SCIM (System for Cross-domain Identity Management) lets you automatically provision and deprovision users in Formalize platform directly from Microsoft Entra ID. Instead of manually managing users in the platform, any changes you make in Entra ID are synced automatically.
Once set up, users assigned to the application in Entra ID will be provisioned in Formalize automatically. If a user is removed from the assigned group they will be disabled, and if they are permanently deleted in Entra ID they will be removed from Formalize entirely.
Before you start
In Microsoft Entra ID, you must have one of the following roles to configure SCIM provisioning:
Global Administrator
Cloud Application Administrator
Application Administrator
Owner of the service principal
In Formalize, you must have either the Administrator or System Technician role to access Settings > Security > SCIM Provisioning.
Steps
Step 1 - Enable SCIM provisioning in the platform
Go to Company → Settings → Security → SCIM Provisioning
Click Generate SCIM Configuration.
Copy the URL shown under the URL field. This is the base URL for all SCIM API requests and will be used as the Tenant URL in Microsoft Entra ID.
Copy the Authorization Header value. This is your Bearer token and will be used as the Secret Token in Microsoft Entra ID.
If you ever need to reset your SCIM credentials, click Regenerate SCIM settings. This will generate a new URL and Authorization Header. Any existing SCIM connection will need to be updated with the new values.
Step 2: Create a new application in Microsoft Entra ID
Go to Microsoft Entra ID and navigate to Enterprise Applications.
Click New Application, then select Create your own application.
Enter a name for the application, for example "Formalize Software".
Select Integrate any other application you don't find in the gallery.
Click Create.
Step 3: Configure provisioning
Open the new application and go to Provisioning.
Click Get started and set the Provisioning Mode to Automatic.
Under Admin Credentials, enter the following from Step 1:
Tenant URL: Paste the Tenant URL generated in Formalize Software.
Secret Token: Paste the Secret Token generated in Formalize Software.
Click Test Connection to verify the credentials are working correctly. You should see a confirmation that the connection was successful.
Click Save.
Go to Provisioning > Settings and set the Scope to Sync only assigned users and groups. This ensures only the users you explicitly assign are provisioned, rather than your entire directory.
If provisioning users in a group, disable the provisioning of “groups” (users in groups will still be provisioned)
Step 4: Assign users or groups
In the application, go to Users and Groups.
Click Add user/group and select the users or groups you want to provision to Formalize Software.
Click Assign.
Step 5: Start provisioning
Go to Provisioning and click Start Provisioning.
The initial sync may take a few minutes depending on the number of users being provisioned.
Once complete, you can check the provisioning logs to confirm the sync was successful.
Verifying the sync
Once provisioning is complete, you can verify the sync was successful in two places:
In Microsoft Entra ID: The provisioning logs will show each user that was successfully synced along with their status.
In Formalize: Go to Users. The users assigned in Entra ID should now appear in the list. Any future changes made in Entra ID, such as adding or removing users, will be reflected in Formalize automatically.
Configuring user permissions after provisioning
When users are provisioned through SCIM, they are assigned base user permissions by default. Permissions cannot be configured during the provisioning process itself, so after the sync is complete you will need to go into the Users page and manually update permissions for any user who needs a different role, such as Administrator.
How deprovisioning works
Formalize supports deprovisioning through SCIM. The behavior depends on what action is taken in Microsoft Entra ID:
If a user is removed from the assigned group: The user will be disabled in Formalize.
If a user is permanently deleted in Entra ID: The user will be fully removed from Formalize.
Note: Microsoft Entra ID syncs changes on a scheduled incremental cycle. Changes made in Entra ID will not be reflected in Formalize immediately. If you need to remove a user's access urgently, manually remove them from the Users page.
Troubleshooting
Test Connection fails: Double-check that the Tenant URL and Secret Token were copied correctly from Formalize with no extra spaces. If the token has expired, generate a new SCIM configuration and try again.
Users are not appearing after sync: Make sure the users or groups have been assigned to the application in Entra ID and that provisioning has been started. Check the provisioning logs in Entra ID for any errors.
We’re here to support you. If you have questions reach out to us directly via the Messenger icon in the bottom right corner of your screen, or send us an email at [email protected]