SCIM provisioning with Microsoft Entra ID

Connect Microsoft Entra ID to Conduit with SCIM 2.0 so Entra automatically creates, updates, and deactivates Conduit users — and, optionally, materializes your Entra groups as Conduit teams. You configure this once: generate a token in Conduit, paste it into an Entra Enterprise application, then assign users and groups.

Don’t use the gallery “Conduit” app

Don’t use the gallery “Conduit” app — create a non-gallery enterprise app, then paste the Tenant URL and Secret token from Conduit Settings → Provisioning. The gallery listing says out-of-the-box automatic provisioning is not supported and disables Get started. Conduit does support SCIM 2.0; that banner only applies to the gallery app.

This page is self-contained, but if you want the shared concepts — what SCIM provisions, how the shadow-user model works, and the other supported IdPs — see the SCIM provisioning overview.

Prerequisites:

• Owner or Admin on the Conduit organization (needed to generate the SCIM token).
• An Entra ID admin who can create Enterprise applications.

---

Step 1 — Generate a SCIM token in Conduit

This first step is identical for every IdP and always happens in Conduit first.

1. In Conduit, go to Provisioning (/org/scim).
2. Click Connect IdP.
3. Choose Microsoft Entra ID.
4. Pick the default role new SCIM-provisioned users will receive — member is the safe default.
5. Click Generate token.
6. Copy the Tenant URL and Secret token. They are shown only once — keep the tab open while you configure Entra.

Those two values — the Tenant URL and the secret token — are everything Entra needs.

---

Step 2 — Create the Enterprise application

1. In the Azure portal, go to Microsoft Entra ID → Enterprise applications → + New application.
2. Click Create your own application.
3. Give it a name (e.g. “Conduit SCIM”).
4. Choose Integrate any other application you don’t find in the gallery (Non-gallery). Do not add the gallery application named Conduit. That listing shows automatic provisioning is not supported and leaves Get started disabled.
5. Click Create.

Step 3 — Configure provisioning

1. From the app’s Overview, choose Provisioning → Get started.
2. Set Provisioning Mode to Automatic.
3. Under Admin Credentials, paste the Tenant URL into Tenant URL and the Secret token into Secret Token — both from Step 1.
4. Click Test Connection. Expect “The supplied credentials are authorized to enable provisioning”.
5. Click Save.

Step 4 — Assign users and start provisioning

1. From the app’s Overview, go to Users and groups → + Add user/group, pick who to provision, then Assign.
2. Back in Provisioning, set Provisioning Status to On, then Save.
3. Click Provision on demand to push the first batch immediately, rather than waiting for the sync cycle.

Note

Entra provisions on a schedule — roughly every 40 minutes — so ongoing changes sync automatically. Use Provision on demand whenever you want a change to take effect right away.

Note

Entra only sends memberships for groups that are explicitly assigned to the application. To sync a group as a Conduit team, add the group itself under Users and groups — assigning only its individual members will not materialize the team.

---

How Conduit handles Entra ID

Entra takes a few liberties with the SCIM spec: it capitalizes PATCH operations (Add/Replace/Remove) and uses members[value eq "<id>"] paths on group updates. Conduit normalizes these automatically, so there are no attribute-mapping workarounds or custom expressions to configure — the defaults in the steps above are all you need.

What gets provisioned

Entra action	Result in Conduit
User assignment (direct or via group)	users row + org_members row at the connection’s default role
Group assignment	org_teams row + org_team_members for each member
User deactivated / unassigned	org_members row removed; user marked inactive (re-activatable)

Note

SCIM creates a “shadow” user record keyed by email. A provisioned user still signs in through Conduit’s existing SSO — on first sign-in the shadow record binds to their identity.

Verify

After the first push, confirm the results in Conduit:

• /org/members — assigned users appear at the connection’s default role.
• /org/teams — any groups you assigned appear as teams, with their members.

Troubleshooting

• “Test Connection” fails with 401 — the token in Entra doesn’t match what Conduit issued. In Conduit, generate a fresh token (Provisioning → Connect IdP) and paste the new Tenant URL and secret token into Entra.
• Group memberships not syncing — Entra only sends memberships for groups explicitly assigned to the application. Add the group itself under Users and groups, not just its members.
• Provisioning paused after errors — Entra auto-pauses after sustained failures. Open Provisioning logs, fix the cause, then Restart provisioning.
• Gallery “Conduit” app says provisioning is not supported, or Get started is disabled — that listing is not how Conduit SCIM works. Create a non-gallery enterprise app and paste the Tenant URL and Secret token from Settings → Provisioning.

Revoking access

To disconnect Entra, go to Conduit Provisioning (/org/scim) and click Revoke on the connection. The token is invalidated immediately, so Entra receives a 401 on its next sync. Teams and users the connection created remain in place until you remove them manually. See the overview for details.