Provisioning people from your directory (SCIM)

Let Entra, Okta or Google Workspace open and close accounts here automatically. Enterprise, over SCIM 2.0.

What it does, and what it deliberately does not

Your directory becomes the list. Somebody added to the group you assign gets an account here without anybody inviting them; somebody removed from it, or switched off in the directory, loses their sign-in here within a few minutes.

It cannot delete anything. Every removal — a deactivation, somebody dropping out of the assigned group, even a directory sending an outright delete — suspends the account and leaves its codes, cards and contacts with the company. A licence lapsing overnight or a mis-clicked filter is then a thing you undo, not a thing you restore from a backup.

It cannot make anybody an owner, and a job title it sends that we do not recognise becomes a viewer rather than something more.

What you need before you start

The Enterprise plan, an admin account here, and enough rights in your directory to create an enterprise application. Single sign-on is not required, but the two belong together: SCIM decides who exists, single sign-on decides how they get in.

Getting the address and the token

1. Open Team here and find Directory provisioning.
2. Copy the tenant URL. It ends in /scim/v2 and it is the same for every provider.
3. Press Issue token and copy what it shows you. It is shown once — it is stored as a hash, so there is no screen that can show it again.

Microsoft Entra ID, step by step

1. In Entra, open Enterprise applications, then New application, then Create your own application. Name it Lynkarr and choose “Integrate any other application you don’t find in the gallery”.
2. Open Provisioning on the new application and set the mode to Automatic.
3. Under Admin Credentials, paste the tenant URL into Tenant URL and the token into Secret Token.
4. Press Test Connection. It should succeed before you save; if it does not, the two most common causes are a trailing slash on the URL and a token that was copied short.
5. Save, then open Users and groups and assign the group whose members should have accounts here.
6. Back in Provisioning, set the scope to “Sync only assigned users and groups” and switch Provisioning Status on.
7. Press Provision on demand with one person to check it before the whole group runs.

The attribute mapping

Entra’s defaults work. Four attributes are read and the rest are ignored: userPrincipalName to userName, displayName to displayName, givenName and surname to the name parts, and active for whether the person can sign in.

If your userPrincipalName is not the address people actually use, map mail to userName instead. The address is the identity here, and a mismatch creates a second account rather than updating the first.

Delete mappings you do not need rather than leaving them pointed at attributes you do not fill. Entra treats a failed mapping as a failed user, and one empty field can quarantine the whole cycle.

Okta and Google Workspace

The same two values in a different order. In Okta, create an application with SCIM 2.0 Header Auth, put the tenant URL in as the base URL, the token in as the bearer, and enable Create Users, Update User Attributes and Deactivate Users.

Google Workspace works through its own auto-provisioning form and asks for the same URL and token.

Turning it off

Revoke the token on the Team page. Your directory stops being able to change anything here immediately, and everybody who already has an account keeps it — revoking is not a mass deactivation, and cannot become one.

It is a token of its own rather than an API token, so revoking a directory that is behaving badly does not take your integrations down with it.

If somebody is not appearing

Check they are in the assigned group, then check the address. A person whose directory address differs from the one they already sign in with here is two people to any SCIM implementation, including this one.

Entra’s provisioning logs name the user and the reason, and every change made this way is in your audit log here with the directory as the actor.