Skip to main content

​
Prerequisites

  • An SSO connection between env zero and Entra ID. See Azure Active Directory integration.
  • A SCIM endpoint URL and bearer token from env zero. See Set up SCIM.
  • An Entra ID account with at least the Application Administrator role.

​
Configure the provisioning job

1

Open the application

In the Microsoft Entra admin center, go to Entra ID > Enterprise apps and open the application you use for env zero. If you do not have one, create it with + New application > + Create your own application and select Integrate any other application you don’t find in the gallery (Non-gallery).
2

Add the SCIM configuration

Select Provisioning, then + New configuration. Set:
  • Tenant URL: the SCIM Endpoint URL from env zero
  • Secret Token: the env zero bearer token
Click Test Connection, then Create.
3

Assign users and groups

On the Users and groups tab, assign the users and groups to provision. With the scope set to sync only assigned users and groups, nothing is provisioned until you assign something.
4

Review the attribute mappings

Under Mappings, confirm that Provision Microsoft Entra ID Users maps userName to the user’s email address. Leave Provision Microsoft Entra ID Groups enabled to create env zero teams from Entra ID groups, or disable it to provision users only.Attributes env zero does not store are ignored rather than rejected, so the stock Entra ID mapping needs no trimming. See User attributes for what is stored.
5

Test with a single user

Use Provision on demand to provision one assigned user, and confirm they appear on the Users screen in your env zero organization settings.
6

Start provisioning

Return to Overview and click Start provisioning. The initial cycle takes longer than later cycles, which run about every 40 minutes while the service is on. Provisioning logs shows each action Entra ID performed.

​
How Entra ID provisioning behaves

  • Entra ID sends updates as PATCH, and env zero accepts both the filter-path and value-as-object PATCH dialects.
  • Group provisioning creates one env zero team per group and keeps its membership in sync. See Group to team mapping.
  • Entra ID sends externalId for both users and groups, and env zero stores it and returns it on reads.
  • A cycle covers only the users and groups assigned to the application. Unassign a user, or disable their Entra ID account, to deprovision them in env zero.

​
Troubleshooting

​
Next steps