Microsoft Entra ID
StandardsTutorial - Develop a SCIM endpoint for user provisioning to apps from Microsoft Entra ID
In brief
The article now documents configuring a SCIM endpoint that uses an OAuth2 client-credentials grant from a non-Entra issuer, including the token endpoint, client credentials, credential placement, and scopes.
What Entra admins need to know
Admins integrating these endpoints can use the updated fields and configuration guidance.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
In the app management screen, select Provisioning in the left panel.
Select + New configuration.
If the SCIM endpoint requires an oauth2ClientCredentialsGrant from an issuer other than Microsoft Entra ID, perform the following steps:
In the Tenant URL field, enter the URL of the application's SCIM endpoint. Example:
https://api.contoso.com/scim/.IfIn the
SCIMOAuth token endpointrequires, input the token endpoint value.Enter the Client ID and Client Secret retrieved from the application.
In the How credentials are sent, Choose where to send the client identifier and client secret in the token request. Header sends them as an HTTP Basic Authorization header (client_secret_basic). Body sends them as form parameters in the request body (client_secret_post). Both sends them in both the header and the body of the request.
Specify the OAuth
bearer2.0 scopes to include in the tokenfromrequest when acquiring anissuer other than Microsoft Entra ID, then copy the required OAuth bearer token into the optionalaccess token.
Select
Secret TokenTest Connectionfield. If this field is left blank,to have Microsoft Entra IDincludes an OAuth bearer token issued from Microsoft Entra ID with each request. Apps that use Microsoft Entra ID as an identity provider can validate this Microsoft Entra ID-issued token.attempt to connect to the SCIM endpoint. If the attempt fails, error information is displayed.
@@ -2,7 +2,7 @@ title: Tutorial - Develop a SCIM endpoint for user provisioning to apps from Microsoft Entra ID description: System for Cross-domain Identity Management (SCIM) standardizes automatic user provisioning. In this tutorial, you learn to develop a SCIM endpoint, integrate your SCIM API with Microsoft Entra ID, and start automating provisioning users and groups into your cloud applications. ms.topic: tutorial-ms.date: 08/28/2026+ms.date: 09/15/2026 ms.reviewer: arvinh ai-usage: ai-assisted ---@@ -1417,10 +1417,17 @@ Applications that support the SCIM profile described in this article can be conn 1. In the app management screen, select **Provisioning** in the left panel. 1. Select **+ New configuration**.-1. In the **Tenant URL** field, enter the URL of the application's SCIM endpoint. Example: `https://api.contoso.com/scim/`-1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Microsoft Entra ID, then copy the required OAuth bearer token into the optional **Secret Token** field. If this field is left blank, Microsoft Entra ID includes an OAuth bearer token issued from Microsoft Entra ID with each request. Apps that use Microsoft Entra ID as an identity provider can validate this Microsoft Entra ID-issued token. - > [!NOTE]- > It's ***not*** recommended to leave this field blank and rely on a token generated by Microsoft Entra ID. This option is primarily available for testing purposes.+1. If the SCIM endpoint requires an oauth2ClientCredentialsGrant from an issuer other than Microsoft Entra ID, perform the following steps:++ ++ 1. In the **Tenant URL** field, enter the URL of the application's SCIM endpoint. Example: `https://api.contoso.com/scim/`.+ 1. In the **OAuth token endpoint**, input the token endpoint value.+ 1. Enter the **Client ID** and **Client Secret** retrieved from the application.+ 1. In the **How credentials are sent**, Choose where to send the client identifier and client secret in the token request. Header sends them as an HTTP Basic Authorization header (client_secret_basic). Body sends them as form parameters in the request body (client_secret_post). Both sends them in both the header and the body of the request.+ + 1. Specify the **OAuth 2.0 scopes** to include in the token request when acquiring an access token.+ 1. Select **Test Connection** to have Microsoft Entra ID attempt to connect to the SCIM endpoint. If the attempt fails, error information is displayed. > [!NOTE]