Microsoft Entra provisioning

Use a non-gallery enterprise application in Microsoft Entra ID to create, update, and deactivate Sim organization members. Configure single sign-on separately for authentication.

Before you start

• On Sim Cloud, use an Enterprise organization. Use an organization owner or admin account to configure provisioning.
• Verify each provisioned email domain.
• Use an Entra administrator who can create enterprise applications and manage provisioning.
• Make Sim reachable by Entra over HTTPS. Self-hosted deployments must meet the SCIM rollout requirements.

Automated user provisioning is available with Entra ID Free. Group provisioning and group-based application assignment require P1 or higher. See Microsoft licensing.

Start with dedicated test accounts. Provisioned members use a seat and receive workspace access through mappings or existing grants.

An existing SAML or OIDC sign-in setup can remain in place. Use the same account email for authentication and provisioning, and review app assignments if they use separate enterprise applications. See Plan membership and access for the distinction between sign-in, organization membership, workspace access, and permission policy.

Connect Entra to Sim

1. 1

   Enable provisioning in Sim

   Open Settings → Organization → Single sign-on → Provisioning and enable Enable directory provisioning. Copy Connection → Base URL. Under Tokens, choose an expiry and select Issue token. Copy the token before closing its dialog; Sim shows it once.

2. 2

   Create the enterprise application

   In Entra, open Enterprise applications → New application → Create your own application. Name the app, for example Sim provisioning, choose Integrate any other application you don't find in the gallery (Non-gallery), and select Create.

3. 3

   Configure the connection

   Open the app's Provisioning page, select New configuration, and choose Bearer authentication.

   Field	Value
   Tenant URL	Sim's HTTPS Base URL ending in /api/scim/v2
   Secret token	Your Sim token, without a Bearer prefix

   Select Test connection, then Create after it succeeds. Entra adds the bearer prefix. A successful test confirms connectivity and authentication; a test assignment verifies provisioning.

   

4. 4

   Set scope and attribute mappings

   In the configuration's Properties, keep Scope set to Sync only assigned users and groups. Review accidental deletion protection before broadening the rollout.

   Under Users and groups → Add user/group, choose a test account and select Assign. On the Free plan, assign accounts individually.

   Under Attribute mapping, review the user mappings:

   Entra attribute	SCIM attribute
   userPrincipalName	userName, retained as the matching attribute
   mail	Work email
   displayName	displayName

   Use an email in a verified Sim domain. If the UPN differs from the account email, adjust mappings before provisioning. When Mail is empty, Entra omits the work email and Sim uses userName as the account email; that UPN must be a valid email address in a verified domain.

   

Verify the user lifecycle

1. Open Provision on demand, search for the assigned test account, and select Provision. Inspect the import, scope, matching, and action results.
2. In Sim, confirm the member under Organization → Members and successful requests under Single sign-on → Provisioning → Activity.
3. Change its display name in Entra and provision again. Confirm the new name in Sim. An unchanged repeat should report that source and target already match.
4. Remove the app assignment, then provision that account on demand again. Confirm Sim deactivates the member.
5. Reassign and provision it to verify reactivation of the same account. Assignment changes can take a few minutes to reach provisioning.

Deactivation and directory deletion

Sim deactivation suspends access while retaining membership, ownership, and the seat. See Microsoft's deprovisioning lifecycle and Sim's lifecycle behavior.

Provision groups and verify access

With P1 or higher, create a security group with Assigned membership and add test accounts as direct members. Assign it under Users and groups. Review Attribute mapping and keep group provisioning enabled. Create the target workspace and a dedicated permission group in Sim, configuring that policy's restrictions and workspace scope before mapping it.

1. Run Provision on demand for one group and select up to five test members, or wait for a scheduled cycle. Nested membership is unsupported; see Microsoft group assignment.
2. Once the group appears under Single sign-on → Provisioning → Group mappings in Sim, add a Workspace mapping and a Permission group mapping to the policy created above. Confirm both workspace access and policy restrictions. A permission-group mapping alone does not grant workspace access; an organization-admin mapping is a separate privilege.
3. For automatic policy matching, enable Provisioning rules → Manage rules → Match permission groups by name. Names must match an existing non-default Sim permission group exactly, including case. Select Reconcile now for groups already synced. Sim does not create the permission group.
4. Remove a test member from the group while retaining a separate direct app assignment. After synchronization, confirm the directory workspace grant is withdrawn while the account remains active. Check the fallback policy on any workspace the person can still access.
5. Add the member back and verify access and restrictions return.

Read How access is withdrawn before mapping groups that overlap manual access.

Start automatic provisioning

After testing, return to the provisioning Overview and select Start provisioning. Wait for the initial cycle and inspect Provisioning logs for failures. Subsequent cycles normally run about every 40 minutes; changes are not immediate. See Microsoft's provisioning lifecycle.

Keep the scope limited to assigned accounts and groups. Use on-demand provisioning for small tests, and regular cycles for directory disablement or deletion.

Leave the job running during a scheduled lifecycle test. Restart provisioning clears its change watermark and starts another initial cycle; changing mappings or scoping filters also resets it. Wait for the incremental cycle and inspect the account's log before changing more settings.

Rotate a token

Issue a replacement token in Sim while the current one remains active. In Entra's provisioning configuration, open Connectivity, replace Secret token, select Test connection, and save. Confirm a successful provisioning request before revoking the old token. Sim allows two active tokens for overlapping rotation.

Troubleshooting

Use Entra's Provisioning logs and Sim's Provisioning → Activity. Invalid or revoked tokens appear only in Entra because Sim cannot associate them with a connection.

Related docs

• Directory provisioning
• Single sign-on
• Verified domains