Let Microsoft Entra ID create TekStacks accounts for your team, keep their names and emails current, and turn them off when they leave, using SCIM provisioning.

Overview

With provisioning on, Entra manages TekStacks users (people who sign in):

• someone you assign in Entra gets a TekStacks account, with roles from the groups you mapped;
• name and email changes in Entra reach TekStacks;
• someone disabled in Entra, or unassigned, is turned off in TekStacks and signed out at once. Nobody is deleted, and assigning them again turns the same account back on.

Employees (the people equipment is assigned to) come from the employee sync instead.

Requirements

• A TekStacks Admin.
• Entra ID P1 in your directory, which is included in Microsoft 365 Business Premium, E3 and E5. Group assignment, which is how roles reach TekStacks, needs P1.
• Sign in with Microsoft set up, so provisioned people can sign in.
• Your groups mapped to roles under Map groups to roles (Sign in with Microsoft, Step 3).

Note: Provisioning uses its own enterprise application in Entra, separate from the TekStacks application that signs people in. Assign the same people and groups to both.

Step 1: Make a provisioning token in TekStacks

1. In TekStacks, open Settings, then Microsoft sign in.
2. Under Provisioning (SCIM), click Make a provisioning token.
3. Copy the Tenant URL (https://yourcompany.tekstacks.com/scim/v2) and the token.

Note: The token is shown once. Making a new token replaces the old one immediately.

Step 2: Create the provisioning application in Entra

1. In the Microsoft Entra admin center, go to Entra ID, Enterprise applications, and click New application.
2. Click Create your own application and name it, for example TekStacks provisioning.
3. Select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

Step 3: Connect provisioning

1. In the new application, open Provisioning.
2. Click Connect your application (or Get started, and set Provisioning Mode to Automatic).
3. Set Select authentication method to Bearer authentication, and enter the Tenant URL and the token as the Secret token.
4. Click Test connection. It must pass before you continue.
5. Click Create (or Save).

Step 4: Check the mappings

1. Open Attribute mapping and select the Users mapping.
2. Make sure userName maps to userPrincipalName. TekStacks uses it as the person's email, the same name Microsoft sign in matches. The mailbox address under emails is ignored, so the two cannot disagree.
3. Leave the Groups mapping on; provisioned groups are how roles reach TekStacks.

Step 5: Assign people and groups

1. Open Users and groups and click Add user/group.
2. Assign the groups you mapped to roles in TekStacks, and any individual people.
3. Under Provisioning, Settings, keep Scope on Sync only assigned users and groups.

Step 6: Test, then turn it on

1. Click Provision on demand, choose one person in a mapped group, and click Provision. They appear under Users in TekStacks with the group's role.
2. Disable that person in Entra and provision on demand again. They are turned off in TekStacks.
3. Enable them again and provision on demand: the same account is back on.
4. Set Provisioning Status to On and click Save.

Entra's first full cycle can take up to 40 minutes; after that it runs about every 40 minutes.

How roles work

• A provisioned group whose Object ID is mapped under Map groups to roles gives its members that role.
• Groups add roles and never remove them; change roles under Users.
• Someone provisioned without any mapped group has no role until an Admin gives them one.
• Provisioning never turns off your company's last active Admin.
• When provisioning changes someone's email, their old address is told.

Turning provisioning off

Under Provisioning (SCIM) in TekStacks, click Turn off provisioning. The token stops working at once; every account stays as it is. Set Provisioning Status to Off in Entra too.

Troubleshooting

Test connection fails. Use the Tenant URL exactly as shown, ending in /scim/v2, and the newest token.

"... is already linked to ... Change their TekStacks email ..." Someone already linked that Microsoft account to a TekStacks account with a different email, such as an Admin who signed up with a personal address. They click Use ... as my email on their Security page (or an Admin changes the email under Users), then provision again.

"A user with that userName already exists." Someone already has an active TekStacks account with that email. Entra normally finds and links them by userName; if it does not, check that their TekStacks email matches their Entra userPrincipalName.

"The company has reached its plan's number of users." Your plan's user limit. Turn off unused users or change plans under Billing, then retry in Entra.

People are created with no role. The group they came through is not mapped in TekStacks, or they were assigned individually rather than through a group.

Someone who left can still sign in. Entra applies changes on its next cycle, about every 40 minutes. Use Provision on demand to apply one at once.

Where to look. The provisioning application's Provisioning logs in Entra show every request and TekStacks' answer.

FAQ

Do I need SCIM if I use Sign in with Microsoft? No. Without SCIM, people are invited or come in through mapped groups when they first sign in. SCIM adds turning people off automatically when they leave.

Does SCIM create employees? No. Employees come from the employee sync.