How to Configure and Test SCIM Provisioning with Microsoft Entra ID

Configure Microsoft Entra ID SCIM Provisioning for Apidog

SCIM connects an identity provider to an Apidog organization so administrators can add and remove organization users through the identity lifecycle. Provisioned users remain inactive until they sign in with the organization's SSO identity.

Try Apidog today

This tutorial configures Microsoft Entra ID for Apidog SCIM, verifies provisioning, and tests controlled user removal.

Prerequisites

You need:

• An Apidog Enterprise organization
• SAML authentication already configured for the organization
• Organization Owner or Organization Admin access in Apidog
• Administrator access to the Microsoft Entra enterprise application
• A disposable test account

Apidog currently supports these SCIM operations:

Operation	Support
Add organization users	Supported
Remove organization users	Supported
Update user attributes	Not supported
SCIM groups	Not supported

SAML group mapping is a separate feature for mapping identity-provider groups to Apidog teams.

1. Confirm the SAML identifier

Microsoft Entra must use a stable identifier that matches the SCIM mapping.

In the Entra enterprise application used for Apidog:

1. Open Single sign-on.
2. Edit Attributes & Claims.
3. Open Unique User Identifier (Name ID).
4. Set the Name ID format to Persistent.
5. Set the source attribute to user.objectid.
6. Save the change.

If the application is already in production, test this change with a pilot user first.

2. Generate the SCIM token in Apidog

1. Open the Apidog organization settings.
2. Go to the SAML SSO page.
3. Select Generate a SCIM token.
4. Copy the SCIM token.
5. Copy the SCIM API endpoint URL.

Generate the token from the organization that Microsoft Entra should provision.

Treat the SCIM token as a credential. Store it in your approved secret-management system. Do not include it in screenshots, tickets, or shared notes.

3. Configure automatic provisioning in Microsoft Entra ID

1. In Microsoft Entra ID, open Enterprise applications.
2. Select the application used for Apidog.
3. Open Provision User Accounts, then select Get started.
4. Set Provisioning Mode to Automatic.
5. Paste the Apidog SCIM API endpoint into the tenant URL field.
6. Paste the SCIM token into the secret token field.
7. Test the connection.
8. Save only after the connection test succeeds.

Use the endpoint and token generated by the same Apidog organization.

4. Configure attribute mappings

Open the provisioning mappings for the enterprise application.

• Disable Groups Mapping.
• Open Users Mapping.
• Remove the default externalId mapping.
• Map Entra objectId to SCIM externalId with matching precedence 1.
• Map userPrincipalName to userName.
• Remove all other mappings so only the required mappings remain.
• Save the configuration.

The documented mapping uses objectId for externalId and userPrincipalName for userName.

Do not enable SCIM group push. Apidog does not currently support SCIM groups.

5. Start provisioning and verify the user

1. Return to the Entra provisioning overview.
2. Select Start provisioning.
3. Assign the disposable test user to the application if required by your Entra configuration.
4. Wait for the provisioning cycle, or use an approved on-demand test.
5. Open the Apidog organization's member list.
6. Confirm that the user appears in a provisioned or inactive state.

A provisioned user does not occupy a paid seat until they sign in through SSO and become active.

Have the test user sign in through the organization's SSO entry point. Confirm that:

• The account is linked to the SSO identity.
• The account becomes active.
• The account occupies a seat.

Apidog documents Microsoft's synchronization interval as approximately 40 minutes. Treat this as an estimate, not a service-level guarantee.

6. Test user removal before rollout

Identity providers can expose several offboarding actions, including unassignment, disablement, and deletion. These actions may produce different SCIM requests.

Use a controlled test:

1. Confirm that the disposable user is active in the intended Apidog organization.
2. Record the user's organization and team memberships.
3. Apply the exact Microsoft Entra offboarding action your organization plans to use.
4. Wait for provisioning to process.
5. Confirm the provisioning result in Entra.
6. Confirm that the linked user was removed from the corresponding Apidog organization.
7. Review the organization's Audit Logs for the SCIM deprovisioning or member-removal event.
8. Confirm that the user can no longer enter the organization through SSO.

Apidog's general SCIM documentation states that deleting a user from the identity provider removes the linked user from the corresponding Apidog organization. The current Microsoft Entra setup page does not document the result of every Entra offboarding action.

Validate the action used by your tenant before making SCIM the only offboarding control.

Removing a user from an Apidog organization is not the same as deleting their entire Apidog account or removing access from unrelated organizations and external systems.

Verify the lifecycle workflow

Before production rollout, verify all four states with disposable accounts:

Test	Expected evidence
Provision a new user	Entra provisioning succeeds and Apidog shows a provisioned or inactive member
First SSO sign-in	Apidog shows an active member linked to the SSO identity
Remove access	Entra records the provisioning result and the user is removed from the corresponding Apidog organization
Reconcile	The member list, SSO access test, and relevant Audit Log event agree

Also define a manual removal path for failed or delayed provisioning.

Troubleshooting

Problem	What to check
The connection test fails	Confirm that the endpoint and token came from the correct Apidog organization and that the token contains no extra spaces.
A user is not provisioned	Check enterprise-application assignment, provisioning scope, provisioning logs, and required attribute mappings.
The user is provisioned but cannot sign in	Verify SAML SSO, Persistent Name ID, user.objectid, and the user's assignment to the SSO application.
The user remains after an offboarding action	Check which SCIM request Entra sent, review provisioning logs, and use the tested manual removal path.
Group membership is not synchronized	SCIM groups are not supported. Configure SAML group mapping for team membership.

Important limitations

SCIM manages membership in the corresponding Apidog organization. It does not remove credentials issued by other systems, repository access, cloud roles, gateway permissions, or production API keys.

Include those systems in the same offboarding checklist.

Related API governance tutorials

These tutorials cover complementary controls for governing an enterprise API workspace:

• API Governance Framework — connect ownership, controls, evidence, and lifecycle decisions.
• SAML Group Mapping with Microsoft Entra ID — assign team access from identity-provider groups.
• Secret Scanner — review possible exposed credentials in supported Apidog assets.
• Audit Logs — investigate and export administrative organization activity.
• SCIM Provisioning — manage organization users through the identity lifecycle.
• Enterprise Policies — configure credential, membership, SSO-session, and invitation controls.
• Self-Service API Teams — allow member-created teams while retaining ownership oversight.
• GitHub Enterprise Cloud Integration — connect supported GHE.com repositories for OpenAPI workflows.

Related official documentation

• Introduction to SCIM Provisioning
• Microsoft Entra ID SCIM Setup
• Okta SCIM Setup
• Mapping Groups to Teams
• Audit Logs