User and group provisioning (SCIM)

Scalepoint is a SCIM 2.0 service provider. Your identity system can create, update, and deactivate users in Scalepoint automatically, and manage their group memberships, instead of an administrator maintaining them by hand.

There are two ways to connect:

• Microsoft Entra ID provisioning — Entra's built-in provisioning service calls Scalepoint on a schedule. This is the recommended option if you use Entra ID.
• Any other SCIM 2.0 client — your own integration, or another identity platform, calls the same endpoints directly.

Both use the same endpoints, the same credentials, and the same attribute mapping. Only the configuration on your side differs.

Provisioning is configured independently of single sign-on: federation controls who can sign in, provisioning controls who exists, and you can use either without the other. User names must use one of your organization's registered domains — your default Scalepoint domain always works, and Entra ID federation adds your own domains to the list.

Before you start

Contact Scalepoint to have provisioning enabled for your organization. You will receive:

• the SCIM base URL for your organization
• a client ID and a client secret

Scalepoint issues these credentials — there is no self-service portal for them yet. Ask for sandbox credentials first, verify the integration there, then request production.

Endpoints

Your SCIM base URL follows this pattern, where {tenant} is your organization's tenant identifier at Scalepoint:

The correct URL is provided to you by Scalepoint.

Two resource types are available under the base URL:

Users also support the enterprise extension, urn:ietf:params:scim:schemas:extension:enterprise:2.0:User, which carries the department, employee number, and manager.

Filtering, sorting, and PATCH are supported.

Authentication

Scalepoint protects the SCIM endpoints with OAuth 2.0 client credentials. Request an access token with the client ID and secret Scalepoint issued you, then send it as a bearer token on every SCIM call. The token endpoint for each environment is listed under Authentication.

Request the token with the scopes you need:

A token carrying scim:write is also accepted on reads, so a client that both reads and writes can request both scopes and use one token throughout.

The token is bound to your organization and is rejected against another organization's base URL, so one client can never reach another organization's data.

Tokens are short-lived. Request a new one when the current token expires rather than caching it indefinitely.

Provisioning from Microsoft Entra ID

Provisioning is configured on an application in your own directory. The Scalepoint application you may already have installed for single sign-on is not used for provisioning, so create a separate one as described below.

Create the application

1. In the Microsoft Entra admin center, go to Enterprise applications and select New application.
2. Select Create your own application.
3. Name it, for example, Scalepoint SCIM Provisioner.
4. Select Integrate any other application you don't find in the gallery (Non-gallery). Entra may suggest gallery applications whose names resemble what you typed; keep the non-gallery option selected.
5. Select Create.

Configure provisioning

1. Open the new application, select Provisioning, and start a new provisioning configuration. The configuration is automatic; there is no mode to choose.

2. Under Admin credentials, choose OAuth2 client credentials grant as the authentication method.

3. Fill in the remaining fields:

   Field	Value
   Tenant URL	the SCIM base URL Scalepoint gave you
   OAuth token endpoint	the token endpoint for the same environment, listed under Authentication
   Client identifier	your client ID
   Client secret	your client secret

4. Select Test connection. Entra requests a token and makes a test call. Create stays disabled until this succeeds, so resolve any error here.

5. Select Create.

Use the sandbox values while you are testing, as in the screenshot above, and repeat the setup with the production values once the integration works.

You are taken to the configuration details page afterwards, where the remaining settings live.

Map attributes

You do not need to configure attribute mappings. Entra's defaults for a non-gallery SCIM application already send what Scalepoint consumes, and the attributes Scalepoint does not use are ignored.

If you do open Provisioning > Mappings, leave externalId mapped to the Entra objectId. The object ID is the only Entra identifier that survives a rename. If externalId points at userPrincipalName or a mail attribute instead, renaming the user in Entra makes Scalepoint treat them as a different person, and you get a duplicate account rather than an update.

See Attribute mapping below for what Scalepoint does with each attribute it receives.

Choose who is provisioned

Under Settings, set Scope to Sync only assigned users and groups, then assign users and groups on the application's Users and groups tab.

Three things are worth planning around:

• A group must be assigned to the application before its membership is visible to Scalepoint. Assigning a user does not implicitly assign their groups.
• Nested group membership is not provisioned. If a user belongs to a group only through another group, assign the inner group as well, or the membership does not reach Scalepoint.
• Assign only the groups Scalepoint needs. Large numbers of assigned groups make each synchronization cycle slower.

Start provisioning

On the configuration's overview, select Start provisioning. The first cycle processes everyone in scope and can take some time; later cycles are incremental and run roughly every 40 minutes.

Monitor progress under Provisioning logs.

Provisioning from another SCIM client

Any SCIM 2.0 client can use the same endpoints. Request a token, then call the resource paths.

GET /scim/v2/{tenant}/Users?filter=userName%20eq%20%22ada@example.com%22 HTTP/1.1
Host: sandbox-accounts.scalepoint.com
Authorization: Bearer YOUR_ACCESS_TOKEN

POST /scim/v2/{tenant}/Users HTTP/1.1
Host: sandbox-accounts.scalepoint.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "ada@example.com",
  "displayName": "Ada Lovelace",
  "externalId": "5f9a1f6e-3c1a-4a5f-9c2e-4f0f8a2b7d31",
  "active": true,
  "emails": [{ "value": "ada@example.com", "type": "work", "primary": true }]
}

Contact Scalepoint before you build against these endpoints. Each client is authorized individually for your organization, so a client that has not been registered receives 403 Forbidden even with a valid token.

Attribute mapping

Users

The type qualifiers are significant. An email sent as type: "other", or a phone number sent as type: "home", is not mapped.

From the enterprise extension:

A department group is created automatically the first time a department value arrives, and the user is added to it.

Groups

Only security groups are provisioned. Department groups are derived from the user's department attribute instead.

If you also federate sign-in with Entra ID, note that group aliases in Scalepoint must match the Entra group object ID for role mapping to work. See group mapping on the federation page.

Deactivation and deletion

Scalepoint never deletes an account through SCIM.

Setting active to false, or sending DELETE /Users/{id}, has the same effect: the account can no longer sign in, but the record and its history are kept. Setting active back to true restores access.

This is deliberate. Accounts are referenced by cases and other records that must remain auditable after a person leaves.

Groups are different: deleting a group removes it and its memberships from Scalepoint. The users in it are not affected.

Concurrency

Every user resource carries a version in meta.version, returned as an ETag header.

Send it back as If-Match on updates. If the record changed since you read it, the request is rejected instead of silently overwriting the other change. Clients that do not send If-Match are accepted, and last write wins.

Troubleshooting

When you contact Scalepoint about a provisioning problem, include the time of the failure, the affected user's externalId, and the response your client received.