Provision users from Microsoft Entra ID via SCIM

Microsoft Entra ID (formerly Azure Active Directory) provisions Measured Cloud users via the same SCIM 2.0 surface as Okta and Google Workspace. The configuration is slightly different — Entra uses aadOptscim062020 mode and emits patches with the path=name.givenName form, not the bare-value form Okta prefers — but Measured Cloud's SCIM handler supports both.

Goal

Configure Entra ID's enterprise-application provisioning so:

• Adding a user (or group member) to the Measured Cloud enterprise app in Entra triggers POST /scim/v2/Users in Measured Cloud.
• Removing a user from the app sends PATCH active=false, deprovisioning the org membership.
• Group assignments mirror as Measured Cloud workspace memberships.

Prereqs

• The super admin or technical admin role in Measured Cloud (to mint the SCIM token).
• Entra ID P1 or higher (the free tier doesn't include outbound provisioning).
• Measured Cloud reachable from Entra over HTTPS.

1. Mint a SCIM bearer in Measured Cloud

Same as for Okta — see Provision users from Okta via SCIM. Use a distinct name (e.g. entra-prod) so a future revoke takes down one IdP without disrupting the other.

2. Create the enterprise application in Entra

1. Entra admin centre → Enterprise applications → New application → Create your own application.
2. Name: "Measured Cloud", and pick Integrate any other application you don't find in the gallery (Non-gallery).
3. After creation, open the app and choose Provisioning from the left nav.

3. Configure the provisioning connection

1. Provisioning mode: Automatic.
2. Admin credentials:
   • Tenant URL: https://dq.example.com/scim/v2
   • Secret token: the dqs_... from step 1.
3. Click Test Connection. Entra hits GET /Users?filter=userName eq "testuser@example.com" and GET /ResourceTypes; both should return 200.
4. Save.

Note: Entra ID requires the ?aadOptscim062020 query string on every endpoint to enable the compatibility mode it expects. Measured Cloud accepts that query string as a no-op so this works out of the box; you do not need to configure anything extra.

4. Set up the attribute mappings

Entra's default User attribute mappings work without modification, but verify them:

Entra attribute	SCIM target	Measured Cloud column
userPrincipalName	userName	users.email
mail	emails[type=work].value	users.email
givenName	name.givenName	first token of users.full_name
surname	name.familyName	remainder of users.full_name
Switch([IsSoftDeleted], ...)	active	presence of org_memberships row

Optional but recommended: delete the mappings for phoneNumbers, addresses, and roles. Measured Cloud ignores them; sending them just bloats the audit trail.

5. Enable provisioning

1. Set Provisioning Status to On.
2. Under Settings, pick Scope = Sync only assigned users and groups for the first run — this keeps the blast radius small until you've validated the mapping.

6. Assign users and groups

1. Open the Users and groups tab in the same app.
2. Add user/group → pick the users or security groups to provision.
3. Trigger an immediate sync via Provisioning → Provision on demand → Provision and paste a test user's UPN. The right-hand pane shows the SCIM call Entra emitted and the response from Measured Cloud — useful for diagnosing mapping issues without waiting 40 minutes for the scheduled sync.

For groups, enable Push Groups (the toggle is on the Provisioning page). Each pushed group lands as a Measured Cloud workspace; renaming the group in Entra triggers a PATCH /Groups/{id} displayName=... and Measured Cloud updates the workspace name and slug.

7. Deprovisioning

When a user is disabled in Entra (or removed from the app), Entra sends:

PATCH /scim/v2/Users/{id}
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{"op": "Replace", "path": "active", "value": "False"}]
}

Measured Cloud accepts the string "False" as a falsy value (Entra ID quirk) and deletes the org_memberships row + any workspace memberships in this org. The global users row stays put so the same person can still log in to other tenants.

Admin accounts are off-limits to SCIM

SCIM provisions every user at the editor role and never grants a super admin, technical admin, workspace admin or team admin role. It also can't change the email of, deactivate, or delete a super admin or technical admin, and it can't change the email of someone who also belongs to another organization. Those requests return 403, and the change is logged. A resync that leaves the email unchanged is still accepted. Manage admin accounts in Measured Cloud itself.

Trouble­shooting

Symptom	Likely cause
Entra "Test Connection" returns 401	dqs_ bearer was copy-pasted with whitespace or has been revoked.
Provisioning attempt logs 400 invalidValue	Entra sent a payload without userName. Check the userName mapping is set to userPrincipalName.
409 uniqueness on every assignment	The user is already in the org. This is expected on re-syncs; Entra logs it and continues.
Provisioning fails with 415 unsupportedMediaType	A reverse proxy in front of Measured Cloud is rewriting the Content-Type. Make sure application/scim+json is allowed through.

Revoking the connector

1. In Entra ID, Provisioning Status → Off, then Save.
2. In Measured Cloud, Settings → SCIM provisioning → Revoke the entra-prod token. The Redis-backed auth cache picks up the revoke within ~5 s.

Related

• Provision users from Okta via SCIM — the equivalent for Okta.
• Configure single sign-on — pair SCIM provisioning with SAML/OIDC sign-in.
• FEATURE-90 — the tracking ticket.