Skip to main content
Microsoft Entra ID (formerly Azure AD) can provision users and sync groups to ResolveAI.
An Entra ID Administrator must complete this setup. A ResolveAI organization admin must generate the credentials.Set up Azure AD SSO first. SCIM attaches to the same ResolveAI enterprise application.
Before you start, read Directory Sync (SCIM) for the effects of each push.

​
1. Get your credentials from ResolveAI

In ResolveAI:
  • Go to Admin → Authentication
  • Find Directory provisioning (SCIM)
  • Click Generate SCIM credentials
ResolveAI shows a base URL and a token. For Entra, use the Entra variant of the URL, which ResolveAI displays alongside the plain one:
Use the ?aadOptscim062020 suffix. It makes Entra send standards-compliant update operations. ResolveAI accepts the URL with or without the suffix, but the suffix makes Entra’s behavior predictable.ResolveAI shows the token only once. You cannot retrieve it later, so copy it before leaving the page.

​
2. Add provisioning in Entra

  • Go to the Azure Portal
  • Open Entra ID → Enterprise applications and select your ResolveAI app
  • Choose Provisioning in the left menu
  • Click Get started, then set Provisioning Mode to Automatic

​
3. Enter the connection details

Under Admin Credentials:
  • Tenant URL: the Entra variant URL from step 1, including ?aadOptscim062020
  • Secret Token: your SCIM token
Click Test Connection, then Save.

​
4. Map attributes and fix the email mapping

Open Mappings → Provision Microsoft Entra ID Users.
Entra maps userPrincipalName to userName by default. A UPN may look like an email address but often is not one. ResolveAI requires userName to contain the person’s real email address.Change the userName mapping to use mail instead of userPrincipalName.
Confirm the mapping includes: Only userName is required. ResolveAI refuses users whose mail value is empty. It does not invent an address. Populate mail, or exclude those users from the provisioning scope.

​
5. Set scope and turn provisioning on

  • Under Settings, choose the scope: either everyone assigned to the application, or all users and groups
  • Assign the users and groups who should have ResolveAI access
  • Set Provisioning Status to On
  • Click Save
Entra runs an initial cycle and then follows its own sync schedule. Confirm that people appear under Admin → Authentication in ResolveAI.
Wait for the user cycle to finish before relying on groups. If a group names people ResolveAI does not have yet, ResolveAI stores the group push but refuses to reconcile the linked team. The team stays unchanged; it is not emptied.

​
6. Put the groups to work

Entra pushes groups in scope automatically. A pushed group does not affect a team until you link it in ResolveAI. See Linking groups to teams. After you verify the directory, you can restrict sign-in to it. Sign-in enforcement previews who will gain or lose access.

​
Troubleshooting

Test Connection fails. Check that the Tenant URL uses the Entra variant with ?aadOptscim062020 and the api. host shown by ResolveAI. People are provisioned with the wrong address, or refused. This usually means userName is still mapped from userPrincipalName. Change the mapping to mail. See step 4. “Email domain is not configured for this SCIM connection”. ResolveAI accepts only the email domains configured on your connection. Matching is exact and does not include subdomains. A connection configured for example.com refuses someone@eng.example.com. Map Entra to send an address on a configured domain, or ask your Resolve contact to add it. A large group change looks half applied. Entra sends one request per member, so a fifty-person change arrives as fifty requests. ResolveAI waits a few seconds after the last request before updating the linked team. Refresh after a few seconds. Disabling an account. Setting a user inactive in Entra freezes the ResolveAI account and ends its sessions immediately. ResolveAI retains the record; it does not delete it.