---
title: How to configure SCIM for Microsoft Entra ID
description: Learn how to automatically provision and edit users from your Entra ID Identity Provider using SCIM
tags: scim entra provisioning
dates:
  validation: 2026-04-15
  posted: 2026-04-15
---
import Requirements from '@macros/iam/requirements.mdx'

To use SCIM-based user provisioning with your Entra ID provider, you need to follow the steps below:
1. Configure SCIM in Scaleway.
2. Create an Entra ID application.
3. Configure the Entra ID application.
4. Configure the user mapping.

<Message type="important">
  Only SCIM user-related actions are currently supported by Scaleway. Group auto-provisioning is planned for availability in the coming months.
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- The Cloud Application Administrator role in Microsoft Entra ID.

## Configure SCIM in Scaleway

1. Click **Settings** in the upper-right corner of the Organization Dashboard.
     Alternatively, click the avatar icon in the upper-right corner of the header navigation, then select **Settings** on the drop-down menu.
2. Click **Automatic user provisioning (SCIM)**, under **Organization security**, on the left-side navigation.
3. Click **Enable**. A pop-up displays, informing you that a token creation is required to enable SCIM.
4. Click **Enable SCIM and create token**. SCIM is now enabled for the Organization. Two fields appear — copy both before continuing:
     - **SCIM token** — used by your Identity Provider to authenticate with Scaleway. Treat this as sensitive and do not share it.
     - **Base URL** — used by your Identity Provider to locate your Scaleway account.

     <Message type="important">
     The SCIM token and base URL are only displayed once. Copy and store them securely before closing the pop-up, you will need both to configure SCIM on your Identity Provider.
     </Message>

5. Click **Close**.
   The configuration is complete on the Scaleway side, but you now need to carry out the SCIM configuration on your Identity provider.
   
<Message type="note">
      To ensure the correct SCIM configuration, you can perform actions such as changing a name or creating a user directly on your Identity Provider. You should then see:
      - The impacts reflected on your Scaleway [users](https://console.scaleway.com/iam/users)
      - The update events listed in the Paris region of your [Audit Trail dashboard](https://console.scaleway.com/audit-trail/fr-par/events)
</Message>

<Message type="important">
      By default, SCIM manages users only if their usernames match between the Identity Provider and Scaleway. The federation compares users from both sources, and users not found in the Identity Provider are not impacted by SCIM configuration.
      If you wish to manage not-found users via SCIM, you must re-create them on the Identity Provider or change settings on the Identity Provider side.
</Message>

## Create an Entra ID application

1.  Sign in to the [Microsoft Entra admin center](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal#:~:text=in%20to%20the-,Microsoft%20Entra%20admin%20center,-as%20at%20least).
2. Go to **Enterprise applications** and click **New Application**.
     Scaleway is not in the Entra app gallery, so you need to create your own application.
3. Click **Create your own application**.
     1. Enter a name for the application.
     2. Select the option **Integrate any other application you don't find in the gallery (Non-gallery).
4. Click **Create**.

## Configure provisioning in the Entra ID application

1. Click **Provisioning** under the **Manage** menu.
     Alternatively, click **Provision User Accounts** on the application overview page.
2. Click **Connect your application**.
3. Enter the following parameters:
     - **Authentication method**: Bearer authentication
     - **Tenant URL**: This is the Base URL value you got when you configured SCIM in Scaleway.
     - **Bearer token**: This is the SCIM token you got when you configured SCIM in Scaleway.

## Configure the user mapping in the Entra ID application

Scaleway's SCIM implementation does not support all the default object and attribute values in Microsoft Entra ID. Configure the following parameters.

### Disable group provisioning

<Message type="note">
 Scaleway's SCIM implementation does not support groups.
</Message>

1. Click **Attribute mapping** under the **Manage** menu.
2. Click **Provision Microsoft Entra ID Groups**.
3. Select **No** for **Enabled**, then click **Save**.

### Disable `name.formatted`

Scaleway does not use a `name.formatted` field, it constructs the display name by joining the first and last name with a space, identical to Entra's behavior. This mapping is redundant and should be removed.

1. Click **Attribute mapping** under the **Manage** menu.
2. Click **Provision Microsoft Entra ID Users**.
     This section controls how Entra ID attributes map to Scaleway SCIM fields.
3. Click **Delete** for  `name.formatted`.

### Simplify generated usernames

By default, Entra generates Scaleway usernames in the format `<username>@<domain>.onmicrosoft.com`. To keep usernames short and practical, you can add a formatting rule that strips the domain suffix, leaving only `<username>`.

1. In the **Manage** menu, click **Attribute mapping**.
2. Select **Expression** in **Mapping type**.
3. Enter the following expression: `Item(Split([userPrincipalName], "@"), 1)`, then click **Ok**.

## Troubleshooting - Error 404

Microsoft Entra ID can return an error indicating that a path is not supported by Scaleway's SCIM implementation.
For example, Entra ID might show an error like the following:

```
HTTP 400

unsupported path for operation Add: displayName
```

This type of error indicates that Entra ID is trying to reconcile data that Scaleway does not understand. To fix this issue, follow these steps:
1. In the **Manage** menu, click **Attribute mapping**.
2. Click **Provision Microsoft Entra ID Users**.
     This section controls how Entra ID attributes map to Scaleway SCIM fields.
3. Find the attribute that Entra ID flagged in the error. In the previous example, find the line where the `Microsoft Entra ID Attribute` column reads `displayName`, then click **Delete**.