SCIM Provisioning with Microsoft Entra ID (Azure)
This guide describes how to configure SCIM provisioning between Microsoft Entra ID (formerly Azure AD) and Descope, enabling Azure to automatically create, update, deactivate, and manage groups for users in your Descope tenant.
Prerequisites
Note
Azure only pushes users to Descope if they are assigned to the Enterprise Application — either directly or as a member of a group that is assigned to the app. With JIT disabled, a user who is not assigned in Azure cannot log in to your application — Azure rejects authentication for unassigned users. (In multi-app setups where SSO and SCIM use different Azure applications, authentication can succeed via the SSO app but Descope reports the user as unknown because no SCIM record exists.)
For ongoing onboarding, the recommended pattern is to assign a group (for example, an "All Employees" group or a department group) to the Enterprise Application rather than assigning users one by one. New employees added to the group are then provisioned automatically by Azure's next provisioning cycle. See SCIM Best Practices for the full pattern.
Before starting:
- SSO must already be configured and working for the Descope tenant.
- A tenant must exist in Descope with an associated Access Key that has the
Tenant Adminrole. - The Azure Enterprise Application must have assigned users and/or groups.
Warning
Entra runs SCIM on a ~40 minute cycle (not configurable). Creates and updates often land later than expected. Disabled users usually are not pushed to Descope until that cycle includes them — or until you run Provision on Demand / a provisioning job manually. See Microsoft's docs and SCIM Best Practices.
Step 1: Enable SCIM Provisioning in Azure
- In the Azure portal, go to your Enterprise Application connected to Descope.
- Navigate to Provisioning in the left sidebar.
- Click Get Started to begin SCIM setup.
Step 2: Configure the SCIM Endpoint and Authentication
- Set the Provisioning Mode to
Automatic. - Fill in the following values:
| Field | Value |
|---|---|
| Tenant URL | https://api.descope.com/scim/v2 |
| Secret Token | ProjectID:AccessKey (must be scoped to the tenant with the Tenant Admin role) |
The Tenant URL can be found in the SCIM Provisioning section under your tenant's SSO configuration in the Descope Console.
- Click Test Connection to verify.
- Click Save.
Step 3: Configure Attribute Mappings
Once saved, navigate to the Mappings section.
User Mappings
Azure should map standard user fields such as givenName, surname, email, and userPrincipalName to the SCIM schema.
Group Mappings
Azure can also manage SCIM group creation, updates, and deletions. Groups pushed from Azure will appear in Descope and can be mapped to roles.
Step 4: Start or Test Provisioning
You can test provisioning by:
- Selecting Provision on Demand for individual users.
- Starting full provisioning from the main Provisioning panel.
Once provisioning is active, Entra pushes users and groups to Descope on its schedule (~40 minutes), not on the user's next SSO login. Use Provision on Demand when you need an immediate create, update, or disable to land in Descope.