Microsoft Entra SCIM

Tenvyr's SCIM 2.0 connector lets Entra manage user lifecycle, group membership, and the immutable IDs used for safe first-sign-in provisioning. Tenvyr remains the source of truth for tenant roles and SSH authorization.

You need:

• a Tenvyr owner or administrator;
• an Entra administrator who can configure enterprise application provisioning; and
• one test user and one test group that are not business-critical.

1. Create the Tenvyr connector

In Tenvyr:

1. Open Integrations → SCIM.
2. Select Create connector and give it an operational name such as Entra production.
3. Copy the connector ID.
4. Select Rotate credential to issue a bearer token.
5. Store the token immediately in your approved secret store. It is shown once.

Build the Entra tenant URL from the connector ID:

https://scim.tenvyr.com/scim/v2/CONNECTOR_ID

Do not add /Users or /Groups. Entra appends resource paths itself.

2. Configure Entra provisioning

In the Microsoft Entra admin center:

1. Open Identity → Applications → Enterprise applications.
2. Select the enterprise application used for Tenvyr.
3. Open Provisioning and choose Automatic.
4. Under Admin Credentials, enter:
   • Tenant URL: the Tenvyr SCIM URL above;
   • Secret Token: the one-time Tenvyr bearer token.
5. Select Test Connection and save.

Microsoft's current automatic provisioning guide uses the same Tenant URL, Secret Token, mappings, scope, and start-provisioning workflow.

3. Review attribute mappings

Use stable identifiers. Do not use email addresses as external IDs.

Users

Groups

Keep Entra's SCIM id value as the Tenvyr-generated resource ID. The customer-controlled Entra object ID belongs in externalId.

Tenvyr supports SCIM discovery, filtered lookup, pagination, users, groups, PUT, PATCH, membership changes, and deactivation. Custom extensions should be removed from the mappings unless they have been separately qualified.

4. Limit the provisioning scope

Under Settings:

1. Set Scope to Sync only assigned users and groups.
2. Keep Provisioning Status off while you finish the pilot mapping.
3. Assign one test group and one direct test user to the enterprise application.
4. Use Provision on demand for the test user.
5. Confirm that the user and group appear under Integrations → SCIM in Tenvyr.

Starting small makes an attribute or scope error reversible. Entra is the source of detailed provisioning delivery logs; Tenvyr shows connector authentication state and provisioned totals.

5. Map Tenvyr roles

Provisioning an identity does not grant SSH access by itself.

1. In Tenvyr, open Integrations → SCIM → Identities.
2. Assign a tenant role to the pilot group or user.
3. Prefer group mappings for normal operations.
4. Reserve direct user mappings for exceptions and record an owner and expiration.
5. Configure access policies for the resources the role may request.

Role precedence and access rules are evaluated by Tenvyr, not Entra.

6. Start provisioning

In Entra, set Provisioning Status to On and save. Monitor:

• the initial provisioning cycle;
• user and group create/update events;
• the Tenvyr SCIM identity totals; and
• a pilot user's sign-in and access-request path.

Entra provisioning is asynchronous. Do not treat the save action as proof that all assignments have arrived.

7. Connect OIDC first sign-in

If you also use Microsoft Entra OIDC:

1. confirm the SCIM user's externalId is the Entra object ID;
2. confirm the user or group has a Tenvyr role mapping;
3. enable Provision mapped SCIM users on first sign-in on the Entra OIDC provider; and
4. test with a new pilot identity.

Tenvyr requires an exact immutable identity match. If an existing invited account has the same email, the sign-in fails closed instead of linking it. Use the explicit identity-linking workflow.

Deprovisioning behavior

When Entra sends active: false or deletes a SCIM user, Tenvyr contains the linked actor and removes their ability to obtain access. Re-enabling the Entra user does not silently restore a previously contained Tenvyr actor; an administrator must review and restore access deliberately.

Test this lifecycle before broad rollout:

1. grant the pilot user access;
2. deactivate or unassign the user in Entra;
3. wait for provisioning and confirm Tenvyr containment;
4. confirm new access and SSH authentication fail; and
5. re-enable the Entra user and verify that Tenvyr still requires explicit review.

Rotate the SCIM token

Tenvyr invalidates the previous token immediately—there is no overlap window.

1. Choose a maintenance window or pause Entra provisioning.
2. In Tenvyr, select Rotate credential and capture the new token.
3. Immediately replace Secret Token under Entra Admin Credentials.
4. Select Test Connection.
5. Resume provisioning and confirm a test update arrives.

If the token is exposed, rotate it first and investigate missed provisioning events afterward.

Troubleshooting