Microsoft Entra ID provisioning

Configure provisioning in Settings → Single sign-on. SCIM works independently of sign-in: you can provision members while Enable single sign-on is off, without entering an OIDC issuer or client credentials. For sign-in setup, follow Microsoft Entra ID single sign-on.

Before you begin

• An owner or admin account in the Cust organization, with access to Single sign-on settings.
• Permission to configure enterprise applications and automatic provisioning in your Entra tenant, with the required Microsoft licensing.
• The team's email domains verified in Cust.

Use the same Cust organization and region throughout setup. This guide uses a non-gallery enterprise application for provisioning. If you also create a separate OIDC sign-in application, manage its access assignments separately.

What provisioning manages

Provision users. Cust does not create Entra group objects or synchronize passwords. Group assignment in Entra can determine which people are in scope without provisioning the groups themselves.

1. Get the connection values from Cust

1. Select Other OpenID Connect provider in Cust's Single sign-on settings to show the generic connection fields.
2. Under User provisioning (SCIM), copy the SCIM base URL.
3. Select Generate token and copy the token while it is shown.

The base URL ends in /scim/v2 on your regional Cust app host. Copy it from settings rather than entering a backend API address or adding /Users yourself. The token identifies the Cust organization.

2. Connect the provisioning application

1. In the Microsoft Entra admin center, open Entra ID → Enterprise apps → New application → Create your own application.

2. Name it Cust provisioning and choose the option to integrate an application outside the gallery.

3. Open Provisioning and create a New configuration.

4. Enter the connection values:

   Entra field	Value from Cust
   Tenant URL	The full SCIM base URL.
   Secret Token	The token alone. Entra supplies the Bearer prefix.

5. Select Test Connection, then save or create the configuration after it succeeds.

6. Set the scope to Sync only assigned users and groups. Assign one test user under Users and groups.

A successful connection test confirms that Entra can query the endpoint. Continue through mappings and a test user before enabling the wider rollout. Microsoft's SCIM connection guide describes the enterprise application setup.

3. Map user attributes

Open the provisioning configuration's Attribute Mapping. Enable the user mapping and turn off the group-object mapping. Keep the user create, update, and delete actions enabled so Entra can manage the complete lifecycle.

Set Match objects using this attribute to Yes for userName, with matching precedence 1. Turn matching off for other attributes. Cust matches SCIM queries by userName.

If a person's email differs from their UPN, align userName with the identity Entra supplies at Cust sign-in. That domain must be verified. Mapping only emails[type eq "work"].value does not update a Cust email; use userName for that change.

4. Map Cust roles

Cust accepts these role values:

Use the SCIM target roles[primary eq "True"].value. For a first test where everyone should be a Member, use a Constant mapping with the value MEMBER. For different access levels, map a controlled source attribute or expression that returns one of the values above. Apply role updates on every sync, not only on creation.

Using Entra app roles

Define the three role values on the application used for provisioning, and assign one role per user. When it has an app registration you own, use that registration's App roles. For a non-gallery enterprise application, follow Microsoft's enterprise application role management instructions.

Microsoft documents this expression for mapping an assigned app role to roles[primary eq "True"].value:

SingleAppRoleAssignment([appRoleAssignments])

Check its result for both creation and later role changes: Cust expects a role value such as BUILDER, rather than an app-role identifier or a JSON object encoded as a string. See Microsoft's role mapping guide.

For example, a Builder role in a SCIM user body is:

{
  "roles": [{ "value": "BUILDER", "primary": true }]
}

A new member without a recognized role receives Member access. An empty role list or an unrecognized value, including Entra's default User, leaves an existing member's role unchanged. Send MEMBER explicitly when downgrading access. Removing the currently granted role returns the member to Member.

If multiple supported role values reach Cust, the most privileged applies. Assign one intended role and verify it in Cust. Role mapping does not grant or remove ownership. See Members and roles for permissions.

5. Test the complete lifecycle

Use Provision on demand for the assigned test user, then also verify a normal provisioning cycle. Check Entra's Provisioning logs and Cust's Members page after each change.

If you also configured OIDC, test sign-in with the same user and identity. Enable the scheduled provisioning job, check its first completed cycle, then expand assignments.

Provisioning is asynchronous. An Entra assignment change is complete only when the corresponding update has reached Cust.

Ongoing management

While provisioning is enabled, manage provisioned members' roles and removal in Entra. Cust prevents those changes in its own member settings. Transfer ownership in Cust before deprovisioning an organization owner.

Generate a new token immediately invalidates the old token. Replace the Secret Token in Entra, retest the connection, and confirm the next provisioning cycle succeeds.

Disable provisioning in Cust revokes the SCIM token. It does not remove existing members or disable their sign-in. Turning SSO off also leaves provisioning enabled until its own token is revoked.

Troubleshooting

For help, send support@cust.co the provisioning log's error and operation details, with tokens and client secrets removed.