Entra ID SCIM provisioning

Create, update, and deactivate users automatically from Microsoft Entra ID

With SCIM (System for Cross-domain Identity Management), Microsoft Entra ID manages the members of your workspace automatically: new employees are created, name and email changes are applied, and departed people are deactivated — without you inviting or removing anyone manually in meinGPT.

You find the setting under Settings → Access, section SCIM provisioning. It is only visible to workspace admins. Microsoft documents the Entra ID side of the setup in detail in its SCIM provisioning documentation; this page focuses on the meinGPT-specific steps.

SCIM or SSO — what's the difference?

Both connect Entra ID, but they solve two different problems. You can use them independently or together.

	Single Sign-On (SSO)	SCIM provisioning
Answers	How do users sign in?	Who exists and with what status?
Creates users	On first login	Up front and continuously from Entra ID
Removes users	No	Yes — deactivation when they leave
Team mapping	Yes, via Entra groups	No (v1 is users-only)

You configure login and group-to-team mapping under Access & Login Security. This page only covers user provisioning.

Achtung

SCIM is the source of truth. Once a SCIM token is active, invite links, email invites, domain auto-join, and manual user creation are disabled. Members are then managed exclusively via Entra ID. This is intentional — plan for it before enabling SCIM, or admins will wonder why invitations suddenly stopped working.

Prerequisites

At least one verified email domain. meinGPT only creates users whose email is on a verified domain of your workspace — this protects you from a misconfigured Entra application writing foreign addresses into your workspace. To verify a domain, see Access & Login Security. Without a verified domain, SCIM cannot be enabled.
SCIM is enabled for your workspace. If it isn't, contact support.
Workspace admin rights in meinGPT and administrator rights in Entra ID.

Setup

Generate the token in meinGPT. Under Settings → Access → SCIM provisioning, turn on Enable SCIM provisioning. meinGPT generates a token and shows it once — copy it immediately, it cannot be shown again. Also copy the Tenant URL from the same section.

SCIM provisioning section under Settings → Access with the toggle to enable it

The "Your SCIM token" dialog — the token is shown only once and must be copied immediately

Create the application in Entra ID. Microsoft Entra ID → Enterprise applications → New application → Create your own application (non-gallery).

Connect provisioning. In the application, under Provisioning, choose the Automatic mode, enter the Tenant URL and the token from step 1, and Test Connection.

Adjust the attribute mapping. externalId must map to objectId — the Entra default mailNickname will not work. userName maps to the email address on your verified domain (userPrincipalName or mail).

Assign users and start. Assign the users (or groups) to provision to the application and start provisioning.

For the first run, use a small test group rather than your whole workforce. Entra ID provisions individual users immediately via Provision on demand — so you see the result without waiting for the 40-minute cycle.

What happens

Create and merge. If the email address doesn't exist yet, a user is created. If it already exists, the existing membership is adopted — the previous role is preserved, chats and assistants are not lost.
Deactivate, not delete. When you disable a person in Entra ID, their membership in meinGPT is deactivated, not deleted. A Deactivated badge appears in the member list. Data is kept, and a deactivated member does not consume a seat.
Name. meinGPT takes first and last name from the Entra fields givenName and surname — not from the display name. If those fields are empty in Entra, the name stays empty in meinGPT even though the display name is set.
Users only. v1 syncs users, not group-to-team mapping. Team mapping runs via Entra group synchronization (Access & Login Security).
Audit log. Every create, update, and deactivation appears in the audit log as scim.user.*, with the affected user and the changed fields.
Marked in the member list. Members managed by Entra ID carry the Entra ID icon on the right edge of the member list — so you can tell at a glance who is provisioned automatically and therefore shouldn't be edited manually.

Member list with Entra-managed users, each showing the Entra ID icon on the right edge

Turning SCIM off again

Via Disable SCIM you restore manual management: invite links, email invites, and domain auto-join work again afterwards. Existing members — including deactivated ones — are kept. Re-inviting a previously deactivated member reactivates them.

You can rotate the token at any time. The old token stops working immediately, and you have to store the new one in Entra ID, otherwise provisioning fails.

When something doesn't work

Domain … is not verified for this organization. meinGPT rejects users whose email domain isn't verified. Verify the domain under Access & Login Security and restart provisioning.
Invitations no longer work. This isn't a bug: with SCIM active, all manual join paths are blocked (see the note above). To invite manually again, you have to disable SCIM.
Names stay empty. Set the givenName and surname fields in Entra ID — the display name alone is not enough.
Connection test fails. Check that the tenant URL and token were copied exactly from the SCIM section. After a token rotation, the new token must be stored in Entra ID.

Frequently asked questions

Do I also need SSO?

No, the two are independent. SCIM creates and deactivates users; SSO handles login and team mapping. Many organizations use both — but you don't have to.

What happens to existing members when I enable SCIM?

They stay unchanged. On the first sync, users whose email matches an account provisioned in Entra are merged with the existing meinGPT account (role and content are kept). Manual join paths are blocked from then on.

I deleted someone in Entra ID — is the account gone in meinGPT?

No. SCIM deactivates the membership but never deletes it. The account stays as a deactivated member and can be reactivated later.

Do deactivated members count toward billing?

No. Deactivated members don't consume a seat and are not included in seat billing.

Was this page helpful?