> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID SCIM Provisioning

> Provision users and sync groups from Microsoft Entra ID to ResolveAI automatically.

Microsoft Entra ID (formerly Azure AD) can provision users and sync groups to ResolveAI.

<Info>
  An Entra ID Administrator must complete this setup. A ResolveAI organization admin must generate the credentials.

  Set up [Azure AD SSO](/azure-ad) first. SCIM attaches to the same ResolveAI enterprise application.
</Info>

Before you start, read [Directory Sync (SCIM)](/directory-sync-scim) for the effects of each push.

## 1. Get your credentials from ResolveAI

In ResolveAI:

* Go to **Admin → Authentication**
* Find **Directory provisioning (SCIM)**
* Click **Generate SCIM credentials**

ResolveAI shows a base URL and a token. For Entra, use the **Entra variant** of the URL, which ResolveAI displays alongside the plain one:

```
https://api.app0.resolve.ai/scim/v2/i/<your-connection-id>?aadOptscim062020
```

<Warning>
  Use the `?aadOptscim062020` suffix. It makes Entra send standards-compliant update operations. ResolveAI accepts the URL with or without the suffix, but the suffix makes Entra's behavior predictable.

  ResolveAI shows the token only once. You cannot retrieve it later, so copy it before leaving the page.
</Warning>

## 2. Add provisioning in Entra

* Go to the [Azure Portal](https://portal.azure.com/)
* Open **Entra ID → Enterprise applications** and select your **ResolveAI** app
* Choose **Provisioning** in the left menu
* Click **Get started**, then set **Provisioning Mode** to **Automatic**

## 3. Enter the connection details

Under **Admin Credentials**:

* **Tenant URL**: the Entra variant URL from step 1, including `?aadOptscim062020`
* **Secret Token**: your SCIM token

Click **Test Connection**, then **Save**.

## 4. Map attributes and fix the email mapping

Open **Mappings → Provision Microsoft Entra ID Users**.

<Warning>
  Entra maps `userPrincipalName` to `userName` by default. A UPN may look like an email address but often is not one. ResolveAI requires `userName` to contain the person's real email address.

  Change the `userName` mapping to use **`mail`** instead of `userPrincipalName`.
</Warning>

Confirm the mapping includes:

| ResolveAI attribute | Entra source          |
| ------------------- | --------------------- |
| `userName`          | `mail`                |
| `name.givenName`    | `givenName`           |
| `name.familyName`   | `surname`             |
| `active`            | account enabled state |

Only `userName` is required.

ResolveAI refuses users whose `mail` value is empty. It does not invent an address. Populate `mail`, or exclude those users from the provisioning scope.

## 5. Set scope and turn provisioning on

* Under **Settings**, choose the scope: either everyone assigned to the application, or all users and groups
* Assign the users and groups who should have ResolveAI access
* Set **Provisioning Status** to **On**
* Click **Save**

Entra runs an initial cycle and then follows its own sync schedule. Confirm that people appear under **Admin → Authentication** in ResolveAI.

<Warning>
  Wait for the user cycle to finish before relying on groups. If a group names people ResolveAI does not have yet, ResolveAI stores the group push but refuses to reconcile the linked team. The team stays unchanged; it is not emptied.
</Warning>

## 6. Put the groups to work

Entra pushes groups in scope automatically. A pushed group does not affect a team until you link it in ResolveAI. See [Linking groups to teams](/scim-team-groups).

After you verify the directory, you can restrict sign-in to it. [Sign-in enforcement](/scim-sign-in-enforcement) previews who will gain or lose access.

## Troubleshooting

**Test Connection fails.** Check that the Tenant URL uses the Entra variant with `?aadOptscim062020` and the `api.` host shown by ResolveAI.

**People are provisioned with the wrong address, or refused.** This usually means `userName` is still mapped from `userPrincipalName`. Change the mapping to `mail`. See step 4.

**"Email domain is not configured for this SCIM connection".** ResolveAI accepts only the email domains configured on your connection. Matching is exact and does not include subdomains. A connection configured for `example.com` refuses `someone@eng.example.com`. Map Entra to send an address on a configured domain, or ask your Resolve contact to add it.

**A large group change looks half applied.** Entra sends one request per member, so a fifty-person change arrives as fifty requests. ResolveAI waits a few seconds after the last request before updating the linked team. Refresh after a few seconds.

**Disabling an account.** Setting a user inactive in Entra freezes the ResolveAI account and ends its sessions immediately. ResolveAI retains the record; it does not delete it.