Microsoft Entra SCIM Provisioning

📘
Who this is for
This guide is for Microsoft Entra administrators who manage enterprise application provisioning. It assumes Authenticx has already issued SCIM/OAuth credentials for your organization. You need the Cloud Application Administrator or Application Administrator role in Entra.

What Entra Will Manage

Microsoft Entra provisioning handles these lifecycle actions in Authenticx:

Create an Authenticx user when an assigned Entra user enters scope.
Update standard user properties like name, email, phone, timezone, active status, and role.
Disable the Authenticx user when the Entra account is disabled or removed from provisioning scope.
Create a linked agent-user record when the Authenticx agent extension is mapped (optional).

🚧
One role per user
Authenticx supports one role per user. Ensure each provisioned user resolves to exactly one active Authenticx role in your organization before enabling automatic provisioning.

Prerequisites

Collect these values from Authenticx before configuring Entra:

Item	Value
SCIM Base URL	`https://<api-host>/scim/v2`
OAuth Token Endpoint	`https://<api-host>/connect/token`
OAuth Client ID	Issued by Authenticx
OAuth Client Secret	Issued by Authenticx
OAuth Scope	`acxapi`
Authenticx Roles	Active role names or IDs for your organization
Agent-User Decision	Whether some or all provisioned users should create linked agent-user records

Required Entra role: Cloud Application Administrator or Application Administrator.

In This Section

Page	What it covers
Attribute Reference	SCIM user properties and agent-user extension fields Entra can send to Authenticx
Configuration Guide	Step-by-step walkthrough for setting up provisioning in Entra
Role Maintenance	How to keep role assignments synchronized between Entra and Authenticx over time
Troubleshooting	Common errors and how to resolve them