> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Entra SCIM Provisioning
> Provision and deprovision members from Microsoft Entra ID to StackOne with SCIM.
Provision your Microsoft Entra ID users into StackOne so member accounts are created and deactivated automatically as people join and leave. Microsoft Entra provisions against StackOne's SCIM 2.0 endpoint, a flow StackOne calls SCIM Provisioning. SCIM Provisioning attaches to an existing SSO connection, so [configure SSO](/identity/sso/overview) before you start.
## Prerequisites
* **Org Admin** role in your StackOne organization.
* An SSO connection for your organization with its email domain verified, for example `acme.com`. SCIM Provisioning attaches to that connection, and StackOne links each provisioned user to your organization by the verified domain.
* Access to the **Microsoft Entra admin center** with permission to manage the enterprise application, such as the **Application Administrator** role.
The **Provisioning** tab and its **Directory Sync** card are enabled per organization. If you don't see them on your SSO connection, even as an Org Admin, contact StackOne support to turn on SCIM Provisioning for your organization.
## Link SCIM in StackOne
SCIM Provisioning lives on your SSO connection. Open it to mint the credentials Microsoft Entra needs and to choose what provisioned members receive.
In the StackOne dashboard, go to **Organization > Security > SSO** and open your SSO connection, for example **Acme Entra**. Select the **Provisioning** tab, find the **Directory Sync** card, and click **Link SCIM** to open the **Directory Sync** panel.
Under **SCIM Details**, StackOne shows the **SCIM base URL** and a **provisioning token**. Copy both now. The token is displayed once and cannot be retrieved later, so store it before you close the panel.
On the **Provisioned access** card, select **Manage access**. Choose the projects provisioned members join and a role for each one (**Viewer**, **Member**, or **Admin**), then click **Save changes**. StackOne applies these to every member Microsoft Entra provisions, so pick the least-privilege role that fits each project. This access is shared with [JIT provisioning](/identity/sso/jit-provisioning).
The **SCIM base URL** always ends in `/api/auth/scim/v2`, the SCIM 2.0 endpoint Microsoft Entra provisions against. If you regenerate the token in StackOne, the previous one stops working immediately, so update the **Secret Token** in Microsoft Entra to match or provisioning fails.
## Configure provisioning in Microsoft Entra
Point the enterprise application at StackOne's SCIM endpoint. Use the same application you set up for SSO.
In the **Microsoft Entra admin center**, go to **Enterprise applications** and open your application, for example **Acme Entra**. Select **Provisioning**, then **Connect your application** to set up automatic provisioning.
Set the authentication method to **Bearer authentication**, then under **Admin Credentials** fill in the two fields with the values from StackOne:
| Microsoft Entra field | Value from StackOne |
| --------------------- | ------------------- |
| **Tenant URL** | SCIM base URL |
| **Secret Token** | Provisioning token |
Click **Test Connection**. Microsoft Entra calls StackOne with the credentials and confirms they work. When the test passes, select **Create** to save the configuration.
Select **Start provisioning** to begin the first cycle. Microsoft Entra provisions your assigned users, then re-syncs roughly every 40 minutes.
## Assign users and groups
Microsoft Entra provisions only the users you assign to the application. Assign the people who should have StackOne access.
In the same enterprise application, open **Users and groups** and add the users or groups to sync, such as the **Finance** group. On its next cycle, Microsoft Entra creates a StackOne member for each assigned user, and StackOne applies the default role and projects you chose.
Unassign a user from the application, or disable their Microsoft Entra account, and the next cycle deactivates the matching StackOne member, removing their access automatically.
## Provision groups
Microsoft Entra can provision the groups you assign to the application as well as their members. Each becomes a synced group in StackOne that keeps its membership in step with Entra.
In the application's **Provisioning** settings, open **Mappings** and make sure **Provision Microsoft Entra ID Groups** is **Enabled**.
Under **Users and groups**, assign the group, such as **Finance**. On the next cycle, Entra provisions the group's direct members as StackOne members and the group itself as a synced group. Nested groups aren't expanded, so assign the groups that directly contain the people you want.
Go to **Organization > Manage Team** and open the **Groups** tab. The group is listed with a **Synced** tag. Assign it to projects from its **Projects** tab. If StackOne already had an empty group with that name, it became the synced group and kept its access. See [Prepare the access before you push](/identity/scim/groups#prepare-the-access-before-you-push).
Rename the group or change its members in Entra and the synced group follows on the next cycle. Unassign the group and, on the next cycle, Entra deprovisions the members who are no longer assigned to the application through any other assignment.
## Next steps
How SCIM provisioning works and how it attaches to your SSO connection.
Set up SCIM provisioning with Okta instead of Microsoft Entra.