Microsoft Entra

Create application in Entra

If you don’t already have an application in Entra, create one by navigating to “Applications” → “Enterprise Applications” and selecting “create your own application”.In the app creation flow, input a name for your application and select “Integrate any other application you didn’t find in the gallery”.

Enable automatic provisioning

Once you have an application, enable SCIM by clicking on “Provisioning” on the left hand management side bar, or “Provision User Accounts” under the Getting Started section.On the next page, click “Get started” and then switch the provisioning mode from “Manual” to “Automatic”.You should now see an “Admin Credentials” section. Leave this tab open, and navigate back to Stytch.

Create SCIM Connection in Stytch

Create a SCIM Connection on the Organization in the Stytch Dashboard or the Create SCIM Connection endpoint. Select Microsoft Entra as the IdP.Once you click save, you’ll be provided with the base url and bearer token you’ll need for the next step.Leave this tab open and navigate back to Entra to input the returned credentials.

Configure SCIM credentials in Entra

On the “Provisioning” tab under “Admin Credentials”:

1. Copy the “BaseURL” from Stytch into the “Tenant URL” field
2. Copy the “HTTP Header Bearer Token” from Stytch into the “Secret Token” field

If you did not specify an IdP when creating the SCIM Connection, you must append ?aadOptscim062020 to the returned BaseURL to flag the application into Entra’s SCIM 2.0 compliant version

Click “Test Connection”, then save.Navigate back to “Provisioning”, and

1. Under “Mappings” ensure that objectId is mapped to externalId (i.e. objectId is set to the “Source” attribute and externalId is set to the “Target” attribute).
2. Toggle “Provisioning Status” to “On”.

Provision users

Once saved, you can test the SCIM integration by assigning people to and removing people from the application. Entra does automatic syncing on a 40 minute timer, but you can provision on demand to speed up testing.You should see the status of the member changing from active to deactivated.

(Optional) Configure webhooks