> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oloid-demo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID - How to Configure Cross-Domain Identity Management (SCIM) Provisioning for Oloid

> This document provides step-by-step instruction to configure SCIM provisioning for Microsoft Entra ID.

## Introduction

This document provides instructions to configure **SCIM (System for Cross-domain Identity Management) provisioning** between **Microsoft Entra ID** and **Oloid**. The configuration enables automatic user and group provisioning, updates, and deprovisioning using the **SCIM 2.0** protocol with **Bearer Token** or **OAuth 2.0 Client Credentials** authentication.

## Prerequisites

* You must have **Admin** access to the Microsoft Entra ID Admin Center.
* The **SCIM integration** must be enabled for your Oloid tenant.
* You must have a pilot user or group available in Microsoft Entra ID for validating the provisioning configuration.

## Steps to Setup the SCIM

1. [Create the Enterprise Application](#create-the-enterprise-application)
2. Configure Provisioning
3. [Monitor and Verify](#monitor-and-verify)

### Create the Enterprise Application

1. Log in to **Microsoft Entra ID Admin Center**.
   The Microsoft Entra ID homepage is displayed.
2. Click **Enterprise applications**.

   ![How to Configure Cross-Domain Identity... - screenshot 1](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-23f90b7b.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=6074a5d13ddf2d7ec5a19982d1097dde)

   The **Enterprise applications** screen is displayed.
3. Click **New application**.

   ![How to Configure Cross-Domain Identity... - screenshot 2](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-cc55d8f2.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=d301e87b4557259ec912a52e5002cddb)

   The **Browse Microsoft Entra App Gallery** screen is displayed.
4. Click **Create your own application**.

   ![How to Configure Cross-Domain Identity... - screenshot 3](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-809e56e5.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=7bc9be26ef2f2817af072f54005e216c)

   The **Create your own application** pop-up box displayed.
5. Do the following:
   1. Enter the app name.
   2. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
   3. Click **Create**.

      ![How to Configure Cross-Domain Identity... - screenshot 4](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-eb208cf7.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=af50cc15223c6b16681aeba179a1439c)

      The **Enterprise application** is created successfully, and application details screen is displayed.

      ![How to Configure Cross-Domain Identity... - screenshot 5](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-cdc1f391.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=3a674fe99ad34dd12657745737077b7f)

### Configure the Provisioning

1. Go back to the Enterprise screen and click **Provisioning**.

   ![How to Configure Cross-Domain Identity... - screenshot 6](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-e761db5e.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=345a2bb93dea4f021a3985ea0021743b)

   The **Overview** screen is displayed.
2. Go to **Manage** > click **Provisioning**.

   ![How to Configure Cross-Domain Identity... - screenshot 7](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-5cad3443.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=1cd67ea2b29f08fa66fc5cecc6437f36)

   The **Provisioning** screen is displayed.
3. On **Provisioning** screen, do the following:
   1. Select Provisional mode as **Automatic** from the drop-down.

      ![How to Configure Cross-Domain Identity... - screenshot 8](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-aacd1d33.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=e89656bcae546bbc47d3a8b9df09bc92)

   2. On **Admin Credentials** section, **click here to switch to the new admin credentials experience**.
      The Connectivity screen is displayed.

   3. Do one of the following:
      1. Select **Bearer authentication** as an Authentication Method.

         > [!NOTE]
         >
         > **Note:** The values required for the following fields are available in the **Tenant Admin Portal**. To view them, go to **Agents > SCIM > API Token**.

      2. Enter **Tenant URL**.

         > [!NOTE]
         >
         > **Note:** Copy the **Base URL** and paste it into the **Tenant URL** field.

      3. Enter **Secret Token**.

         > [!NOTE]
         >
         > **Note:** Copy the **Token** and paste it into the **Secret Token** field.

         ![How to Configure Cross-Domain Identity... - screenshot 9](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-cdc97acc.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=2395f74823ad0732ad8fcda8be7d49e7)

      4. Click **Test Connection.**
         The Success message is displayed.

         ![How to Configure Cross-Domain Identity... - screenshot 10](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-dcedc6c7.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=bb682b2b53bb2461c2a1dc5ea9d8c897)

      5. Click **Save**.

         ![How to Configure Cross-Domain Identity... - screenshot 11](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-7c29fcd7.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=1ce8424d6268dd8d8a85401dc8c61efc)

         The **Admin Credentials** tab is configured successfully.
         OR

      6. Select **OAuth2 Client Credentials Grant** as an Authentication Method.

         > [!NOTE]
         >
         > **Note:** The values required for the following fields are available in the **Tenant Admin Portal**. To view them, go to **Agents > SCIM > OAuth 2.0**.

      7. Enter **Tenant URL**.

         > [!NOTE]
         >
         > **Note:** Copy the **Base URL** and paste it into the **Tenant URL** field.

      8. Enter **Token Endpoint**.

         > [!NOTE]
         >
         > **Note:** Copy the **Endpoint Token** and paste it into the **Token Endpoint** field.

      9. Enter **Client Identifier**.

         > [!NOTE]
         >
         > **Note:** Copy the **Client ID** and paste it into the **Client Identifier** field.

      10. Enter **Client Secret**.

          > [!NOTE]
          >
          > **Note:** If the **Client Secret** is not displayed, click **Get Secret**. Copy the generated **Client Secret** and paste it into the **Client Secret** field.

          ![How to Configure Cross-Domain Identity... - screenshot 12](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-dfa10f46.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=55d1329e687388087014a4e6b2a2113a)

      11. Click **Test Connection**.
          The Success message is displayed.

          ![How to Configure Cross-Domain Identity... - screenshot 13](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-94bea18f.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=6d240f4179d43f10e323afa587281bb4)

      12. Click **Save**.

          ![How to Configure Cross-Domain Identity... - screenshot 14](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-79c92c21.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=b847966fff709f04cdab6e32a79b9aa6)

          The **Admin Credentials** tab is configured successfully.

   4. Go to **Settings** section and do the following:
      1. Select **Send Email notification when failure occurs**.
      2. Enter **Email ID**.

         ![How to Configure Cross-Domain Identity... - screenshot 15](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-2885595f.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=4948563a6bbd10887996ebfaa51eec3d)

   5. Click **Save**.

      ![How to Configure Cross-Domain Identity... - screenshot 16](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-0e410b86.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=9665cbcd9b3849325ab253a8716fd9b4)

      The Mappings section is displayed.

      > [!NOTE]
      >
      > **Note:** Remove any default attribute mappings that are not supported by the Oloid schema (for example, `preferredLanguage` and `addresses[*]`). This helps reduce unnecessary HTTP 400 (Bad Request) errors in the synchronization logs.

   6. Do the following:
      1. Select **Provision Microsoft Entra ID Groups**.
         The Attribute Mapping screen for Provision Microsoft Entra ID Groups is displayed.

         > [!NOTE]
         >
         > **Note:** Refer [Group Attribute Table](#group-attribute-table) to map the attribute for Entra ID Groups.

      2. On **Attribute Mappings** tab, do the following:
         1. Ensure **Yes** is select as Enabled.
         2. Click **Save**.

            ![How to Configure Cross-Domain Identity... - screenshot 17](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-d1c5b7ed.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=f766db3b649cd4e8dc91a5ce34b24e8b)

            A confirmation pop-up box is displayed.
         3. Click **Yes**.

            ![How to Configure Cross-Domain Identity... - screenshot 18](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-2946b730.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=739f9aaea012a64b29dbe5bd952f30d3)

      3. Select **Provision Microsoft Entra ID Users**.
         The Attribute Mapping screen for Provision Microsoft Entra ID Users is displayed.

         > [!NOTE]
         >
         > **Note:** Refer [User Attribute Table](#user-attribute-table) to map the attribute for Entra ID users.

      4. On **Attribute Mappings** tab, do the following:
         1. Ensure **Yes** is select as Enabled.
         2. Click **Save**.

            ![How to Configure Cross-Domain Identity... - screenshot 19](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-fa1ece71.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=d4d4d19e0edaa06f0a3423b6345e09f4)

            A confirmation pop-up box is displayed.
         3. Click **Yes**.

            ![How to Configure Cross-Domain Identity... - screenshot 20](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-2946b730.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=739f9aaea012a64b29dbe5bd952f30d3)

            The Provisioning tab is configured successfully.
4. Click on the **Users and groups** tab.
   The Users and Groups screen is displayed.
5. Click **Add user/group**.

   ![How to Configure Cross-Domain Identity... - screenshot 21](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-856dabfc.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=e854557abf7c76b63e31ce7b3fcdc3cb)

   The **Add Assignment** screen is displayed.
6. Click **None Selected**.

   ![How to Configure Cross-Domain Identity... - screenshot 22](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-9131e2a8.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=531e9e3b3fa0802d750d091ca06be2b3)

   The **Users and groups** pop-up box is displayed.
7. Select the applicable user/group > click **Select**.

   > [!NOTE]
   >
   > **Note:** Assign a pilot user group (recommended) or individual users.

   ![How to Configure Cross-Domain Identity... - screenshot 23](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-6d7c7bbe.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=3ce93df065ba8313def8902b8678606e)

   The user(s) or group(s) is(are) selected.
8. Go back to **Provisioning** tab > under settings tab, configure the following:
   1. Select the scope with the help of drop-down.

      > [!NOTE]
      >
      > **Note:**
      >
      > 1. **Sync only assigned users and groups (recommended):** Synchronizes only the users and groups assigned to the enterprise application. Use this option for initial setup and validation.
      > 2. **Sync all users and groups:** Synchronizes all users and groups in Microsoft Entra ID. Use this option only after the initial setup has been validated.
      > 3. Ensure Provisioning Status set to **ON**.
      > 4. Click **Save**.

      > [!NOTE]
      >
      > **Note:** Entra schedules the initial cycle within a few minutes; full enumeration can take up to 40 minutes on a fresh tenant. After the initial cycle, Entra runs incremental cycles every \~40 minutes

      ![How to Configure Cross-Domain Identity... - screenshot 24](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-84b22d8d.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=e6f31d4091eeefa534d86c12c8882587)

      The Provisioning tab is configured successfully.

### Monitor and Verify

1. Go to **Monitor > Provisioning Logs**.
   The **Provisioning Logs** page is displayed.
   Filter by Status to inspect failures. Each entry shows the SCIM operation, the Entra source object, and the upstream HTTP response from Oloid.

   ![How to Configure Cross-Domain Identity... - screenshot 25](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-9b0f409a.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=bb51f728c198f37cf98364899893c400)
2. Click **Provision on Demand** and do the following:

   > [!NOTE]
   >
   > **Note:** Provision on Demand dry run a single user or group without waiting for the cycle. This is the fastest feedback loop while validating mappings.

   1. Select Group in **Selected group**.
   2. Select one of the following in **Selected users**.
      1. View members only.
      2. View all users.
   3. Click **Provision**

      ![How to Configure Cross-Domain Identity... - screenshot 26](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-761f025b.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=2f882f9e3ca949ab78afb49c93d3e719)
3. Click **Monitor > Audit Logs**.
   The Audit Log page is displayed.

   ![How to Configure Cross-Domain Identity... - screenshot 27](https://mintcdn.com/oloid-999c42b2/LawQ2_JuKdYkdMzh/images/intercom/15652452/image-c41ffa2b.png?fit=max\&auto=format\&n=LawQ2_JuKdYkdMzh\&q=85\&s=9f6484a353b76cbebd98a9e08118989c)
4. Filter **Service** Account Provisioning to see who started, paused, or modified the provisioning configuration.

***

### Attribute Table

#### User Attribute Table

**Entra attribute**

**SCIM Attribute (Target)**

> [!NOTE]
>
> **Note:** userPrincipalName

userName

Required. Used as the SCIM unique identifier on the Oloid side (PrimaryID).

Switch(\[IsSoftDeleted], , "False", "True", "True", "False")

active

Required. Drives Oloid Active/Inactive state on deprovisioning.

displayName

displayName

Required for nice display in Oloid UI.

mail

emails\[type eq "work"].value

Required. Oloid stores this as the user's email.

givenName

name.givenName

Optional but recommended.

surname

name.familyName

Optional but recommended.

objectId

externalId

Recommended. Stable identifier used for re-linking after rename.

#### Group Attribute Table

**Entra attribute**

**SCIM attribute (target)**

> [!NOTE]
>
> **Note:** displayName

displayName

Required. Used as the human-readable group name.

members

members

Required. Each member emits a \{value, \$ref} pair pointing at the SCIM user id Oloid returned at user creation time.

***

#### Additional Information

* Rotate the Secret Token periodically (recommended at least every 12 months, sooner on personnel change).
* Create a new API key for SCIM from the Oloid admin portal.

***

#### Related Article

[Tenant Admin Portal - How to Configure System for Cross-Domain Identity Management (SCIM)](https://oloid.help/en/articles/12740850-tenant-admin-portal-how-to-configure-system-for-cross-domain-identity-management-scim)