This page covers the SCIM user properties and Authenticx extension fields that Entra sends during provisioning. Use it when configuring attribute mappings in the Entra provisioning UI.
Standard User Properties
Authenticx accepts the following SCIM core user properties from Entra:
| SCIM Attribute | Required | Notes |
|---|---|---|
userName | Yes | Unique user identifier. Map from Entra userPrincipalName or mail. |
externalId | No | Stored as the SAML provider user code. Recommended: map from Entra objectId. |
name.givenName | Yes for create | First name. |
name.familyName | Yes for create | Last name. |
emails[type eq "work"].value | Yes for create | Primary email selected by primary == true; otherwise Authenticx uses the first email. |
phoneNumbers[type eq "work"].value | No | Primary phone selected by primary == true; otherwise Authenticx uses the first phone. |
timezone | No | IANA timezone string, e.g. America/New_York. |
active | No | false disables or deprovisions the user in Authenticx. |
roles[primary eq true].value | Recommended | Must be an active Authenticx role name or role ID. Authenticx applies one role per user. |
displayName | No | Read-only in Authenticx. Derived from given and family name — do not treat as an authoritative inbound value. |
Agent-User Extension Properties
Agent-user provisioning uses an Authenticx SCIM extension because standard SCIM has no equivalent for creating a linked agent record. The extension namespace is:
urn:authenticx:params:scim:schemas:extension:agent:2.0:User| SCIM Attribute | Required | Notes |
|---|---|---|
…extension:agent:2.0:User.enableAgentUser | No | Set to true to create, link, or maintain the user's Authenticx agent record. |
…extension:agent:2.0:User.agentId | Read-only | Returned by Authenticx when a linked agent exists. Do not map an Entra source value to this field. |
When to useenableAgentUserUse this only for users who should exist as Authenticx agent users. For admin, analyst, or non-agent users, omit this extension or map it to
false.
Role Value Rules
- The value must match an active Authenticx role name (case-insensitive) or a valid Authenticx role ID.
- If
rolesis omitted, Authenticx leaves the user's existing role unchanged. - If
rolesis sent as an empty array, Authenticx removes the user's role. - If multiple roles are sent, exactly one must be primary. The preferred setup is to send one role value.
Do not maproles[primary eq true].primaryWhen Entra maps multiple sub-attributes under the same filtered array element, it can produce a malformed PATCH payload even when the provisioning log appears successful. Map only
roles[primary eq true].value.
Recommended Constant Mappings
Add these as constant values in the Entra attribute mapping UI alongside your standard mappings:
| Constant | SCIM Target |
|---|---|
true | emails[type eq "work"].primary |
work | emails[type eq "work"].type |
true | phoneNumbers[type eq "work"].primary |
work | phoneNumbers[type eq "work"].type |