Automatic User Provisioning (SCIM)¶
Tip
Active Steward can create, update and deactivate user accounts automatically from your organisation's identity provider (for example Microsoft Entra ID), using the industry-standard SCIM 2.0 protocol. When someone joins, changes or leaves in Entra, their Active Steward account follows, without an administrator having to create or disable it by hand.
Warning
Setting up provisioning requires an Administrator account with permission to manage configuration and integrations, and an administrator of your Entra tenant. See Set up Automatic User Provisioning for the step-by-step guide.
What provisioning does, and what it does not do¶
Provisioning keeps the account lifecycle in step with Entra: joiners are created, leavers are deactivated, and reactivations are restored. Entra owns whether an account exists and whether it is active.
Active Steward continues to own what a user can do. A user's role (and therefore their permissions and the partitions they can reach) is set when the account is first created and is managed by Administrators in Active Steward from then on. Moving a user between groups in Entra after their first sign-in does not change their Active Steward role.
In short: provisioning manages joiners and leavers; Administrators manage roles.
The account lifecycle¶
| In Entra | In Active Steward |
|---|---|
| A user is assigned to the application | The account is created with the default role (see below), the configured partitions, and no password (single sign-on only). |
| A user's name or email changes | The account details are updated. |
| A user is unassigned or disabled | The account is deactivated (disabled). Any active session is signed out on the user's next action. |
| A user is re-enabled | The account is reactivated. |
| A user is deleted in Entra | The account is disabled and hidden from the user list. It is never permanently removed, so audit history is preserved. |
Tip
Entra synchronises on a cycle of roughly 40 minutes. To test a single change immediately, use Entra's "Provision on demand" feature rather than waiting for the next cycle.
How a provisioned user gets their role¶
Because Entra does not send group or role information when it creates a user, the role is decided by Active Steward. There are two modes, chosen by the "SCIM default role" instance configuration:
-
A fixed role for everyone (recommended for most organisations). Set "SCIM default role" to the name of an existing role. Every newly provisioned user is created with that role. Administrators can adjust an individual user's role afterwards.
-
A role decided by the user's Entra groups. Leave "SCIM default role" blank. New users are created with the built-in "SCIM Default (No Access)" placeholder role, which grants nothing. The first time the user signs in with single sign-on, Active Steward reads the Entra groups from their sign-in and assigns the matching role (configured against each role's "SSO Groups" field). This assignment is written once and then owned by Administrators: it only happens while the user still holds the placeholder role, and an administrator-assigned role is never overwritten.
Tip
If a user belongs to more than one Entra group that maps to a role, Active Steward assigns the role with the most permissions. Administrators can change it afterwards if a different role is needed.
Signing in¶
Provisioned accounts sign in with single sign-on only. Because your identity provider is the source of truth for these accounts, username-and-password sign-in and password resets are not available for them, and the password options are hidden on their user page. Accounts created directly in Active Steward are unaffected and continue to use whichever sign-in method they were given.
Security of the connection¶
Entra authenticates to Active Steward with a dedicated API key scoped to provisioning only. This key works exclusively against the provisioning endpoints and grants no access to the rest of the Active Steward API. Every change Entra makes is recorded against the Administrator who created the key, so provisioning activity is fully audited.
Migrating an existing instance¶
Warning
Read this before turning on provisioning for an instance whose users already sign in with single sign-on.
Earlier versions granted a user extra permissions at each sign-in based on their Entra groups, on top of their stored role. That behaviour has been removed: a user's permissions now come only from the role stored against their account. When you upgrade, plan for the following.
-
Users who relied on group-based permissions. Any user who was getting extra access from an Entra group at sign-in (rather than from a role assigned in Active Steward) will now have only their stored role. Review these users and assign each the role they should have.
-
New instances, or users still on the placeholder role. If "SCIM default role" is left blank, users still on the "SCIM Default (No Access)" role are assigned their group-mapped role automatically at their next single sign-on, so no manual step is needed for them.
-
Setting a fixed default role after the fact. Changing "SCIM default role" only affects users created after the change. It does not re-assign existing accounts.
-
Bulk role assignment. If a large group of existing users needs a specific role, ask Active Steward support to prepare a one-off update; this is handled per instance at deployment time.
Tip
Still have questions about migrating your instance? Contact us at support@activesteward.com and we will help you plan the rollout.
To set provisioning up, follow the Set up Automatic User Provisioning tutorial.