Skip to main content

​
SCIM Automatic User Provisioning

SCIM is available for Microsoft Entra ID only — and only one identity provider can be active at a time. Generic OIDC and Google Workspace do not include SCIM; use Role Provisioning (group-to-role mapping) or Manual User Sync instead. In Role Provisioning, choosing the Automatically via SCIM enforcement mode is what hands the user lifecycle to your IdP through SCIM 2.0.
SSO Configuration and SCIM are Enterprise plan features. The Free plan hides both screens in Platform Settings. Plans & Billing lists them under Enterprise.
SCIM (System for Cross-domain Identity Management) automatically creates, updates, and removes NeuralTrust user accounts when changes happen in your Microsoft Entra ID directory. No manual user management needed.

​
Benefits

  • Automatic onboarding: Users get NeuralTrust access when added to your directory
  • Automatic offboarding: Users lose access when removed from your directory
  • No manual invitations: Eliminate manual user management tasks
  • Always in sync: User accounts stay synchronized with your corporate directory

​
Prerequisites

Before configuring SCIM, ensure:
  • SSO is configured and working
  • Enterprise Applications access in Azure Portal
  • Owner role in NeuralTrust
Alternative: Manual User Sync If you prefer on-demand user import instead of automatic provisioning, you can use Manual User Sync instead. Manual Sync uses your existing SSO app registration and doesn’t require a separate Enterprise Application in Azure.

​
Part 1: Generate SCIM Token in NeuralTrust

​
Step 1: Open SCIM Settings

  1. Log in to NeuralTrust as Owner
  2. Open the sidebar gear → Platform settings → SSO Configuration (SCIM tile)
  3. Click the SCIM Provisioning tab

​
Step 2: Generate Token

  1. Click Generate Token
  2. Select expiration period:
    • 30 days
    • 60 days
    • 90 days (recommended)
    • 180 days
    • 365 days
  3. Click Generate
  4. Copy the token immediately — It will not be shown again

​
Step 3: Copy Tenant URL

Your SCIM endpoint URL is displayed in the setup guide:
Self-hosted deployments: the Tenant URL shown in the console currently uses the hosted address above. Replace the host with your own console hostname when configuring your identity provider — for example https://app.your-domain.com/api/scim/v2. The path is unchanged.
Save the Secret Token securely. It’s only shown once and cannot be retrieved later. If you lose it, you’ll need to generate a new one.

​
Token Status Dashboard

After generating a token, you’ll see a status panel with:

​
Revoking a Token

If you need to revoke access:
  1. Go to Settings → SSO → SCIM Provisioning tab
  2. Click Revoke
  3. Confirm the action
  4. The token is immediately invalidated

​
Part 2: Configure Azure Provisioning

​
Step 1: Create Enterprise Application

  1. Go to Azure Portal
  2. Navigate to Enterprise Applications
  3. Click + New application
  4. Click Create your own application
  5. Enter name: NeuralTrust SCIM
  6. Select Integrate any other application you don’t find in the gallery
  7. Click Create

​
Step 2: Configure Provisioning Mode

  1. In your new application, go to Provisioning
  2. Click Get started
  3. Set Provisioning Mode to Automatic

​
Step 3: Enter Admin Credentials

Under Admin Credentials, enter: Click Test Connection. You should see:
“The supplied credentials are authorized to enable provisioning.”

​
Step 4: Configure Attribute Mappings

  1. Expand Mappings
  2. Click Provision Azure Active Directory Users
  3. Verify these mappings exist:
  1. Click Save

​
Step 5: Assign Users and Groups

  1. Go to Users and groups
  2. Click + Add user/group
  3. Select the users or groups you want to provision
  4. Click Assign
You can assign individual users or entire Azure AD groups. When you assign a group, all members of that group will be provisioned to NeuralTrust.

​
Step 6: Start Provisioning

  1. Go back to Provisioning
  2. Set Provisioning Status to On
  3. Click Save
Azure will begin an initial provisioning cycle, which can take 20-40 minutes depending on the number of users.

​
Part 3: Test Provisioning

​
Test with a Single User

Before enabling provisioning for your entire organization, test with a single user:
  1. Go to Provisioning → Provision on demand
  2. Search for and select a test user
  3. Click Provision
  4. Review the provisioning steps and results
  5. Check NeuralTrust — the user should appear in your organization

​
Verify User in NeuralTrust

  1. Open Platform settings → Users & groups in NeuralTrust
  2. Confirm the provisioned user appears in the member list
  3. Verify their display name and email are correct — groups pushed by SCIM appear under the Groups tab with source SCIM

​
Token Management

​
Token Lifecycle

​
Managing Tokens

When you regenerate a token, you must update the Secret Token in Azure immediately. Provisioning will fail until the new token is configured.

​
Token Expiration Workflow

  1. NeuralTrust sends email reminders at 30, 14, and 7 days before expiration
  2. Generate a new token before the old one expires
  3. Update the Secret Token in Azure Enterprise Application
  4. Test the connection to verify the new token works

​
Provisioning Behavior

​
What Happens When You Add a User

  1. User is added to an assigned Azure AD group
  2. Azure detects the change (within 40 minutes, or immediately with on-demand)
  3. Azure sends SCIM request to NeuralTrust
  4. NeuralTrust creates the user account
  5. User can immediately sign in via SSO

​
What Happens When You Remove a User

  1. User is removed from all assigned Azure AD groups
  2. Azure detects the change (within 40 minutes)
  3. Azure sends SCIM deprovisioning request
  4. NeuralTrust deactivates the user account
  5. User can no longer access NeuralTrust

​
What Happens When User Attributes Change

  1. User’s display name, email, or other attributes change in Azure AD
  2. Azure detects the change (within 40 minutes)
  3. Azure sends SCIM update request
  4. NeuralTrust updates the user’s profile

​
Monitoring Provisioning

​
View Provisioning Logs in Azure

  1. Go to your Enterprise Application in Azure
  2. Navigate to Provisioning → View provisioning logs
  3. Filter by date, status, or user to find specific events

​
Common Log Entries

​
View Provisioning Events in NeuralTrust

Provisioning events are logged in NeuralTrust Audit Logs:
  1. Open Audit Logs in the console (location is moving; look under Telemetry / Logs when available)
  2. Filter by Category: SSO Security
  3. Look for events like:
    • scim.user.provisioned
    • scim.user.updated
    • scim.user.deprovisioned

​
Troubleshooting

​
Force Immediate Sync

If you need changes to sync immediately:
  1. Go to Provisioning in Azure
  2. Click Provision on demand
  3. Select the user to sync
  4. Click Provision

​
Security Best Practices

  1. Set calendar reminders to regenerate tokens before the 90-day expiration
  2. Use Azure AD groups to manage access rather than individual user assignments
  3. Monitor provisioning logs regularly for failed operations
  4. Test with a small group before assigning your entire organization
  5. Review NeuralTrust audit logs for provisioning-related events

​
Next Steps