Set up Automatic User Provisioning¶
Tip
This tutorial configures Active Steward so that Microsoft Entra ID automatically creates, updates and deactivates user accounts using SCIM. For an overview of what provisioning does, read the Automatic User Provisioning guide first.
Warning
You will need an Active Steward Administrator account with permission to manage configuration and integrations (Edit User Roles), and administrator access to your Microsoft Entra tenant.
Warning
Complete the steps in order. In particular, set the default partitions (Step 1) before Entra provisions its first user, otherwise account creation will fail.
In Active Steward¶
1. 👆 Set the default partitions for provisioned users.¶
Navigate to the settings icon 👉 "Configuration" ("Whole instance"), find "SSO default partition
ids", and enter a comma-separated list of the partition ids new users should receive (for example
3 or 3,7,12). The first id in the list becomes the user's landing partition. 👆 Click "SAVE".
Warning
This field must contain at least one valid partition id before provisioning starts. If it is empty, every account Entra tries to create will fail and Entra will keep retrying.
2. 👆 Choose the role new users should receive.¶
On the same "Configuration" page, set "SCIM default role":
- To give every provisioned user the same role, enter the exact name of an existing role (for
example
Viewer). This is the simplest option for most organisations. - To let each user's role be decided by their Entra groups at first sign-in, leave the field blank and complete Step 3.
👆 Click "SAVE".
3. 👆 Map your Entra groups to roles (only if "SCIM default role" is blank).¶
For each role that should be assigned from an Entra group, navigate to the settings icon 👉 "Roles", 👆 open the role, and in the "SSO Groups" field ✍️ enter the Object ID of the Entra group. 👆 Click "SAVE".
Tip
The group value must be the Entra group's Object ID (a GUID such as
18ecc62c-a4bf-4f94-a03d-266250e9b6ea), found in Entra under Groups 👉 (your group) 👉
Overview. The group name will not match.
4. 👆 Create the provisioning API key.¶
Navigate to the settings icon 👉 "Integrations" 👉 "API Keys" 👉 "Add Key". ✍️ Enter a name (for
example Entra Provisioning), then under access rights tick only "Provision Users (SCIM)".
👆 Click "SAVE", then 👆 click "Copy" and store the key safely.
Warning
The key is shown once, immediately after saving. Copy it now; it cannot be retrieved later, only regenerated. Tick only "Provision Users (SCIM)" so the key can be used for provisioning and nothing else.
In Microsoft Entra¶
5. 👆 Point the Entra enterprise application at Active Steward.¶
In your Entra enterprise application, open the Provisioning blade and set Provisioning Mode to "Automatic". Enter the connection details:
| Field | Value |
|---|---|
| Tenant URL | https://{{your Active Steward address}}/ActiveSteward/scim/v2 |
| Secret Token | The key you copied in Step 4 |
👆 Click "Test Connection". A successful test confirms Active Steward is reachable and the key is valid.
6. 👆 Set the attribute mappings.¶
In the provisioning attribute mappings, set the user attributes exactly as below and remove any others:
| Entra attribute | Active Steward (SCIM) attribute |
|---|---|
userPrincipalName |
userName |
objectId |
externalId |
mail |
emails[type eq "work"].value |
givenName |
name.givenName |
surname |
name.familyName |
| (Entra's default "active" expression) | active |
Warning
Leave Entra's default expression for the active attribute exactly as provided. Do not map an
Entra group or role attribute into SCIM: roles are managed in Active Steward, not sent by Entra.
Tip
Active Steward provisions users only. If Entra reports an "unsupported" error for groups, disable the Entra Groups mapping (or scope the application to users rather than groups).
7. 👆 Scope and start provisioning.¶
Assign the application to a small pilot group of one to three users first, set scope to "Sync only assigned users and groups", and use "Provision on demand" to provision one pilot user immediately.
8. 🥳 Provisioning is live.¶
The pilot user now exists in Active Steward. 👆 Navigate to the settings icon 👉 "Users" 👉 "List All Users" to confirm the account was created before the user has ever signed in. Sign in as the pilot user to confirm they land in the right place with the expected access, then widen the application's scope to the rest of your users.
Tip
A "409 Conflict" the first time Entra provisions someone who already has an Active Steward account is expected and harmless: Entra recognises the existing account and links to it rather than creating a duplicate.
Warning
Once an account is managed by provisioning it signs in with single sign-on only; its username-and-password and password-reset options are removed. See the Automatic User Provisioning guide for the full behaviour, and the guide's "Migrating an existing instance" section if your users already used single sign-on before you turned provisioning on.
Tip
Need a hand with the Entra side, or planning a migration? Contact us at support@activesteward.com.