---
title: "Microsoft Entra ID"
slug: "microsoft-entra-id"
updated: 2025-03-05T09:39:35Z
published: 2025-03-05T09:39:35Z
canonical: "docs.connect.visma.com/microsoft-entra-id"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.connect.visma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

## Microsoft Entra ID Provisioning

With Provisioning you can automate common administrative tasks. By enabling the System for Cross-domain Identity Management (SCIM) you can connect Visma with Entra, so you can:

- Create users and groups
- Grant and revoke access to groups
- Edit attributes of users and groups
- Suspend deprovisioned users **Note**: you will need to redo your setup, in case you have SAML already enabled and you want to configure provisioning.

### Prerequisit**es**

- Microsoft account with Entra Premium activated
- Global Admin or Co-admin account in Entra
- All of your users under your account in Visma will need a pre-existing account in Entra with exactly the same email address
- Entra SSO Saml configured in Authentication Settings

### Configure Visma Single Sign-On app in Entra

1. On the "Single Sign-On" page go to **1. Upload the Visma file into Entra** section. Click on **Download** to get the Visma SAML metadata file. You'll need this Visma Single Sign-On metadata information for configuring Visma as a service provider in your Entra.

![AuthSettings_Provisioning_EntraID_Step1](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step1.png)
2. Log into your Microsoft Entraministrative portal.
3. Click on the hamburger menu icon in the upper left-hand side of the page. Click **All services**.
4. Click on **Azure Active Directory.**

![AuthSettings_Provisioning_EntraID_Step4](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step4.png)
5. Click on **Enterprise applications**.
6. Click **+ New application** at the top of the screen.

![AuthSettings_Provisioning_EntraID_Step6](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step6.png)
7. Click **+ Create your own application** at the top of the screen.

![AuthSettings_Provisioning_EntraID_Step7](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step7.png)
8. Input a name for your application and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
9. Click **Create**.
10. On the left navigation click **Single sign-on**.
11. Select **SAML** on the "Select a single sign-on method" page.

![AuthSettings_Provisioning_EntraID_Step11](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step11.png)
12. On the **Basic SAML Configuration** heading select **Upload metadata file**. Upload the XML file that you have downloaded from Authentication Settings Entra setup page, at step 1.

![AuthSettings_Provisioning_EntraID_Step12](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step12.png)
13. After you have successfully uploaded the XML file, all the fields within the **Basic SAML Configuration** section will be populated. Click **Save** and **close** the "Basic SAML Configuration" editor.

![AuthSettings_Provisioning_EntraID_Step13](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step13.png)
14. Go to the **User Attributes & Claims** heading and select the **Edit** icon. Ensure that the values are exactly as below.

![AuthSettings_Provisioning_EntraID_Step14](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step14.png)
15. Click the **X** icon at the top right-hand side to close the view.

### Configure Visma Single Sign-On and Provisioning to use Entra

1. In the **SAML Signing Certificate** section, ensure that the certificate status is **Active** (it is valid for 3 years after it was added), **if not, add a new certificate** by clicking on the **edit (pencil)** button. Enter a notification email for the certificate expiry reminders and click **Save**.
2. Click the **App Federation Metadata Url** copy button. Your Metadata XML link address should look like: https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxxx/federationmetadata/2007-06/federationmetadata.xml?appid=xxxxxxxxxxxxxxxxxxxxxxx

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step2](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step2.png)
3. Paste this Metadata XML link address into the **Single Sign-On** page within **Authentication Settings**. It contains all your Entra endpoints and public certificate that Visma needs in order to complete the setup.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step3](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step3.png)
4. Click **Save**.
5. After you've successfully saved your Entra integration, you will see your setup details on the **Single Sign-On page**, below MyDomain.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step5](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step5.png)
6. Depending on your provider, the certificate can expire. In that case, we show an error message on the Entra setup.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step6](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step6.png)
7. **Go to Entra** and create or upload a **new and valid certificate.**

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step7](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step7.png)
8. Come back to **Authentication Setting**s and click the **Edit** icon or the Entra link.
9. Click the **Refresh** certificate button and then **Save**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step9](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step9.png)
10. Go to **Entra** and from the Provisioning tab click **Get started.**

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step10](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step10.png)
11. Select **Automatic** for **Provisioning Mode**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step11](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step11.png)
12. Go to the **Authentication Settings Provisioning** tab and **turn on SCIM 2.0 Provisioning**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step12](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step12.png)
13. Copy the **SCIM Endpoint**.
14. Choose the **desired Visma actions and triggers**.
15. Go to **Azure Provisioning** and **paste the SCIM Endpoint in the Tenant URL field**.
16. Go back to **Authentication Settings Provisioning** and click on **Generate SCIM token**.
17. Copy the **SCIM token**.
18. Click **Close**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step18](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step18.png)
19. In **Entra Provisioning** paste the SCIM token you copied into the **Secret Token** field.
20. Click **Save** on the top left corner and **close** the tab.
21. In the **Mappings** field check each mapping for groups/users to have **your desired configuration**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.1](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.1.png)

- **Groups Attribute Mapping** for provisioning:

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.2](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.2.png)

- **Users Attribute Mapping** for provisioning:

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.3](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.3.png)

1. Once all needed actions are selected **SAVE** and **close** the tab. Note: You can **test the provisioning by using Provision on demand for a single user or group** (with a member) to check the setup. 22. **1 Click Provisioning on demand**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.1](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.1.png)

22.2 Use the search bar to **select user or group**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.2](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.2.png)

22.3 Click **Provision**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.3](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.3.png)

1. Click on **Start Provisioning**.
2. Click on **Users and groups**.
3. Click **+Add user/group**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step25](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step25.png)
4. Click **None Selected**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step26](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step26.png)
5. Search and **select** any user/group that you want to add to your application.
6. Click **Assign**.
7. Users/Groups should be provisioned in Connect. **No**te: Every provisioning interval is fixed to 40 minutes.

### Renew expired SCIM token

Upon receiving the email with the subject **“Your organization SCIM token is about to expire”** you should:

- sign in into **Authentication Settings** on the organization mentioned in the email body
- go to the **Provisioning** menu
- click on "**Generate SCIM token**"

![Renew SCIM token](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Renew.png)
- **copy** the new secret key

**In Entra ID:**

- sign in to Entra ID
- open **Enterprise applications**
- go to the application which has provisioning enabled for Visma
- go to **Provisioning**
- click "**Edit provisioning**"
- ![AuthSettings_Provisioning_EntraID_EditProvisioning](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_EditProvisioning.png)
- click "**Update credentials**"
- **paste** the secret key previously copied into "**Secret Token**" field

![AuthSettings_Provisioning_EntraID_EditProvisioning_PasteToken](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_EditProvisioning_PasteToken.png)
- click "**Test Connection**"
- click "**Save**"