> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.spreadly.app/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# User Provisioning with Entra-ID

Creating a [SCIM Provisioning application](https://spreadly.app/en/blog/provisioning-with-scim-20) in Microsoft Entra-ID is a straightforward process that significantly enhances the management of user identities in cloud-based applications. In this article, we'll guide you through the steps to set up a SCIM Provisioning application for Spreadly.

# Step 1: Create an Enterprise Application
![Create an Entra-ID Enterprise Application for Spreadly](https://spreadly.app/storage/proxy/02c946e86cee4739ad18e9fce59c9eec/other/custom_files/65aadfb4099cc/S2e6corJtKGIbPvkTjWaUKvtJnY7h4lqKQGy1VRq.png)

First, navigate to the *Applications* section in Entra-ID, and select *Enterprise applications*. Here, click on *+ New application* and then choose *+ Create your own application*. Name your application "Spreadly" and select the "Non-gallery" option. This step initiates the process of integrating your custom application with Microsoft's identity management solution.

# Step 2: Obtain SCIM Secret Token from Spreadly
![Obtain SCIM Secret Token from Spreadly](https://spreadly.app/storage/proxy/f358e023ef2b9c8fa04ad8303f99fea8/other/custom_files/11/2Mw9OZ7q0qX7me5S28hfq62kgT0vmBU8IdbOx7k2.png)

Access the "*Team > Members > HR Integrations > SCIM synchronization*" section in Spreadly to find your SCIM Secret Token. This token is essential for secure communication between Spreadly and Microsoft Entra-ID. Copy this token as you'll need it in the next steps.

# Step 3: Set Up Provisioning
![Set Up Provisioning in Entra-ID](https://spreadly.app/storage/proxy/431fef5b1edfe6b0cf2d8dccb683f4e6/other/custom_files/65aae054f0877/OB2mOqmnvc4QHASoMlTpNSv0ZKRxydM1mSwtwfui.png)

Now, open the newly created enterprise application in Entra-ID and go to *Provisioning* > *Manage: Provisioning*. Set the Provision Mode to "Automatic". Input the Tenant URL as `https://spreadly.app/api/v1/scim` and enter the Secret Token you previously copied from Spreadly. To ensure the setup is correct, click on "Test connection", then save your settings.

# Step 4: Edit  Mappings
![Setup SCIM Mapping attributes in Entra-ID](https://spreadly.app/storage/proxy/80d9312e4ab3df180e48d5bff94100aa/other/custom_files/65aae0f1afd74/HhQS5ZXNY2qyURba5ukcIudHVirLS77RSoM69asi.png)

In this step, you'll configure how attributes of Users and Groups in Microsoft Entra-ID correspond to those in Spreadly.

## User Mappings

|| The attributes `objectId` and `userPrincipalName` must be set up with the correct matching precedence.

| Azure Active Directory Attribute | customappsso Attribute | Matching precedence |
| ---- |
| objectId | externalId | 1 |
| userPrincipalName | userName | 2 |
| givenName | name.givenName |  |
| surname | name.familyName |  |
| telephoneNumber | phoneNumbers[type eq "work"].value |  |
| mobile | phoneNumbers[type eq "mobile"].value |  |
| jobTitle | title |  |
| department | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department |  |
| employeeOrgData.division | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:division |  |
| companyName | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization |  |
| streetAddress | addresses[type eq "work"][streetAddress] |  |
| city | addresses[type eq "work"][city] |  |
| postalCode | addresses[type eq "work"][postalCode] |  |
| state | addresses[type eq "work"][region] |  |
| country | addresses[type eq "work"][country] |  |
See https://help.spreadly.app/en/article/user-provisioning-with-scim-20-10h4w3d/#2-user-attributes for the full list of supported SCIM attributes for users.

## Group Mappings

| Azure Active Directory Attribute | customappsso Attribute | Matching precedence |
| ---- |
| objectId | externalId | 1 |
| displayName | displayName |  |
| description | spreadly:scim:Group:description |  |
| members | members |  |
See https://help.spreadly.app/en/article/user-provisioning-with-scim-20-10h4w3d/#2-group-attributes for the full list of supported SCIM attributes for groups.

# Step 5: Test the Mapping
![Test Mapping by provisioning a single user on demand](https://spreadly.app/storage/proxy/6194a4e0607ab5b06a480a6ed10f1b77/other/custom_files/65aae13346e43/SDssW769UWAQmLHTOWcYSuhSJRSo6zLRKybK0Y3f.png)

To verify that your mappings are correct, use the "Provision on demand" feature. Select a user or group to test the mapping. This step is crucial to ensure that the data flows correctly between Microsoft Entra-ID and Spreadly.

# Step 6: Select Users/Groups for Provisioning
Finally, manage who will be provisioned by visiting "Manage: Users and groups" in your enterprise application. Here, select the users and groups you expect to be provisioned. This step determines which identities from Microsoft Entra-ID will be managed in Spreadly.

# Step 7: Configure Single Sign-On (optional)
![Configure Single Sign-On](https://spreadly.app/storage/proxy/e90bef54bbef41c855690b13d304805e/other/custom_files/65aae18b339cd/YwulcpLy0D3zXouK9kwP2w2CAWJTlDpkYAPEQJS3.png)

Finally, set up the Single Sign-On (SSO) feature for a seamless user experience. Under "Manage: Single sign-on," copy the Sign on URL from Spreadly's "Team > Settings." Additionally, upload the Spreadly application logo ( [download here](https://spreadly.app/img/logo/logo.png)). For a cleaner user interface, make the default Spreadly App (Application ID: `f6f257df-7ac4-4e92-886c-4768649ca097`) invisible to users.