---
title: "Entra ID SCIM provisioning"
description: "Create, update, and deactivate users automatically from Microsoft Entra ID"
canonical_url: "https://meingpt.com/en/docs/admin-guide/entra-scim-provisioning"
language: en
---

# Entra ID SCIM provisioning

With **SCIM** (System for Cross-domain Identity Management), Microsoft Entra ID manages the members of your workspace automatically: new employees are created, name and email changes are applied, and departed people are deactivated — without you inviting or removing anyone manually in meinGPT.

You find the setting under **Settings → Access**, section **SCIM provisioning**. It is only visible to workspace admins. Microsoft documents the Entra ID side of the setup in detail in its [SCIM provisioning documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups); this page focuses on the meinGPT-specific steps.

## SCIM or SSO — what's the difference?

Both connect Entra ID, but they solve two different problems. You can use them independently or together.

| | Single Sign-On (SSO) | SCIM provisioning |
| --- | --- | --- |
| Answers | **How** do users sign in? | **Who** exists and with what status? |
| Creates users | On first login | Up front and continuously from Entra ID |
| Removes users | No | Yes — deactivation when they leave |
| Team mapping | Yes, via Entra groups | No (v1 is users-only) |

You configure login and group-to-team mapping under [Access & Login Security](/en/docs/admin-guide/access-and-login-security). This page only covers user provisioning.

**SCIM is the source of truth.** Once you activate SCIM, meinGPT permanently deletes all pending email invitations and resets your invite links — this isn't a temporary pause, it's an actual deletion and regeneration. Domain auto-join and manual user creation are also disabled while SCIM is active. Members are then managed exclusively via Entra ID. This is intentional — plan for it before enabling SCIM, or admins will wonder why invitations suddenly stopped working.

## Prerequisites

- **At least one verified email domain.** meinGPT only creates users whose email is on a verified domain of your workspace — this protects you from a misconfigured Entra application writing foreign addresses into your workspace. To verify a domain, see [Access & Login Security](/en/docs/admin-guide/access-and-login-security). Without a verified domain, SCIM cannot be enabled.
- **SCIM is enabled for your workspace.** If it isn't, contact support.
- **Workspace admin rights** in meinGPT and administrator rights in Entra ID.

## Setup

**Generate the token in meinGPT.** Under **Settings → Access → SCIM provisioning**, turn on **Enable SCIM provisioning**. meinGPT generates a token and shows it once — **copy it immediately, it cannot be shown again**. Also copy the **Tenant URL** from the same section.

![SCIM provisioning section under Settings → Access with the toggle to enable it](/images/admin-guide/entra-scim/scim-provisioning-en.png)

![The "Your SCIM token" dialog — the token is shown only once and must be copied immediately](/images/admin-guide/entra-scim/scim-token-en.png)

**Create the application in Entra ID.** Microsoft Entra ID → **Enterprise applications → New application → Create your own application** (non-gallery).

**Connect provisioning.** In the application, under **Provisioning**, choose the **Automatic** mode, enter the **Tenant URL** and the **token** from step 1, and **Test Connection**.

**Adjust the attribute mapping.** `externalId` must map to `objectId` — the Entra default `mailNickname` will not work. `userName` maps to the email address on your verified domain (`userPrincipalName` or `mail`).

**Assign users and start.** Assign the users (or groups) to provision to the application and **start provisioning**.

For the first run, use **a small test group** rather than your whole workforce. Entra ID provisions individual users immediately via **Provision on demand** — so you see the result without waiting for the 40-minute cycle.

## What happens

- **Create and merge.** If the email address doesn't exist yet, a user is created. If it already exists, the existing membership is adopted — the previous role is preserved, chats and assistants are not lost.
- **Deactivate, not delete.** When you disable a person in Entra ID, their membership in meinGPT is **deactivated, not deleted**. A **Deactivated** badge appears in the member list. Data is kept, and a deactivated member does not consume a seat.
- **Name.** meinGPT takes first and last name from the Entra fields `givenName` and `surname` — **not** from the display name. If those fields are empty in Entra, the name stays empty in meinGPT even though the display name is set.
- **Users only.** v1 syncs users, not group-to-team mapping. Team mapping runs via Entra group synchronization ([Access & Login Security](/en/docs/admin-guide/access-and-login-security)).
- **Audit log.** Every create, update, and deactivation appears in the [audit log](/en/docs/admin-guide/compliance-controls) as `scim.user.*`, with the affected user and the changed fields.
- **Marked in the member list.** Members managed by Entra ID carry the Entra ID icon on the right edge of the member list — so you can tell at a glance who is provisioned automatically and therefore shouldn't be edited manually.
- **Seat and role.** Users newly created via SCIM start as a Viewer without a seat. If the "[Auto-assign seats for new members](/en/docs/admin-guide/member-management#auto-assign-seats-for-new-members)" toggle is enabled, they're automatically granted a seat and become a Member — exactly the same as someone joining via email invitation, invite link, or a verified domain. If the toggle is disabled, they remain a Viewer until an admin assigns them a seat manually.

![Member list with Entra-managed users, each showing the Entra ID icon on the right edge](/images/admin-guide/entra-scim/scim-users-list-en.png)

## Turning SCIM off again

Via **Disable SCIM** you restore manual management: you can invite by email again, and domain auto-join works again. The invite link meinGPT generates at that point is new — the original link, reset when you activated SCIM, does not come back, and any invitations you'd already sent but that weren't accepted yet need to be sent again. Existing members — including deactivated ones — are kept. Re-inviting a previously deactivated member reactivates them.

You can **rotate** the token at any time. The old token stops working immediately, and you have to store the new one in Entra ID, otherwise provisioning fails.

## When something doesn't work

- **`Domain … is not verified for this organization`.** meinGPT rejects users whose email domain isn't verified. Verify the domain under [Access & Login Security](/en/docs/admin-guide/access-and-login-security) and restart provisioning.
- **Invitations no longer work.** This isn't a bug: with SCIM active, all manual join paths are blocked (see the note above). To invite manually again, you have to disable SCIM.
- **Names stay empty.** Set the `givenName` and `surname` fields in Entra ID — the display name alone is not enough.
- **Connection test fails.** Check that the tenant URL and token were copied exactly from the SCIM section. After a token rotation, the new token must be stored in Entra ID.

## Frequently asked questions

**Do I also need SSO?**

No, the two are independent. SCIM creates and deactivates users; SSO handles login and team mapping. Many organizations use both — but you don't have to.

**What happens to existing members when I enable SCIM?**

They stay unchanged. On the first sync, users whose email matches an account provisioned in Entra are merged with the existing meinGPT account (role and content are kept). Manual join paths are blocked from then on.

**I deleted someone in Entra ID — is the account gone in meinGPT?**

No. SCIM deactivates the membership but never deletes it. The account stays as a deactivated member and can be reactivated later.

**Do deactivated members count toward billing?**

No. Deactivated members don't consume a seat and are not included in seat billing.

**Can I sync additional attributes like job title or phone number?**

No. SCIM only carries first name, last name, email address, and active status; other Entra fields such as job title, phone number, or department are neither read nor stored in meinGPT. Team mapping runs separately through group sync (see "Users only" above) — it doesn't transfer any additional profile data either.

**Does a user still need an email invitation if they use SSO (no SCIM)?**

Yes, unless a verified email domain has auto-join enabled. Signing in with Microsoft only authenticates the person and creates their meinGPT account — it does not add them to your workspace. Without SCIM, they still need one of the three regular join paths: an email invitation, an invite link, or a verified auto-join domain (see [Member Management](/en/docs/admin-guide/member-management)). If none applies, they can complete SSO sign-in but won't land in your workspace at all — there's no "signed in but access-pending" state.