Skip to main content

Setting Up SCIM Group Provisioning and Deprovisioning with MS Entra

Updated

Step 1: Access the Microsoft Entra Portal

  1. Navigate to the Microsoft Entra portal
  2. Sign in with your administrator credentials 

Step 2: Register a New Application In MS Entra

  1. In the left-hand menu, select Application - Enterprise applications
  2. Click + New Application
  3. Click + Create your own application
  4. Fill the application details:
    • What's the name of your app?: Enter a name for your app
    • What are you looking to do with your application?: Choose the “Integrate any other application you don’t find in the gallery (Non-gallery)”
  5. Click Create

After registration, you’ll be taken to the app overview page.

Step 3: Configure Single Sign-On Settings

  1. In the left-hand menu, select Application - Enterprise applications
  2. Select your application
  3. Select Single sign-on from the application's left-hand menu
  4. Select SAML
  5. Configure the “Basic SAML Configuration” as per below screenshot
    • Identifier (Entity ID): loopio-sp

    • Reply URL (Assertion Consumer Service URL): https://LOOPIOURL/sso_saml/module.php/saml/sp/saml2-acs.php/loopio-sp

       

      Learn more: What is my Company's Loopio URL?

  6. Download the SSO settings XML file from the “Federation Metadata XML” section. We will use this XML file to configure the “SAML SSO settings” in Loopio

     

    Note: Before proceeding with SCIM setup, SAML SSO must be the only login method, and our Support Team must enable SCIM for your account. If you don't see the SCIM panel on your Admin screen, please reach out to our Support Team via the Help menu in Loopio.

Step 4: Generate a SCIM token from Loopio

  1. In Loopio, access the Admin page
  2. Select the Integrations tab
  3. In the User Management section, on the SCIM tile, click Generate Token

  4. Copy this token to configure the provisioning in Entra

     

    Note: If this token was previously generated (previously using SCIM without group functionality) it needs to be generated again. See Regenerating Your SCIM Token

Step 5: Configuring the SCIM Provisioning in Entra

  1. In Entra, in the left-hand menu, select Application - Enterprise applications
  2. Select your application created in step 2 above
  3. Select Provisioning from the left menu
  4. Again, click on Provisioning from the left menu
  5. Under Provisioning Mode, select Automatic
  6. Enter the SCIM API endpoint and authentication credentials provided by the target application
  7. Click Test Connection to verify connectivity
  8. Save the configuration
  9. Refresh the page

Step 6: Set the Attribute Mapping for Provisioning

  1. In Entra, in the left-hand menu, select Application - Enterprise applications
  2. Select your application created in step 2 above
  3. Select Provisioning from the left menu

  4. Click Attribute Mapping (Preview)

     

    Note: If the 'Attribute Mapping' menu isn’t enabled, please refresh the page manually.

  5. Select Provision Microsoft Entra ID Users

  6. Add/update the attributes below:

    Target attribute Source attribute/Expression/Constant Mapping type Attribute Operation
    active Switch([IsSoftDeleted], , "False", "1", "True", "0") Expression Update
    emails[type eq "work"].value userPrincipalName Direct Update
  7. Save those changes

Step 7: Assign Groups to the Application

 

Important: The Group name in Entra must exactly match the Role name in Loopio

  1. In Entra, in the left-hand menu, select Application - Enterprise applications
  2. Select your application created in step 2 above
  3. Go to the Users and groups menu
  4. Click + Add user/group
  5. Select the Groups

  6. Select a Role for the Groups

     

    Note: The chosen Role does not have any impact on provisioning as users will be assigned to a default Role in Loopio when they are created, however Role selection is necessary to be able to assign the Groups in Entra.

  7. Click Assign

Step 8: Start the Provisioning

  1. In Entra, in the left-hand menu, select Application - Enterprise applications
  2. Select your application created in step 2 above
  3. Select Provisioning from the left menu
  4. Click Overview (Preview)

  5. Click Start provisioning

     

    Note: With automatic user provisioning, Microsoft Entra ID syncs user accounts based on assignments every 40 minutes (More Info).

You may also use the Provision on Demand option to instantly test:

  1. In Entra, in the left-hand menu, select Application - Enterprise applications
  2. Select your application created in step 2 above
  3. Select Provisioning from the left menu
  4. Click on Provision on Demand
  5. Select the Groups and Users
  6. Click Provision

Once Group provisioning has been set up, any member added or removed from the Group in Entra will be provisioned or deprovisioned in Loopio. 

Step 9: Monitoring the Provisioning Log

  • Navigate to the Provisioning Logs section to monitor provisioning activities
  • Use the Audit Logs in Entra ID for troubleshooting 

Step 10: Troubleshooting Common Issues

  • Failed Connections: Verify the SCIM endpoint and authentication details
  • Sync Errors: Check logs for detailed error messages and adjust attribute mappings
  • User Not Provisioned: Ensure the user is assigned to the application 

Notes:

  • Users should have below valid details:
    • First name (Required)
    • Last name (Required)
    • User Role (Must have valid role)
  • All users in Loopio, should exist in MS Entra.
  • With automatic user provisioning, Microsoft Entra ID syncs user accounts based on assignments every 40 minutes (More Info)
  • If a user is deleted from Entra, we disable the user in Loopio. User accounts cannot be deleted from Loopio

Related to

Related articles