Skip to main content

​
Manual User Sync

Manual User Sync provisions users from Microsoft Entra ID groups without a separate SCIM Enterprise Application — it reuses your existing SSO app registration’s Graph permissions. Users are admitted and assigned roles from your group mappings when they sign in, according to the enforcement mode you choose.
Group-to-role mapping now lives in Role Provisioning. That single section replaces the old Role mapping, User provisioning, SCIM, and Trust identity provider screens. This page covers the Entra-specific prerequisites and how manual (non-SCIM) provisioning behaves.

​
When to use it

Manual provisioning and SCIM are alternative approaches for the same goal. SCIM is available only with Microsoft Entra ID, and only one identity provider can be active at a time. Don’t run both against the same users.

​
Prerequisites

  1. Microsoft Entra ID SSO is configured and working
  2. At least one verified email domain
  3. Your app registration has these Application Graph permissions, with admin consent:
    • User.Read.All
    • GroupMember.Read.All
    • Group.Read.All
Without Group.Read.All (and consent), no groups appear in the Role Provisioning picker.

​
Configure it in Role Provisioning

  1. Log in as Owner or Admin → Platform settings → Role Provisioning
  2. Turn on User provisioning & role mapping
  3. Set a Default Access role for users who match no mapped group (or No NeuralTrust access)
  4. Choose an Enforcement mode:
  1. Under Role Mapping, add a row per Entra group and choose its platform role:
A user in several mapped groups gets the highest-privilege role among them — not the first match. Do not map IdP groups to Owner; transfer ownership in Users & groups instead.

​
What manual provisioning does not do

  • It does not auto-deprovision. Removing a user from an Entra group does not remove them from NeuralTrust — remove them in Users & groups, or use SCIM for automatic offboarding.

​
Verify

  1. Open Platform settings → Users & groups
  2. Confirm the expected members appear with the correct roles
  3. The Groups tab shows each synced group with its source and member count
All provisioning actions are recorded in Audit Logs.