Skip to main content

Microsoft Entra ID Sync via SCIM

How to set up the Microsoft Entra ID / Active Directory integration to synchronize user information

1. Enable SCIM within the revel8 platform

  1. In the revel8 platform, open Settings → Employee Sync (under Integrations).

  2. On the Employee sync page, select the SCIM tab, then click Generate SCIM config.

    The revel8 Employee sync settings page with the SCIM tab selected and the Generate SCIM config button

  3. Copy the URL and Key. You'll paste them into Microsoft Entra ID in Step 3 as the Tenant URL and Secret Token.

    The generated SCIM URL and Key fields on the revel8 Employee sync page

2. Create an enterprise application

  1. Open the Microsoft Entra Admin Center

  2. Go to Enterprise apps → click New application

  3. Select Create your own application → type in a suitable name e.g. revel8 → click create

3. Configure Application

  1. Go to the provisioning tab within the revel8 application

  2. Setup the provisioning with the following parameters:

    • Provisioning Mode: Automatic

    • Authentication Method: Bearer Authentication

    • Tenant URL: (paste the SCIM URL from Step 1)

    • Secret Token: (paste the token from Step 1)

4. Configure Attribute Mappings

Following microsoft SCIM attributes are needed to fully integrate with the revel8 platform:

  1. Users: Review and adjust the attribute mapping - please refer to the mapping overview below (especially the custom - yellow marked - entries to validate)

  2. Groups: [DisplayName, members]

  3. Make sure to Test your Connection.

📝 Note
For a full overview of which revel8 fields are populated via SCIM, which SCIM attribute to use, and how each maps to a Microsoft Entra ID attribute, see the Attribute Mapping Reference at the bottom of this article.

5. Assign groups

  1. Simply assign the required users or groups to the revel8 application

  2. As an alternative, also all groups in scope can be synced by checking the designated button under the provisioning setup

  3. Click Start provisioning

Requirements and Limitations

  • The SCIM integration with revel8 is limited to data from Microsoft Entra ID. On-premise Active Directories are not supported

  • It only allows for the connection of a single Entra ID tenant. All user data must be managed within one Azure tenant, as connections to multiple tenants are not supported

  • Once a SCIM connection is established, administration of SCIM-synced users must be done through Entra ID. Updating or modifying these synced users via Excel or CSV import is no longer possible. However, distinct users not managed within the same Entra ID tenant can still be added via a CSV upload.

  • The system supports individual email addresses only. Group or shared email addresses are not supported

  • To provision Entra ID security groups, a "Premium P1" license or higher is required.

Final checklist

  • SCIM configuration generated in revel8 (URL and Key saved)

  • Enterprise application created in Microsoft Entra ID

  • Provisioning mode set to Automatic

  • SCIM Tenant URL and Secret Token added in Microsoft Entra ID

  • Attribute mappings configured or confirmed

  • Test Connection passed

  • Required groups assigned to the application

  • Provisioning started and users/groups visible in revel8

6. Attribute Mapping Reference

The table below lists all available user fields in revel8, the SCIM attribute used to populate each field, and the corresponding Microsoft Entra ID attribute. Use this as a reference when reviewing or adjusting your attribute mappings in Step 4.

⚠️ Standard vs. custom attributes
Most fields below are pre-mapped by default when you create a new enterprise application in Entra. Fields marked Custom are not pre-mapped: you add the mapping manually in Entra, and the revel8 team may need to enable them for your organisation. In any case, review that the value is actually stored in the expected Entra ID attribute, otherwise adjust the mapping.

revel8 Field

SCIM Attribute

Microsoft Entra ID Attribute

Comment

First Name

name.givenName

givenName

Pre-mapped by default

Last Name

name.familyName

surname

Pre-mapped by default

E-Mail

emails[type eq "work"].value

mail

Pre-mapped by default

Job Title

title

jobTitle

Pre-mapped by default

Department

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department

department

Pre-mapped by default

Language

preferredLanguage

preferredLanguage

Pre-mapped by default

Country

addresses[type eq "work"].country

country

Pre-mapped by default.
​Used to derive time zone for local business hours scheduling

Main Phone Number

phoneNumbers[type eq "work"].value

telephoneNumber

Pre-mapped by default

Mobile Phone Number

phoneNumbers[type eq "mobile"].value

mobile

Pre-mapped by default

Management (Manager)

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager

manager

Pre-mapped by default.
​The referenced manager must also be provisioned in revel8, otherwise the field will not resolve.

Status

active

Switch([IsSoftDeleted],,"False","True","True","False")

Pre-mapped by default. Automatically derived from the Entra soft-delete state.

Microsoft ID

externalId

objectId

Custom. Needed for MSTeams Attacks.

Company

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:costCenter

extensionAttribute or custom directory attribute

Custom. Must be manually added as a new mapping in Entra. Map to whichever Entra attribute holds this value in your directory (e.g. extensionAttribute). Contact revel8 to enable

Company Code

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:division

extensionAttribute or custom directory attribute

Custom. Must be manually added as a new mapping in Entra. Contact revel8 to enable

User Type

userType

employeeType or custom directory attribute

Custom. Must be manually added as a new mapping in Entra. Contact revel8 to enable

Salutation

N/A

N/A

Automatically generated by revel8. No mapping available.

Time Zone

N/A

N/A

Automatically derived from the Country field ensure Country is populated. No mapping available.

Notes

  • Ensure preferredLanguage and country are populated for all users in Entra, these directly affect which language simulations are sent in and when they are scheduled

  • The manager field only resolves if the referenced manager is also in scope of the SCIM sync and provisioned in revel8

  • Exclude test accounts, service accounts, and shared mailboxes from your SCIM scope to keep your employee data clean

  • For large or complex organisations, consider enabling 2-3 custom attributes (e.g. Company, Company Code, User Type)

Related Articles
Did this answer your question?