Skip to main content
With Microsoft Entra ID provisioning, you can have Entra ID create, update, and deactivate Plerion users, and sync your Entra ID groups to Plerion as user groups, from the enterprise application you already use for single sign-on. Entra ID provisions on a schedule rather than on every change, so allow for that delay when you test.
Before you start, enable SCIM in Plerion and copy the SCIM base URL and a readWrite organization API key. See SCIM provisioning. You also need the enterprise application you created in the Azure single sign-on guide, because SCIM provisions users while SAML is used for authentication only.

​
Steps to configure Entra ID provisioning

1

Open your Plerion enterprise application

  • Sign in to the Microsoft Entra admin center.
  • Go to Enterprise applications and open the application you created for Plerion single sign-on.
2

Create a provisioning configuration

  • Go to Provisioning and click New configuration.
Entra ID provisioning overview with the New configuration action
3

Enter the Plerion credentials

  • Leave the authentication method as Bearer authentication.
  • In Tenant URL, paste the SCIM base URL you copied from Plerion.
  • In Secret token, paste your readWrite organization API key.
  • Click Test connection and confirm it succeeds, then click Create.
Entra ID new provisioning configuration with bearer authentication, tenant URL, and secret token
4

Review the mappings

  • Under Mappings, open Provision Microsoft Entra ID Users and confirm that userPrincipalName maps to userName and that the mail attribute maps to the primary email, because Plerion derives the Plerion email address from those fields.
  • Open Provision Microsoft Entra ID Groups and confirm it is enabled, with displayName mapped to displayName and members mapped to members. Each synced group appears in Plerion under Admin > Directory > User groups, marked as managed by your identity provider.
5

Choose the scope and start provisioning

  • On the Properties tab, confirm Provisioning scope is Sync only assigned users and groups.
  • Assign groups under Users and groups. Their members are provisioned as users and the groups themselves as user groups.
  • Click Start provisioning. The first cycle starts within a few minutes.
Entra ID provisioning properties with the scope set to assigned users and groups
6

Grant roles to the synced groups

  • In Plerion, go to Admin > Directory > User groups, open each synced group, and grant it the roles its members should hold. See User groups.
  • Until one of their groups grants a role, its members are refused at sign-in. A SCIM-managed user cannot be granted a role directly.
7

Verify the first cycle

  • Open Provisioning logs to confirm the users and groups were created.
  • In Plerion, go to Admin > Directory > Users and confirm they appear with the roles their groups grant.

​
Entra ID-specific behavior

  • Changes arrive in cycles, not instantly. Entra ID runs an incremental cycle roughly every 40 minutes. A change you make in Entra ID can take that long to reach Plerion, including a deactivation. Use Provision on demand to push a single user immediately while you are testing.
  • Errors land in the provisioning logs. Open Provisioning logs on the application, then match the message against the troubleshooting table.
For the full user lifecycle and the break-glass rules that apply whatever your IdP, see SCIM provisioning.