> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Entra SCIM Provisioning
> Connect Microsoft Entra ID to StackOne with SCIM, assign users, and provision Entra groups.
export const idp_0 = "Microsoft Entra"
Sync users from Microsoft Entra ID, your identity provider (IdP), into StackOne with SCIM. Once linked, assigning a person to the StackOne application in Entra adds them to the organization, and unassigning or disabling them removes their access, except for the organization's last active **Organization Admin**.
For what happens to users once SCIM Provisioning is running, see the [SCIM Provisioning overview](/secure/identity-and-access/manage-team/scim/overview).
Before setting up SCIM Provisioning, you need:
* A verified SSO connection between the organization and {idp_0}. See [Single Sign-On](/secure/identity-and-access/authentication/sso/overview).
* The **Organization Admin** role in StackOne.
* Admin access to the StackOne application in {idp_0}.
* (Optional) {idp_0} set up to send `admin` in the SCIM `roles` field for anyone who should join as an **Organization Admin**. Everyone else joins as an **Organization Member**. See [Organization Roles](/secure/identity-and-access/roles-and-groups/organization-roles).
The `roles` value only counts when a user first joins. After that, their role can only be changed in StackOne.
SCIM Provisioning only adds users whose email is on the organization's verified domain. Anyone else, including everyone assigned before the domain is verified, shows as an error in {idp_0}'s provisioning log.
In Microsoft Entra, admin access means permission to manage the enterprise application, such as the **Application Administrator** role.
## Link SCIM in StackOne
1. In the StackOne dashboard, go to [**Organization > Security > SSO**](https://app.stackone.com/organization/security/sso).
2. Open the verified SSO connection.
3. Select the **Provisioning** tab.
1. On the **Provisioned access** card, select **Manage access**.
2. Pick the projects new users should join.
3. Choose a role for each one. See [Project Roles](/secure/identity-and-access/roles-and-groups/project-roles).
4. Select **Save changes**.
Provisioned access applies to users added by both Just-in-Time Provisioning and SCIM Provisioning.
1. On the **Directory Sync** card, select **Link SCIM**.
2. In the **SCIM Details** section, copy the **SCIM base URL** and the **Provisioning token**. You paste both into the IdP.
The token is only shown once. Store it somewhere safe before you close the panel. To replace a lost or leaked token, see [Rotate the token](/secure/identity-and-access/manage-team/scim/overview#rotate-the-token).
## Configure provisioning in Microsoft Entra
Point the enterprise application at StackOne's SCIM endpoint. Use the same application you set up for SSO.
1. In the **Microsoft Entra admin center**, go to **Identity > Applications > Enterprise applications** and open the application you created for StackOne SSO.
2. Select **Provisioning**.
3. Select **Connect your application**.
Under **Admin credentials**, set the following:
* **Select authentication method**: `Bearer authentication`.
* **Tenant URL**: the **SCIM base URL** from StackOne.
* **Secret token**: the **Provisioning token** from StackOne.
1. Click **Test connection**.
2. When the test passes, select **Create** to save the configuration.
Select **Start provisioning** to begin the first cycle. Microsoft Entra provisions the assigned users, then re-syncs roughly every 40 minutes.
## Assign users and groups
Microsoft Entra provisions only the users you assign to the application. Assign the people who should have StackOne access.
1. In the same enterprise application, open **Users and groups**.
2. Add the users or groups to sync, such as the **Finance** group.
On its next cycle, Microsoft Entra adds each assigned user to the organization, with their organization role and provisioned access.
Unassign a user from the application, or disable their Microsoft Entra account, and the next cycle deactivates the matching StackOne member, removing their access automatically.
## Provision groups
Microsoft Entra can provision the groups you assign to the application as well as their members. Each becomes a synced group in StackOne that keeps its membership in step with Entra.
If StackOne already has a group with the same name, an empty one becomes the synced group and keeps its access.
If the group has members, it's left untouched, and StackOne creates a second, synced group with the same name instead. To set up a group's access before anyone is provisioned into it, see [Prepare the access before you push](/secure/identity-and-access/manage-team/scim/groups#prepare-the-access-before-you-push).
1. In the application's **Provisioning** settings, open **Mappings**.
2. Make sure **Provision Microsoft Entra ID Groups** is `Enabled`.
Under **Users and groups**, assign the group, such as **Finance**.
On the next cycle, Entra provisions the group's direct members as StackOne members and the group itself as a synced group.
Nested groups aren't expanded, so assign the groups that directly contain the people you want.
1. Go to [**Organization > Manage Team**](https://app.stackone.com/organization/manage_team) and open the **Groups** tab. The group is listed with a **Synced** tag.
2. Assign it to projects from its **Projects** tab.
After a group is provisioned:
* **To rename it or change its members**, make the change in Entra. The synced group follows on the next cycle.
* **To stop provisioning it**, unassign the group from the application. On the next cycle, Entra deprovisions the members who are no longer assigned to the application through any other assignment.
## Next steps
How SCIM provisioning works and how it attaches to the SSO connection.
Set up SCIM provisioning with Okta instead of Microsoft Entra.
Push the identity provider's groups into StackOne and grant access through them.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.