> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning with Microsoft Entra ID

> Configure automatic provisioning in Microsoft Entra ID to manage Plerion users and user groups

With **Microsoft Entra ID provisioning**, you can have Entra ID create, update, and deactivate Plerion users, and sync your Entra ID groups to Plerion as user groups, from the enterprise application you already use for single sign-on. Entra ID provisions on a schedule rather than on every change, so allow for that delay when you test.

<Info>
  Before you start, enable SCIM in Plerion and copy the SCIM base URL and a **readWrite** organization API key. See [SCIM provisioning](/guides/administration/scim/overview#steps-to-enable-scim-in-plerion). You also need the enterprise application you created in the [Azure single sign-on](/guides/administration/sso/azure) guide, because SCIM provisions users while SAML is used for authentication only.
</Info>

***

## Steps to configure Entra ID provisioning

<Steps>
  <Step title="Open your Plerion enterprise application">
    * Sign in to the Microsoft Entra admin center.
    * Go to `Enterprise applications` and open the application you created for Plerion single sign-on.
  </Step>

  <Step title="Create a provisioning configuration">
    * Go to `Provisioning` and click `New configuration`.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/entra-new-configuration.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=8bbfc25cc5b4ce6ff8d7bc9ea60fac9e" alt="Entra ID provisioning overview with the New configuration action" width="2874" height="1400" data-path="images/administration/scim/entra-new-configuration.jpg" />
    </Frame>
  </Step>

  <Step title="Enter the Plerion credentials">
    * Leave the authentication method as `Bearer authentication`.
    * In `Tenant URL`, paste the SCIM base URL you copied from Plerion.
    * In `Secret token`, paste your **readWrite** organization API key.
    * Click `Test connection` and confirm it succeeds, then click `Create`.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/entra-provisioning-credentials.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=e2b0ca88b3b6d550292f5a90e9f80b3a" alt="Entra ID new provisioning configuration with bearer authentication, tenant URL, and secret token" width="2876" height="1396" data-path="images/administration/scim/entra-provisioning-credentials.jpg" />
    </Frame>
  </Step>

  <Step title="Review the mappings">
    * Under `Mappings`, open `Provision Microsoft Entra ID Users` and confirm that `userPrincipalName` maps to `userName` and that the mail attribute maps to the primary email, because Plerion derives the Plerion email address from those fields.
    * Open `Provision Microsoft Entra ID Groups` and confirm it is enabled, with `displayName` mapped to `displayName` and `members` mapped to `members`. Each synced group appears in Plerion under `Admin` > `Directory` > `User groups`, marked as managed by your identity provider.
  </Step>

  <Step title="Choose the scope and start provisioning">
    * On the `Properties` tab, confirm `Provisioning scope` is `Sync only assigned users and groups`.
    * Assign groups under `Users and groups`. Their members are provisioned as users and the groups themselves as user groups.
    * Click `Start provisioning`. The first cycle starts within a few minutes.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/entra-provisioning-properties.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=90920d56c4045130254b8ceba8e5299e" alt="Entra ID provisioning properties with the scope set to assigned users and groups" width="2880" height="1300" data-path="images/administration/scim/entra-provisioning-properties.jpg" />
    </Frame>
  </Step>

  <Step title="Grant roles to the synced groups">
    * In Plerion, go to `Admin` > `Directory` > `User groups`, open each synced group, and grant it the roles its members should hold. See [User groups](/guides/administration/user-groups).
    * Until one of their groups grants a role, its members are refused at sign-in. A SCIM-managed user cannot be granted a role directly.
  </Step>

  <Step title="Verify the first cycle">
    * Open `Provisioning logs` to confirm the users and groups were created.
    * In Plerion, go to `Admin` > `Directory` > `Users` and confirm they appear with the roles their groups grant.
  </Step>
</Steps>

***

## Entra ID-specific behavior

* **Changes arrive in cycles, not instantly.** Entra ID runs an incremental cycle roughly every 40 minutes. A change you make in Entra ID can take that long to reach Plerion, including a deactivation. Use `Provision on demand` to push a single user immediately while you are testing.
* **Errors land in the provisioning logs.** Open `Provisioning logs` on the application, then match the message against the [troubleshooting table](/guides/administration/scim/overview#troubleshooting).

For the full user lifecycle and the break-glass rules that apply whatever your IdP, see [SCIM provisioning](/guides/administration/scim/overview).