Skip to main content
Microsoft Entra ID creates, updates and deactivates people in Living Security through SCIM. This guide connects an Entra enterprise application to Living Security and tests it with one user.

What you need

  • A Living Security admin with the Manage Identity Provider permission.
  • Single sign-on is optional. If you use it, the SCIM userName must match the name your single sign-on sends. See SSO and sub-organizations.
  • If your organization already uses the earlier SCIM setup, keep your existing enterprise application. Follow Move from the earlier SCIM setup instead of the first step below, then replace the URL and token in that enterprise application.
  • In Entra: the Application Administrator or Cloud Application Administrator role. Group assignment needs Microsoft Entra ID P1 or P2.

Set up provisioning

1

Create the SCIM token in Living Security

  1. Open Settings → Privacy & security → Directory sync (SCIM).
  2. Select Set up SCIM.
  3. Copy the SCIM base URL and the Bearer token. You can’t see the token again. If you lose it, select Rotate token.
The token expires after one year. Living Security sends notices 30, 14, 7 and 1 days before it expires.
2

Create the enterprise application

In the Microsoft Entra admin center, open Enterprise applications → New application → Create your own application. Name it Living Security, select Integrate any other application you don’t find in the gallery (Non-gallery), and select Create.If you already use an enterprise application for Living Security single sign-on, you can add provisioning to it instead.
3

Connect provisioning

  1. In the application, open Provisioning and set Provisioning Mode to Automatic.
  2. Under Admin Credentials, paste the SCIM base URL into Tenant URL and the token into Secret Token.
  3. Select Test Connection, then Save.
The Setup checklist in Living Security shows First request received and Connection test passed.
4

Map the attributes

Open Provisioning → Mappings → Provision Microsoft Entra ID Users and set these mappings:Turn matching off on every other mapping.
userName, the single sign-on NameID and the primary email must be the same email address. If they differ, provisioning succeeds but the person can’t sign in. See Identity requirements.
5

Check your mappings

  1. In Entra, select Show advanced options → Review your schema here and download the schema.
  2. In Living Security, open Troubleshoot SCIM → Validate → Check an Entra mapping.
  3. Upload the file, enter the single sign-on NameID source (for example user.userprincipalname), and select Check mapping.
Fix each finding before you start provisioning. The codes are in Mapping check codes.
6

Choose who to provision

  1. In Provisioning → Settings, set Scope to Sync only assigned users and groups.
  2. In Users and groups, assign the people and groups to provision.
  3. Keep Provision Microsoft Entra ID Groups on to send groups. Each group must be security-enabled. Entra sends only the direct members of an assigned group, not members of nested groups.
7

Test with one user

  1. Select Provision on demand, choose one assigned user, and select Provision.
  2. Wait for First user received, then First user ready to sign in, on the Living Security Setup checklist. This takes a few minutes.
  3. Ask the test user to sign in to Living Security.
The checklist shows First sign-in by a SCIM user. If First user ready to sign in stays waiting, open the Health tab.
8

Start provisioning

Set Provisioning Status to On and select Save. Entra runs a first cycle for everyone in scope, then a cycle about every 40 minutes. A change made in Entra reaches Living Security on the next cycle. Use Provision on demand for one person at once.

Living Security and custom attributes

Living Security also reads startDate, location and employmentType from urn:ietf:params:scim:schemas:extension:livingsecurity:2.0:User. To send other attributes, select Show advanced options → Edit attribute list for customappsso, add an attribute such as urn:ietf:params:scim:schemas:extension:yourcompany:2.0:User:costCenter, then map it. Living Security stores custom extension attributes and lists them in its /Schemas document. Limits: 20 custom extension schemas, 200 attributes per schema, 256-character schema URNs.

Restart provisioning

Restart provisioning clears Entra’s state and runs a full cycle again. Living Security matches each user on userName, so a restart creates no duplicates.

Troubleshoot

Open Settings → Privacy & security → Directory sync (SCIM) → Troubleshoot. The Health tab shows failed requests, held accounts and token expiry. The Attributes tab shows what your identity provider sends. Copy diagnostics copies request IDs and error codes for a support request, with no names, emails or tokens.

Quarantine

Entra puts the application in quarantine when most of its requests fail, and then runs cycles less often. The Health tab shows Quarantine risk before this happens.
1

Find the cause

Read the error in Entra’s Provisioning logs and fix the cause. An expired or revoked token (LS-SCIM-1001) is the usual cause.
2

Leave quarantine

Select Restart provisioning.

Attribute problems

The Attributes tab shows what Entra sent for the newest user, how many people carry each attribute, and attributes Living Security did not store. Fix each finding in Provisioning → Mappings → Provision Microsoft Entra ID Users, then select Provision on demand for one user to check it.

Error codes

Each failed request has an LS-SCIM code in its error detail. Entra shows it in the Provisioning logs.

Held accounts

Some changes are accepted but held. Entra shows success, the SCIM card shows Held accounts, and the Health tab lists each reason with its fix. Fix the cause, then select Provision on demand for the person: the next change applies. If an account stays held, contact Living Security Support with the diagnostics.

Mapping check codes

SCIM provisioning

Identity rules, directory groups and request history.

Set up SCIM with Okta

The same setup for Okta.