> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning with Entra ID

> Configure Microsoft Entra ID (Azure AD) automatic provisioning for env zero over SCIM 2.0: tenant URL, assignment scope, groups, and attribute mappings.

## Prerequisites

* An SSO connection between env zero and Entra ID. See [Azure Active Directory integration](/guides/sso-integrations/self-service-azure-ad).
* A SCIM endpoint URL and bearer token from env zero. See [Set up SCIM](/guides/sso-integrations/scim-provisioning#set-up-scim).
* An Entra ID account with at least the Application Administrator role.

## Configure the provisioning job

<Steps>
  <Step title="Open the application">
    In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **Enterprise apps** and open the application you use for env zero. If you do not have one, create it with **+ New application** > **+ Create your own application** and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
  </Step>

  <Step title="Add the SCIM configuration">
    Select **Provisioning**, then **+ New configuration**. Set:

    * **Tenant URL**: the SCIM Endpoint URL from env zero
    * **Secret Token**: the env zero bearer token

    Click **Test Connection**, then **Create**.
  </Step>

  <Step title="Assign users and groups">
    On the **Users and groups** tab, assign the users and groups to provision. With the scope set to sync only assigned users and groups, nothing is provisioned until you assign something.
  </Step>

  <Step title="Review the attribute mappings">
    Under **Mappings**, confirm that **Provision Microsoft Entra ID Users** maps `userName` to the user's email address. Leave **Provision Microsoft Entra ID Groups** enabled to create env zero teams from Entra ID groups, or disable it to provision users only.

    Attributes env zero does not store are ignored rather than rejected, so the stock Entra ID mapping needs no trimming. See [User attributes](/guides/sso-integrations/scim-provisioning#user-attributes) for what is stored.
  </Step>

  <Step title="Test with a single user">
    Use **Provision on demand** to provision one assigned user, and confirm they appear on the **Users** screen in your env zero organization settings.
  </Step>

  <Step title="Start provisioning">
    Return to **Overview** and click **Start provisioning**. The initial cycle takes longer than later cycles, which run about every 40 minutes while the service is on. **Provisioning logs** shows each action Entra ID performed.
  </Step>
</Steps>

## How Entra ID provisioning behaves

* Entra ID sends updates as `PATCH`, and env zero accepts both the filter-path and value-as-object PATCH dialects.
* Group provisioning creates one env zero team per group and keeps its membership in sync. See [Group to team mapping](/guides/sso-integrations/scim-provisioning#group-to-team-mapping).
* Entra ID sends `externalId` for both users and groups, and env zero stores it and returns it on reads.
* A cycle covers only the users and groups assigned to the application. Unassign a user, or disable their Entra ID account, to deprovision them in env zero.

## Troubleshooting

| Symptom                                                                                  | Cause                                                                                       | Fix                                                                                                                                    |
| :--------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------- |
| **Test Connection** fails with an authorization error                                    | Wrong, incomplete, or expired bearer token.                                                 | Confirm the token was pasted in full. If the token is lost, rotate it in env zero and paste the new value into **Secret Token**.       |
| Provisioning logs show HTTP 403 `SCIM provisioning is not enabled for this organization` | The env zero organization is in **JIT** mode, which rejects SCIM writes.                    | Switch the [provisioning mode](/guides/sso-integrations/scim-provisioning#provisioning-modes) to **Full SCIM** or **Hybrid (legacy)**. |
| A group fails with HTTP 409 `A group named <name> already exists`                        | An env zero team already uses that name. env zero matches groups by display name.           | Rename the Entra ID group, or rename or delete the env zero team, then let the next cycle retry.                                       |
| A group member fails with HTTP 400 `Member <id> is not part of this organization`        | The user is not provisioned into the env zero organization or one of its sub-organizations. | Assign the user to the application so the user is provisioned first.                                                                   |
| Nothing is provisioned after **Start provisioning**                                      | No users or groups are assigned, or they are out of scope.                                  | Assign users and groups on the **Users and groups** tab.                                                                               |

## Next steps

* [SCIM provisioning](/guides/sso-integrations/scim-provisioning) - Provisioning modes, token rotation, and reconcile.
* [Azure Active Directory integration](/guides/sso-integrations/self-service-azure-ad) - The SSO side of the Entra ID setup.
* [Manage teams](/guides/admin-guide/user-role-and-team-management/teams) - Assign project roles to provisioned teams.