Over SCIM, Microsoft Entra ID creates users in portierX and keeps them in step with the directory: joiners appear, leavers are deactivated, name changes arrive. Setting it up needs the Organisation Admin role and starts from Integrations, on the Available tab, with the Entra ID SCIM card.
Also called: SCIM, provisioning, user provisioning, directory sync.
The SCIM add-on for your organisation. portier enables it. Without it, portierX answers "This organisation does not have the SCIM add-on enabled. Contact your portierX account team."
An active single sign-on connection to Microsoft Entra ID with a verified domain. Without one, portierX refuses to generate or rotate tokens.
The Organisation Admin role in portierX. Other roles see "Only an organisation admin can change this." on the connection.
Admin access to Microsoft Entra ID, to set up provisioning on an enterprise application.
Open Integrations and stay on Available.
Open the Entra ID SCIM card with See Details and switch to Connect. The form has no fields.
Click Activate. portierX generates the token, records the connection and opens its page under Connected.
In the dialog SCIM token generated, copy the Tenant URL and the Secret token, and only then close it with I have copied both values. The dialog appears once. After that the token is stored only as a hash.
In Entra, open the enterprise application and its Provisioning page.
Set Provisioning Mode to Automatic and enter, under Admin Credentials, the tenant URL as Tenant URL and the token as Secret Token. Test and save.
Under Users and groups, assign the people or groups portierX should receive, and start provisioning.
Entra provisions only what is assigned. An empty assignment provisions nobody and still reports success.
The Summary tab shows, in Connection summary, the Status, Connected while a token is still valid and otherwise Not connected, the Provider and, under Last called, the last call from Entra, Never until the first one. Beside it, People provisioned counts the active users created through this connection and Recent failures the calls that failed over the last seven days. View event log leads to them. When the active single sign-on connection with a verified domain is missing, a notice sits above the summary.
The Tokens tab lists, under SCIM tokens, every token with Name, Status, Created, Last used, Grace until and Actions. The status is Active, Grace window or Revoked.
Generate token always creates an additional token, with a name if you want one under Name (optional). Without a name it is called Microsoft Entra ID with the date it was created. The dialog SCIM token generated shows the values once.
Rotate replaces a token. portierX reveals the replacement once, the previous token changes to Grace window and keeps working until the time under Grace until. That is the time for repointing Entra. The previous token then expires on its own.
Revoke stops a token at once, after a confirmation. There is no grace window, and provisioning from Entra fails until another valid token is entered there.
The Event log tab lists every call from Entra with Time, Operation, Resource and Outcome. The outcome is Success, Rejected or Error. The operation reads as the SCIM server records it: create, update, patch, deactivate, reactivate, delete, list, get.
View opens the Event detail with Time, Who (the person's name and email address), Operation, Resource and Outcome, with the reason from Entra on a failure and the fields Before and After on a change. Load older events fetches the next page.
This is where to look when Entra reports everything as green and someone is still missing in portierX.
Entra calls the portierX SCIM server on its own schedule. Nothing in portierX triggers a transfer.
A person assigned in Entra is created as a user with the most limited role. Roles are set in portierX.
A person deactivated or removed in Entra is deactivated in portierX. Sign-in is blocked and open sessions end. The record stays.
Name and email changes arrive. A changed email address is accepted only when its domain is verified for your organisation.
SCIM brings users, not groups and not keys. Groups decide in Entra who is provisioned and are not created in portierX. Who may enter what is assigned in portierX.
A person who already exists in portierX under the same email address is matched only when the address's domain is verified for your organisation. Otherwise portierX rejects the call and the event log shows Rejected.
An organisation has one SCIM connection.
A token does not expire on its own. Revoke tokens you no longer need.
Without an active single sign-on connection with a verified domain, no token can be generated or rotated. Existing tokens keep working, and Revoke always works.
Only an Organisation Admin sees the connection's tabs.
