Niah Docs
SCIM recipe

Microsoft Entra ID

Configure automatic provisioning from a Microsoft Entra enterprise application.

Contract tested July 30, 2026. The covered Niah operations are exercised by the SCIM compatibility suite: discovery, initial and incremental user cycles, disable/reactivate, filtering, and group membership changes.

1. Create the connection

  1. In Entra admin center, open an enterprise application and select Provisioning.
  2. Choose automatic provisioning.
  3. Set Tenant URL to https://api.niah.si/scim/v2.
  4. Set Secret Token to a Niah organization API key with scim:read and scim:write.
  5. Run Test Connection and save.

2. Configure user mappings

Microsoft Entra attributeSCIM targetNotes
userPrincipalName or mailuserNameRequired matching property; use an email-form value
givenNamename.givenNameOptional
surnamename.familyNameOptional
mailemails[type eq "work"].valueUse the same address as userName
Switch([IsSoftDeleted], ...)activeKeep Entra's generated active-status expression

Enable Create and Update for users. Niah accepts PATCH operation names without regard to casing, including Entra's Replace form.

3. Scope and start provisioning

Assign users and groups to the enterprise application, choose “Sync only assigned users and groups” unless tenant-wide provisioning is intended, and start provisioning. Use Provision on demand for a first user before the full cycle.

Groups

Enable group Create, Update, and Delete mappings when assigned groups should become Niah teams. Map displayName to displayName and members to members.

Limitations: nested groups are not expanded; members must already be provisioned in the same organization; groups do not grant roles, administrator access, or API scopes; deleting a group does not deactivate its users.

Deprovisioning

Disabling or unassigning a user must produce active=false. Niah deactivates organization membership and retains identity data for reactivation. User DELETE is unsupported; a later hard-delete attempt may be reported as a non-fatal provisioning error by Entra.