwZJ0edSjd/images/sso/entra/scim-provisioning-get-started.png?fit=max&auto=format&n=OlEFjoHwZJ0edSjd&q=85&s=9503a7918ba4a6c635f079e749c4d796" alt="Entra application Provisioning page with the New configuration button highlighted in the toolbar" width="1024" height="449" data-path="images/sso/entra/scim-provisioning-get-started.png" />
    </Frame>
  </Step>

  <Step title="Enter credentials, test, and create">
    On the **New provisioning configuration** page, leave **Bearer authentication** selected and fill in:

    * **Tenant URL** — paste the **SCIM URL** from TrueFoundry.
    * **Secret Token** — paste the **Token** from TrueFoundry.

    Click **Test connection**. When successful, a green confirmation appears. Then click **Create** to save the provisioning configuration.

    <Frame caption="New provisioning configuration — Tenant URL, Secret Token, Test connection, and Create">
      <img src="https://mintcdn.com/truefoundry/OlEFjoHwZJ0edSjd/images/sso/entra/scim-new-provisioning-configuration.png?fit=max&auto=format&n=OlEFjoHwZJ0edSjd&q=85&s=82be64b8fd6cc5e5a17c7de3e74c4b3b" alt="Entra New provisioning configuration page showing Bearer authentication, Tenant URL, Secret Token, Test connection, and Create buttons" width="797" height="938" data-path="images/sso/entra/scim-new-provisioning-configuration.png" />
    </Frame>

    <Tip>
      If the test fails with a 401 response, your token is wrong or expired. Open **View Config** on the **SCIM** row in TrueFoundry to generate a new token and re-paste it.
    </Tip>
  </Step>
</Steps>

## Step 4 — Confirm mappings and scope

Entra ships with default attribute mappings that work with TrueFoundry. You only need to confirm them and choose the scope.

<Steps>
  <Step title="Open Mappings">
    Expand the **Mappings** section on the provisioning page. Both **Provision Microsoft Entra ID Groups** and **Provision Microsoft Entra ID Users** should be **Enabled**.

    The defaults map `mail` → `emails`, `userPrincipalName` → `userName`, `givenName` → `name.givenName`, `surname` → `name.familyName`, and `objectId` → `externalId`. No changes are needed for a standard TrueFoundry tenant.
  </Step>

  <Step title="Adjust settings">
    Expand the **Settings** section and set:

    * **Scope** → **Sync only assigned users and groups** (recommended).
    * **Provisioning Status** → **On**.
  </Step>

  <Step title="Save">
    Click **Save** at the top.
  </Step>
</Steps>

## Step 5 — Assign users and groups

<Steps>
  <Step title="Open Users and groups">
    From the application's left sidebar, click **Users and groups**, then **Add user/group**.
  </Step>

  <Step title="Pick who should be synced">
    Select the users or security groups that should appear in TrueFoundry and click **Assign**.

    <Tip>
      Assign **groups** rather than individual users whenever possible. Group memberships sync as TrueFoundry teams, and managing membership at the IdP level is easier in the long run.
    </Tip>
  </Step>
</Steps>

## Step 6 — Start provisioning

<Steps>
  <Step title="Return to Provisioning → Overview">
    Inside the application, navigate back to **Provisioning** tab.
  </Step>

  <Step title="Start provisioning">
    On the **Overview** tab, click **Start provisioning** in the toolbar.

    Entra runs the initial sync within a few minutes and re-syncs every 40 minutes thereafter. To sync a single user immediately without waiting for the cycle, use **Provision on demand** under **Quick actions**.

    <Frame caption="Provisioning Overview — Start provisioning and Provision on demand">
      <img src="https://mintcdn.com/truefoundry/OlEFjoHwZJ0edSjd/images/sso/entra/scim-provisioning-overview.png?fit=max&auto=format&n=OlEFjoHwZJ0edSjd&q=85&s=dd77124f612233f6e68a066bc14f8869" alt="Entra provisioning configuration Overview tab showing Start provisioning in the toolbar and Provision on demand under Quick actions" width="1024" height="736" data-path="images/sso/entra/scim-provisioning-overview.png" />
    </Frame>
  </Step>

  <Step title="Verify in TrueFoundry">
    Go to **Access → Users** in TrueFoundry. Assigned Entra users should appear within a few minutes, with their email and team memberships populated. Groups appear under **Access → Teams**.
  </Step>
</Steps>

## How SCIM behaves with Entra

* **Sync cadence** — Entra performs SCIM sync on a 20–40 minute interval. Force an immediate run with **Provision on demand** for a single user.
* **Deactivation** — When you unassign a user, Entra sends a PATCH that sets `active=false`. TrueFoundry then deactivates the user (instead of deleting them).
* **Group naming** — Entra group display names sync as TrueFoundry team names. See [Provision teams via SCIM](/docs/platform/team-management#provision-teams-via-scim) for naming rules.

## Troubleshooting

<AccordionGroup>
  <Accordion title="PATCH requests are failing with 400 errors">
    This is a known issue with Entra's SCIM client. Append the query parameter `?aadOptscim062020` to the **Tenant URL** in Entra — this enables the standards-compliant PATCH behaviour Microsoft documents under [SCIM compatibility flags](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility#flags-to-alter-the-scim-behavior).
  </Accordion>

  <Accordion title="Test connection fails with 401 Unauthorized">
    The bearer token is incorrect or expired. Open **View Config** on the **SCIM** row in TrueFoundry to generate a new token, paste it into Entra's **Secret Token** field, and click **Test connection** again.
  </Accordion>

  <Accordion title="A user was assigned but never appeared in TrueFoundry">
    1. In Entra, open the provisioning configuration and click **View provisioning logs** to see what happened for that user.
    2. Confirm **Scope** is set to **Sync only assigned users and groups** and that the user (or one of their groups) is assigned.
    3. Run **Provision on demand** for the user to skip the sync interval.
  </Accordion>

  <Accordion title="Group memberships aren't syncing">
    Make sure you assigned the **group itself** (not just the users) to the Enterprise Application, and that **Provision Microsoft Entra ID Groups** is enabled under **Mappings**. Nested groups are not supported by Entra SCIM — only direct members of an assigned group are synced.
  </Accordion>
</AccordionGroup>