Attribute Reference

This page covers the SCIM user properties and Authenticx extension fields that Entra sends during provisioning. Use it when configuring attribute mappings in the Entra provisioning UI.

Authenticx SCIM User Properties

Authenticx accepts the following user properties from Entra.

SCIM attribute	Required	Standard or Authenticx-specific	Notes
userName	Yes	SCIM core	Unique user identifier. Usually maps from Entra userPrincipalName or mail.
externalId	No	SCIM core	Entra-owned identifier. Authenticx stores it as the SAML provider user code. Recommended mapping: Entra objectId.
name.givenName	Yes for create	SCIM core	First name.
name.familyName	Yes for create	SCIM core	Last name.
emails[type eq "work"].value	Yes for create	SCIM core	Primary email selected by primary == true; otherwise Authenticx uses the first email.
phoneNumbers[type eq "work"].value	No	SCIM core	Primary phone selected by primary == true; otherwise Authenticx uses the first phone.
timezone	No	SCIM core	IANA timezone, for example America/New_York. Entra can provision this when an Entra attribute or expression is mapped to the SCIM timezone target attribute. If omitted, Authenticx defaults the user to America/Indianapolis because users without a timezone cannot sign in. PATCH requests only need to send it when changing the value.
active	No	SCIM core	false disables or deprovisions the user in Authenticx.
roles[primary eq true].value	Recommended	SCIM core	Must be an active Authenticx role name or role ID. Authenticx applies one role.
displayName	No	SCIM core, read-only in Authenticx	Entra may send it, but Authenticx derives it from given and family name.

Authenticx Agent-User Properties

Agent-user provisioning uses the Authenticx SCIM extension because standard SCIM has no equivalent field for creating a linked Authenticx agent record.

SCIM attribute	Required	Notes
urn:authenticx:params:scim:schemas:extension:agent:2.0:User:enableAgentUser	No	Set to true to create, link, or maintain the user's Authenticx agent record.
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager	No	Recommended way to set the linked agent-user's manager. Map from the Entra manager attribute; Entra resolves it to the manager's Authenticx user ID. Ignored for users that are not agent users. See Configuration Guide: Manager Mapping.
urn:authenticx:params:scim:schemas:extension:agent:2.0:User:managerId	No	Alternative to the enterprise manager: an Authenticx user ID. Takes precedence when both are sent. Returns an error for users that are not agent users.
urn:authenticx:params:scim:schemas:extension:agent:2.0:User:agentId	Read-only	Returned by Authenticx when a linked agent exists. Do not map an Entra source value to this field.

📘

When to use enableAgentUser

Use it only for users who should have linked Authenticx agent records. For admin, analyst, or other non-agent users, omit the extension or map it to false.

Authenticx Hierarchy Properties

SCIM attribute	Required	Notes
urn:authenticx:params:scim:schemas:extension:hierarchy:2.0:User:hierarchyCodes	No	Used when Authenticx enables hierarchies by code. Multi-valued string of hierarchy codes, each optionally followed by an access level: SVC-1001 grants View, SVC-1001:Edit grants Edit, SVC-1001:Manage grants Manage.
urn:authenticx:params:scim:schemas:extension:hierarchy:2.0:User:hierarchyIds	No	Used when Authenticx enables hierarchies by ID. Multi-valued string of Authenticx hierarchy IDs, with the same optional :Edit or :Manage suffix.

Hierarchy provisioning is off until Authenticx enables it for the integration, and Authenticx sets which one of the two attributes it uses. While it is off, Authenticx ignores hierarchy data and doesn't return any. See Configuration Guide: hierarchy provisioning.

Response and Update Behavior

• Single-user GET, create, update, list, and filtered GET /scim/v2/Users responses include the configured hierarchy extension.
• A missing hierarchy extension leaves assignments unchanged. For a full replacement, an explicit empty list removes all hierarchy assignments. Entra PATCH operations add or remove only the named entries.
• A missing Enterprise User manager leaves the existing linked agent manager unchanged; an explicit null clears it. managerId takes precedence if both manager fields are sent.
• Disabling a user still succeeds if a bundled manager or hierarchy change is invalid; those invalid changes are skipped. Disabling a manager clears their reports’ manager links.

🚧

Role mapping in Entra

Map only roles[primary eq true].value. Do not add a mapping for roles[primary eq true].primary; Entra can produce a malformed filtered-array PATCH when both are mapped.