# SCIM provioning

SCIM provisioning lets your identity provider create, update, and deactivate Eraser accounts, and control team membership and roles from your directory groups. Once it's running, your directory is the source of truth: admins stop sending team invites, and removing someone from the directory removes their Eraser access.

This guide covers **Microsoft Entra ID**.

<Callout kind="note" title="Availability">
SCIM provisioning is only available on the **Enterprise Plan**, and only for organizations that already have **SAML SSO** configured.
</Callout>

## Quick overview

1. Set up SAML SSO for your organization (prerequisite)
2. Enable provisioning in Eraser and copy the SCIM base URL and bearer token
3. Enable SCIM provisioning on MS Entra
4. Add users and groups on Microsoft Entra
5. Turn on and start provisioning
6. Map your directory groups to Eraser teams
7. Verify provisioning is working

## What SCIM controls

Your directory controls whether an Eraser account exists, which teams the person belongs to, whether they are an **Admin** or a **Member** of each, their name and email, and whether their access is active.

It doesn't touch teams with no group mapping, guests, billing, or any content – deactivating a user never deletes their work. Organization Admins are protected from sync-driven removal and demotion.

Sync is one-way, directory → Eraser, so membership changes made inside a managed team are overwritten on the next sync. That's why Eraser locks those teams' membership UI.

## SCIM provisioning via Entra

Entra pushes your users and security groups to Eraser over SCIM, and you map each directory group to an Eraser team and role.

## Prerequisites

SCIM builds on your SSO connection and can't be enabled without it. If you haven't set it up yet, follow [the SSO documentation](https://docs.eraser.io/docs/sso) using the **MS Entra** instructions – you'll end up with a non-gallery enterprise application named **Eraser** and SSO enabled for your organization.

<Callout kind="note" title="Prerequisite">
Every team you plan to manage with SCIM must have SSO enabled. Teams without it can't be selected when you create a mapping – they appear marked _"(enable SSO first)"_.
</Callout>

## How to enable provisioning in Eraser

An Eraser **Organization Admin** does this.

<Callout kind="note" title="Single-tenant customers">
If you are a single-tenant customer, replace **app.eraser.io** with **your-subdomain.eraser.io** throughout this guide.
</Callout>

1. Go to **[app.eraser.io/organization/dashboard](https://app.eraser.io/organization/dashboard)**.
2. In the left sidebar, select **Identity and settings**.
3. In the **Provisioning** section, click **Set up provisioning**.
4. Eraser reveals a bearer token once. Copy it – it's stored only as a hash and can't be retrieved later.
5. Copy the **SCIM base URL** from the field above it.


<Figure src="/assets/292333916f0662a09edb8212feb7183929af63a87a99e6e8d4f447736748fe3c-image.png" alt="" width="600px" border />


These are the two values Entra needs: the Tenant URL, `https://app.eraser.io/api/scim/v2`, and the secret token.

Leave the **Provisioning is active** toggle on. The badge beside it reads **Not connected yet** until Entra's first request arrives, then **Last sync**, followed by how long ago it ran.

## How to enable SCIM provisioning on MS Entra

An Entra admin does this and the Entra sections that follow.

1. In the Microsoft Entra admin center, open **Enterprise applications → Eraser**.

2. Select **Provisioning** in the left menu.

3. On the **Get started** tab, click **Connect your application**.

4. Under **Admin credentials**, set:

   - **Select authentication method:** `Bearer authentication`
   - **Tenant URL:** the SCIM base URL you copied from Eraser
   - **Secret token:** the bearer token you copied from Eraser

5. Click **Test connection**, confirm it succeeds, then click **Create**.


<Figure src="/assets/e8c50f41f635957822c12624bb7bfdf710a06bb9e3cca21829c0b15a98631487-image.png" alt="" width="600px" border />


The configuration's Overview will show _Current cycle status: Initial sync paused_ – expected, since provisioning isn't switched on yet.

## Checking attribute mappings

Eraser works with Entra's default attribute mappings, so there's nothing to change under **Manage → Attribute mapping**. Attributes Eraser doesn't store are ignored rather than rejected.

## How to add users and groups on Microsoft Entra

Entra only provisions what's assigned to the application.

1. In the Eraser application, go to **Users and groups**.
2. Click **Add user/group** and assign the groups that should have Eraser access.

**Assign groups rather than individual users** wherever you can – those group assignments are what you'll map to Eraser teams later. Entra provisions a group's members as users and the group itself, but it does **not** expand nested groups, so assign the groups you actually want to map. Someone assigned directly belongs to no group, so only a base team rule will place them in a team.

## How to turn on and start provisioning

1. Go to **Manage → Provisioning**.

2. At the bottom, set **Provisioning Status** to **On**.

3. Click **Save**. The toggle defaults to **Off** on a new configuration, and the change doesn't apply until it's saved.


<Figure src="/assets/551dd2de97b205774d86e05e9d7d4f4585fc134d3b33a37cb289725b068d73dd-image.png" alt="" width="600px" border />


4. Return to **Overview** and click **Start provisioning**.


<Figure src="/assets/6b57c5082833ef01b7715b00361ee6481310fcbca1df04fee9f6f6cd44c451ab-image.png" alt="" width="600px" border />


The initial cycle can take **up to 40 minutes**, and Entra runs incremental cycles roughly every 40 minutes after that. **Monitor → Provisioning logs** shows per-user results.

Nothing is granted yet: until you map a group, provisioned users are stored inert, with no account created and no membership changes. Once Entra's first request lands, Eraser's **Provisioning** badge reads **Last sync**, followed by how long ago it ran.

## Provisioning on demand

To see users and groups arrive now rather than waiting out the cycle, use **Provision on demand** in the left menu – search for a user or group and click **Provision**.

It handles 5 group members at a time, and never provisions anyone the regular cycle wouldn't.


<Figure src="/assets/07a95aa559c0358efa466a919987c818d1db5e18600a1c95000e5b7d14d826b8-image.png" alt="" width="650px" border />


## How to map directory groups to Eraser teams

Back in Eraser, an Organization Admin decides what each directory group means. Go to **Organization dashboard → Identity and settings → Group mappings**, where synced groups are listed under **Unmapped groups**.


<Figure src="/assets/effaaf61ed540742e277e6a43ae9c873df1a68860e7f67642deebd6e8ce71655-image.png" alt="" width="650px" border />


1. Find the group and click **Map**.

2. Choose the target team. Teams without SSO are disabled, marked _"(enable SSO first)"_.

3. Choose the role it grants: **Member** or **Admin**.

4. Review the impact preview – _"Adds N, removes M"_, naming the people affected. Save stays disabled until it loads.

5. Click **Save mapping**. Membership syncs immediately.


<Figure src="/assets/8863bfa16bb61408e04f3eb6d46db1d0b0e7bfd140b0fb58e5115abc4d15ee72-image-1785647771780.png" alt="" width="450px" border />


Groups you don't want in Eraser can be dismissed with **Ignore**; they keep syncing, and mapping one later supersedes the ignore.

- A user's role in a team is the **highest** any matching rule grants.
- A team with a mapping is **managed**: its membership list goes read-only and the invite box disappears.
- Removing a mapping keeps current members, then re-syncs against any rules that remain.

### Base team

A base team is an optional rule that puts every provisioned user into one team, on top of any group rules – someone in a mapped group ends up in both. Add one from the **add a base team** link in the section description.

It also gives your whole assigned population accounts, so everyone assigned in Entra consumes a license. Without one, only members of mapped groups get an account; anyone else is blocked at sign-in with _"Your account is not assigned to a team yet."_

## How to verify provisioning is working

In the Eraser organization dashboard:

- **Identity and settings → Recent activity** lists what happened. **Source** reads **Directory** for anything the IdP drove, or an admin's name for changes made in Eraser.
- **Teams** and **Users** gain a **Provisioning** column showing **SCIM managed** or **App managed**. The base team carries a **Base team** badge.
- A managed team's **Members** tab shows the read-only banner and no invite box.


<Figure src="/assets/9db2a34d4b30b0e8ff5c4fbda6c93890d7bb26d0d2fd3a61c83f225aa9c9c4fe-image.png" alt="" width="600px" border />


## Getting help

If provisioning isn't behaving as expected – a sync that won't start, users who can't sign in, or team membership that doesn't match your directory – email us at **[hello@eraser.io](mailto:hello@eraser.io)** and we'll help you work through it.