---
title: "Microsoft Entra ID"
slug: "microsoft-entra-id"
updated: 2026-10-05T07:08:57Z
published: 2026-10-05T07:08:57Z
canonical: "docs.connect.visma.com/microsoft-entra-id"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.connect.visma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

## Microsoft Entra ID Provisioning

With Provisioning you can automate common administrative tasks. By enabling the System for Cross-domain Identity Management (SCIM) you can connect Visma with Entra, so you can:

- Create users and groups
- Grant and revoke access to groups
- Edit attributes of users and groups
- Suspend deprovisioned users

### Prerequisit**es**

- Microsoft account with Entra Premium activated
- Global Admin or Co-admin account in Entra
- All of your users under your account in Visma will need a pre-existing account in Entra with exactly the same email address
- Entra SSO (Saml OR OIDC) configured in Authentication Settings

**Important**:

**If you have configured SSO using OIDC (not SAML) , to enable SCIM provisioning you need to:**

1. [Create an Enterprise Application only for SCIM Provisioning](/v1/docs/microsoft-entra-id#create-an-enterprise-application-only-for-scim-provisioning-using-the-same-user-and-group-assignments-as-your-sso-app-on-which-you-only-configure-the-provisioning-part-in-entra)
2. [Configure Provisioning](/v1/docs/microsoft-entra-id#configure-provisioning)

**If you have already configured SAML SSO using the Visma App Gallery**, that application definition does not support user provisioning, to enable SCIM provisioning, you can either:

1. [Create an Enterprise Application only for SCIM Provisioning](/v1/docs/microsoft-entra-id#create-an-enterprise-application-only-for-scim-provisioning-using-the-same-user-and-group-assignments-as-your-sso-app-on-which-you-only-configure-the-provisioning-part-in-entra) using the same user and group assignments as your SSO app. on which you only configure the Provisioning part in Entra
2. or [Re-Cconfigure SAML SSO using the custom non-gallery application](/v1/docs/microsoft-entra-id#configure-saml-sso-using-the-custom-nongallery-application)
3. [Configure Provisioning](/v1/docs/microsoft-entra-id#configure-provisioning)

## Create an Enterprise Application only for SCIM Provisioning

Sign in to the [Microsoft Entra admin center](https://www.google.com/search?q=https://entra.microsoft.com/) as an Application Administrator or Global Administrator.

- In the left navigation menu, go to Identity > Applications > Enterprise applications.
- Select + New application, then click + Create your own application.
- Enter a clear name for your app (e.g., `AppName - SCIM Provisioning`).
- Choose the option: Integrate any other application you don't find in the gallery (Non-gallery).
- Click Create.
- Verification: Ensure you are automatically redirected to the Overview page of your newly created enterprise application.

## Configure SAML SSO using the custom non-gallery application

1. On the "Single Sign-On" page go to **1. Upload the Visma file into Entra** section. Click on **Download** to get the Visma SAML metadata file. You'll need this Visma Single Sign-On metadata information for configuring Visma as a service provider in your Entra.

![AuthSettings_Provisioning_EntraID_Step1](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step1.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
2. Log into your Microsoft Entraministrative portal.
3. Click on the hamburger menu icon in the upper left-hand side of the page. Click **All services**.
4. Click on **Azure Active Directory.**

![AuthSettings_Provisioning_EntraID_Step4](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step4.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
5. Click on **Enterprise applications**.
6. Click **+ New application** at the top of the screen.

![AuthSettings_Provisioning_EntraID_Step6](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step6.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
7. Click **+ Create your own application** at the top of the screen.

![AuthSettings_Provisioning_EntraID_Step7](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step7.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
8. Input a name for your application and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
9. Click **Create**.
10. On the left navigation click **Single sign-on**.
11. Select **SAML** on the "Select a single sign-on method" page.

![AuthSettings_Provisioning_EntraID_Step11](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step11.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
12. On the **Basic SAML Configuration** heading select **Upload metadata file**. Upload the XML file that you have downloaded from Authentication Settings Entra setup page, at step 1.

![AuthSettings_Provisioning_EntraID_Step12](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step12.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
13. After you have successfully uploaded the XML file, all the fields within the **Basic SAML Configuration** section will be populated. Click **Save** and **close** the "Basic SAML Configuration" editor.

![AuthSettings_Provisioning_EntraID_Step13](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step13.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
14. Go to the **User Attributes & Claims** heading and select the **Edit** icon. Ensure that the values are exactly as below.

![AuthSettings_Provisioning_EntraID_Step14](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Step14.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
15. Click the **X** icon at the top right-hand side to close the view.

### Configure Visma Single Sign-On

1. In the **SAML Signing Certificate** section, ensure that the certificate status is **Active** (it is valid for 3 years after it was added), **if not, add a new certificate** by clicking on the **edit (pencil)** button. Enter a notification email for the certificate expiry reminders and click **Save**.
2. Click the **App Federation Metadata Url** copy button. Your Metadata XML link address should look like: https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxxx/federationmetadata/2007-06/federationmetadata.xml?appid=xxxxxxxxxxxxxxxxxxxxxxx

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step2](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step2.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
3. Paste this Metadata XML link address into the **Single Sign-On** page within **Authentication Settings**. It contains all your Entra endpoints and public certificate that Visma needs in order to complete the setup.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step3](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step3.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
4. Click **Save**.
5. After you've successfully saved your Entra integration, you will see your setup details on the **Single Sign-On page**, below MyDomain.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step5](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step5.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
6. Depending on your provider, the certificate can expire. In that case, we show an error message on the Entra setup.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step6](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step6.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
7. **Go to Entra** and create or upload a **new and valid certificate.**

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step7](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step7.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
8. Come back to **Authentication Setting**s and click the **Edit** icon or the Entra link.
9. Click the **Refresh** certificate button and then **Save**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step9](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step9.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

## Configure Provisioning

Inside your Enterprise app menu, select Provisioning under Manage, then click Get started.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step10](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step10.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

Select **Automatic** for **Provisioning Mode**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step11](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step11.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- Go to the **Authentication Settings Provisioning** tab and **turn on SCIM 2.0 Provisioning**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step12](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step12.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- Copy the **SCIM Endpoint**.
- Choose the **desired Visma actions and triggers**.
- Go to **Azure Provisioning** and **paste the SCIM Endpoint in the Tenant URL field**.
- Go back to **Authentication Settings Provisioning** and click on **Generate SCIM token**.
- Copy the **SCIM token**.
- Click **Close**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step18](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step18.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- In **Entra Provisioning** paste the SCIM token you copied into the **Secret Token** field.
- Click **Save** on the top left corner and **close** the tab.
- In the **Mappings** field check each mapping for groups/users to have **your desired configuration**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.1](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.1.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- **Groups Attribute Mapping** for provisioning:

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.2](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.2.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- **Users Attribute Mapping** for provisioning:

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.3](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step21.3.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
- Once all needed actions are selected **SAVE** and **close** the tab.
- Note: You can **test the provisioning by using Provision on demand for a single user or group** (with a member) to check the setup.
- **Click Provisioning on demand**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.1](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.1.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- Use the search bar to **select user or group**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.2](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.2.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- Click **Provision**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.3](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step22.3.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)

- Click on **Start Provisioning**.
- Click on **Users and groups**.
- Click **+Add user/group**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step25](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step25.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
- Click **None Selected**.

![AuthSettings_Provisioning_EntraID_ConfigureVisma_Step26](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_ConfigureVisma_Step26.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
- Search and **select** any user/group that you want to add to your application.
- Click **Assign**.
- Users/Groups should be provisioned in Connect. **No**te: Every provisioning interval is fixed to 40 minutes.

## Renew expired SCIM token

Upon receiving the email with the subject **“Your organization SCIM token is about to expire”** you should:

- sign in into **Authentication Settings** on the organization mentioned in the email body
- go to the **Provisioning** menu
- click on "**Generate SCIM token**"

![Renew SCIM token](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_Renew.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
- **copy** the new secret key

**In Entra ID:**

- sign in to Entra ID
- open **Enterprise applications**
- go to the application which has provisioning enabled for Visma
- go to **Provisioning**
- click "**Edit provisioning**"
- ![AuthSettings_Provisioning_EntraID_EditProvisioning](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_EditProvisioning.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
- click "**Update credentials**"
- **paste** the secret key previously copied into "**Secret Token**" field

![AuthSettings_Provisioning_EntraID_EditProvisioning_PasteToken](https://cdn.document360.io/0ec30182-e256-4eca-ab6a-d067d83d0895/Images/Documentation/AuthSettings_Provisioning_EntraID_EditProvisioning_PasteToken.png?sv=2026-02-06&spr=https&st=2026-10-30T03%3A25%3A45Z&se=2026-10-30T04%3A25%3A45Z&sr=c&sp=r&sig=n7MGJa3YTjXS6X98obYAfJxg6TGoE93CFoniB14i7Yo%3D)
- click "**Test Connection**"
- click "**Save**"