---
sidebar_label: Configure provisioning
toc_max_heading_level: 3
doc_id: b2d4e6a8-1c3f-4b5d-9a7e-8f0c2d4e6a1b
description: >-
  Step-by-step guide to configure SCIM provisioning from Azure Entra ID to nullplatform.
keywords:
  - Azure Entra ID
  - SCIM
  - provisioning
  - configuration
  - attribute mapping
---

# Configure provisioning

This guide walks you through configuring automatic user and group provisioning from Azure Entra ID to nullplatform using SCIM 2.0.

## Prerequisites

- **Azure tenant admin access**: Global Administrator or Application Administrator role
- **SCIM connection details**: your **Tenant URL** and **Secret Token**, provided by nullplatform when your SCIM integration is set up. These values are unique to your organization.
- **Network connectivity**: Azure Entra ID must be able to reach the Tenant URL provided by nullplatform

## Steps

### Step 1: Add a new enterprise application

1. Sign in to the [Azure portal](https://portal.azure.com) as a Global Administrator or Application Administrator.
2. Navigate to **Enterprise applications**.
3. Click **New application**.
4. Search for **SCIM** or select **Create your own application**.
5. Choose **Integrate any other application you don't find in the gallery**.
6. Name the application (e.g., "nullplatform SCIM") and click **Create**.

### Step 2: Configure SCIM connectivity

1. In the new application, go to **Provisioning** in the left sidebar.
2. Click **Get started**.
3. Set **Provisioning Mode** to **Automatic**.
4. Under **Admin Credentials**, enter the values nullplatform gave you:
   - **Tenant URL**: your SCIM endpoint (looks like `https://<your-scim-host>/scim/v2`)
   - **Secret Token**: the Bearer token for your integration

:::info
The **Tenant URL** and **Secret Token** are provisioned per organization. Nullplatform runs a dedicated SCIM endpoint for each customer, so both values are generated and shared with you during onboarding, they are not the same for every organization. If you don't have them yet, request them from nullplatform before configuring the connection.
:::

### Step 3: Test the connection

1. Click **Test Connection**.
2. Azure Entra ID will attempt to reach the SCIM ServiceProviderConfig endpoint.
3. If successful, you'll see a green checkmark.

If the test fails:
- Verify the **Tenant URL** matches the one nullplatform provided and includes `/scim/v2`.
- Confirm the **Secret Token** matches the one nullplatform provided.
- Ensure the Tenant URL host is reachable from Azure.
- Check firewall rules and network access.

### Step 4: Configure attribute mappings

Attribute mappings define how Azure Entra ID user attributes map to SCIM user attributes.

1. In **Provisioning**, click **Edit attribute mappings**.
2. Review the default mappings. Common mappings include:

| Azure Entra ID Attribute | SCIM Attribute | Required |
|---------------------------|----------------|----------|
| `mail` | `userName` | Yes |
| `displayName` | `displayName` | No |
| `givenName` | `name.givenName` | No |
| `surname` | `name.familyName` | No |
| `userPrincipalName` | `externalId` | No |
| `accountEnabled` | `active` | No |

3. Customize mappings as needed for your use case.
4. Click **Save**.

Example mapping for email-based provisioning:

```json
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "john.doe@example.com",
  "displayName": "John Doe",
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "value": "john.doe@example.com",
      "primary": true
    }
  ],
  "active": true
}
```

### Step 5: Enable group provisioning (optional)

If you want group membership from Azure Entra ID to drive role assignments in nullplatform:

1. In **Provisioning**, scroll to **Mappings**.
2. Click **Provision Azure Active Directory Groups** to enable group sync.
3. Assign the relevant groups to the application.

Azure sends group membership information via SCIM. The actual mapping from groups to nullplatform roles is configured server-side in nullplatform. See [Group membership and role mapping](/docs/authorization/scim/scim-overview#group-membership-and-role-mapping) for details.

:::info
Ensure group-to-role mappings are configured in nullplatform **before** enabling provisioning so that role assignments take effect from the first sync.
:::

### Step 6: Enable provisioning

1. Back in **Provisioning**, set **Provisioning Status** to **On**.
2. Click **Save**.

Azure Entra ID will immediately begin provisioning users and groups to nullplatform.

## Next steps

- [Monitor provisioning activity](/docs/authorization/scim/azure-entra-id/monitor)
- [Troubleshooting](/docs/authorization/scim/azure-entra-id/troubleshooting)