> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Entra Directory Sync
> Provision and deprovision members from Microsoft Entra ID to StackOne with SCIM.
Provision your Microsoft Entra ID users into StackOne so member accounts are created and deactivated automatically as people join and leave. Microsoft Entra provisions against StackOne's SCIM 2.0 endpoint, a flow StackOne calls Directory Sync. Directory Sync attaches to an existing SSO connection, so [configure SSO](/identity/sso/overview) before you start.
## Prerequisites
* **Org Admin** role in your StackOne organization.
* An SSO connection for your organization with its email domain verified, for example `acme.com`. Directory Sync attaches to that connection, and StackOne links each provisioned user to your organization by the verified domain.
* Access to the **Microsoft Entra admin center** with permission to manage the enterprise application, such as the **Application Administrator** role.
The **Provisioning** tab and its **Directory Sync** card are enabled per organization. If you don't see them on your SSO connection, even as an Org Admin, contact StackOne support to turn on Directory Sync for your organization.
## Link SCIM in StackOne
Directory Sync lives on your SSO connection. Open it to mint the credentials Microsoft Entra needs and to choose what provisioned members receive.
In the StackOne dashboard, go to **Organization > Security > SSO** and open your SSO connection, for example **Acme Entra**. Select the **Provisioning** tab, find the **Directory Sync** card, and click **Link SCIM** to open the Directory Sync panel.
Under **SCIM Details**, StackOne shows the **SCIM base URL** and a **provisioning token**. Copy both now. The token is displayed once and cannot be retrieved later, so store it before you close the panel.
On the **Provisioned access** card, select **Manage access**. Choose the projects provisioned members join and a role for each one (**Viewer**, **Member**, or **Admin**), then click **Save changes**. StackOne applies these to every member Microsoft Entra provisions, so pick the least-privilege role that fits each project. This access is shared with [JIT provisioning](/identity/sso/jit-provisioning).
The **SCIM base URL** always ends in `/api/auth/scim/v2`, the SCIM 2.0 endpoint Microsoft Entra provisions against. If you regenerate the token in StackOne, the previous one stops working immediately, so update the **Secret Token** in Microsoft Entra to match or provisioning fails.
## Configure provisioning in Microsoft Entra
Point the enterprise application at StackOne's SCIM endpoint. Use the same application you set up for SSO.
In the **Microsoft Entra admin center**, go to **Enterprise applications** and open your application, for example **Acme Entra**. Select **Provisioning**, then **Connect your application** to set up automatic provisioning.
Set the authentication method to **Bearer authentication**, then under **Admin Credentials** fill in the two fields with the values from StackOne:
| Microsoft Entra field | Value from StackOne |
| --------------------- | ------------------- |
| **Tenant URL** | SCIM base URL |
| **Secret Token** | Provisioning token |
Click **Test Connection**. Microsoft Entra calls StackOne with the credentials and confirms they work. When the test passes, select **Create** to save the configuration.
Select **Start provisioning** to begin the first cycle. Microsoft Entra provisions your assigned users, then re-syncs roughly every 40 minutes.
## Assign users and groups
Microsoft Entra provisions only the users you assign to the application. Assign the people who should have StackOne access.
In the same enterprise application, open **Users and groups** and add the users or groups to sync, such as the **Finance** group. On its next cycle, Microsoft Entra creates a StackOne member for each assigned user, and StackOne applies the default role and projects you chose.
Directory Sync provisions **users only**, group sync is not available yet. Assigning a group in Microsoft Entra is a convenience on Entra's side: Entra expands the group and provisions each member as an individual StackOne user. The group and its membership are not synced into StackOne. To organize members into groups within StackOne, see [Groups](/identity/groups/overview).
Unassign a user from the application, or disable their Microsoft Entra account, and the next cycle deactivates the matching StackOne member, removing their access automatically.
## Next steps
How SCIM provisioning works and how it attaches to your SSO connection.
Set up SCIM provisioning with Okta instead of Microsoft Entra.