Skip to main content

Setting Up SCIM User Provisioning with Microsoft Entra ID

This guide explains how to configure SCIM-based user provisioning between Microsoft Entra ID and AdvaPACS.

SCIM provisioning allows Entra ID to automatically create, update, and deactivate users in AdvaPACS based on changes in your directory.

warning

AdvaPACS currently supports user provisioning only.
Group provisioning must be disabled in Entra ID or provisioning will fail.

Prerequisites​

Before you begin, ensure you have:

  • Administrator access to Microsoft Entra ID
  • The Manage Authentication permission in AdvaPACS
  • An existing Entra ID Enterprise Application for AdvaPACS

Overview​

The configuration process consists of the following steps:

  1. Create a SCIM configuration in AdvaPACS
  2. Copy the SCIM credentials from AdvaPACS
  3. Configure automatic provisioning in Entra ID
  4. Disable group provisioning
  5. Test user provisioning

Step 1: Create a SCIM Configuration in AdvaPACS​

  1. Sign in to AdvaPACS as an administrator
  2. Navigate to: Admin → Settings → Authentication
  3. Select the SCIM tab

Permissions Required​

You must have the Manage Authentication permission to view or modify SCIM configurations.

If you do not see the SCIM tab, verify your role permissions.

Add a SCIM Configuration​

  1. Click Add SCIM Configuration
  2. Enter a Name to describe the configuration
  • Example: Entra ID
  1. Configure the default user settings

These settings will be applied to all users provisioned via SCIM.
They can be modified later on a per-user basis if required.

Save and Generate SCIM Credentials​

  1. Click Save
  2. AdvaPACS will generate:
  • SCIM URL
  • Secret Token

Make note of both values — they will be required when configuring Entra ID.

Step 2: Configure Provisioning in Entra ID​

  1. Sign in to the Microsoft Entra admin center
  2. Navigate to Enterprise applications
  3. Open your AdvaPACS application
  4. Select Provisioning

Set Provisioning Mode​

  1. Click Get started
  2. Set Provisioning Mode to Automatic

Configure Admin Credentials​

In the Admin Credentials section, enter:

Entra ID FieldValue
Tenant URLPaste the SCIM URL from AdvaPACS
Secret TokenPaste the Secret Token from AdvaPACS

Click Test Connection.

If the connection is successful, click Save.

Step 3: Disable Group Provisioning (Required)​

AdvaPACS does not currently support group provisioning.

You must disable group provisioning in Entra ID to prevent errors.

Disable Group Mappings​

  1. In the Provisioning section, select Mappings
  2. Open Provision Microsoft Entra ID Groups
  3. Set Enabled to No
  4. Save the mapping
danger

If group provisioning is enabled, Entra ID will return errors and user provisioning will stop.

Step 4: Configure User Mappings (Optional)​

By default, Entra ID provisions users using standard SCIM attributes such as:

  • userName
  • givenName
  • surname
  • emails

You may adjust attribute mappings if required, but the default mappings are sufficient for most deployments.

If also using SAML and you do change mappings, ensure they align with the username the SAML configuration is expecting.

Step 5: Assign Users and Start Provisioning​

  1. In Entra ID, navigate to: Enterprise applications → AdvaPACS → Users and groups
  2. Assign users who should be provisioned into AdvaPACS

Provisioning will run automatically on the Entra ID provisioning cycle.

Step 6: Verify Provisioning in AdvaPACS​

  1. Return to AdvaPACS
  2. Navigate to the Users section
  3. Confirm users are being created or updated via SCIM

Provisioned users will inherit the default SCIM configuration settings unless overridden.

Troubleshooting​

If provisioning fails:

  • Confirm the SCIM URL and Secret Token are correct
  • Ensure group provisioning is disabled
  • Check Provisioning logs in Entra ID
  • Verify assigned users have required attributes (email, username)