SCIM User Provisioning

When people join or leave your organization, someone has to mirror that in Pactly by hand: create the account, fix the name, remember to deactivate it. SCIM removes the manual step. Your identity provider pushes user changes to Pactly directly, so assigning someone to the Pactly app creates their account, and offboarding them cuts their access automatically.

Pactly implements SCIM 2.0 for user provisioning from Microsoft Entra ID (formerly Azure AD). SCIM can create users, update their names and directory attributes, deactivate them, and reactivate them. Provisioning covers users only: groups are not synced over SCIM.

• Working Entra ID SSO. Set up and test SSO with Microsoft Entra ID before enabling SCIM. The Entra application itself is configured per Entra ID App Setup for SSO (OIDC).
• Verified, locked domains. If your company has locked domains, SCIM can only create users whose email is on one of them. See Verify and lock your domains.
• Admin access to Pactly and to your Entra admin center.

Everything on the Pactly side lives in one card: Account settings → Single Sign-On, under User Provisioning.

Step-through All steps

Step 1 of 5

1

Open the SSO settings

In the left menu, open Account settings and click Single Sign-On. Scroll to the User Provisioning card.

2

Enable SCIM 2.0 provisioning

Switch the SCIM 2.0 provisioning toggle to enabled. The SCIM configuration fields appear below it.

3

Copy the SCIM Endpoint URL

Click Copy next to the SCIM Endpoint URL. You will paste this into Entra ID in the next section.

4

Generate the SCIM Bearer Token

Click Generate Token. The token appears once, with Show, Copy, and Regenerate controls. Copy it somewhere safe for the next section.

5

Save

Click Save at the bottom of the card so the provisioning settings take effect.

Previous Step 1 of 5 Next

SCIM provisioning runs through an enterprise application in your Entra tenant, and it is always a new one you create just for provisioning — don’t go looking for an existing Pactly app to configure. If you use Pactly’s multi-tenant app, there may be no Pactly application in your tenant at all (one only appears after admin consent or the first sign-in), and even then, neither it nor a custom SSO app registration can be configured for automatic provisioning — Entra ID only offers that on gallery apps and on non-gallery apps created through Create your own application. So, whichever SSO model you chose, create the provisioning app fresh and wire it to the endpoint and token from Step 1:

1. In the Microsoft Entra admin center, open Enterprise applications and click New application → Create your own application.
2. Name it something recognizable, for example Pactly Provisioning, choose Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.
3. In the new application, go to Provisioning and click New configuration (the Connect your application button opens the same form).
4. Paste the SCIM Endpoint URL from Pactly into Tenant URL, and the bearer token into Secret Token.
5. Click Test connection — Entra ID calls the Pactly endpoint and confirms the token works — then click Create.
6. Under Users and groups, assign the users (or groups of users) who should have Pactly accounts.
7. Turn provisioning on: on the Provisioning page, switch Provisioning Status to On and click Save (the overview page offers the same thing as a Start provisioning button). Keep the scope on syncing only assigned users and groups (the default) unless you truly want your whole directory pushed to Pactly.

Before you start provisioning, decide two things: who gets pushed to Pactly, and which operations Entra ID is allowed to perform. Both are set in the provisioning app you just created.

• Assignment is the main filter. With the default scope, Sync only assigned users and groups, Entra ID provisions exactly the users (and members of groups) you assign under Users and groups — nobody else.
• The scope setting (in the provisioning configuration’s settings) can also be switched to Sync all users and groups, which pushes your entire directory to Pactly. Leave it on assigned-only unless that is genuinely what you want.
• Scoping filters (the Add scoping filters step on the provisioning overview) narrow the assigned set further by attribute — for example, only users whose department equals Legal. Useful when you assign a broad group but only part of it should have Pactly accounts.

In the provisioning app, open Attribute mapping (on the classic page it’s called Mappings). It lists a mapping per object type — one for users, one for groups. Open the users mapping. Near the top, the Target Object Actions checkboxes — Create, Update, Delete — control which operations Entra ID attempts against Pactly:

• Untick Create to have Entra ID only manage accounts that already exist in Pactly — for example when you want new accounts to come from Just-In-Time sign-in (or manual invites) but leavers to be deactivated automatically.
• Delete here corresponds to deactivation in Pactly: when a user is unassigned, soft-deleted, or disabled in Entra ID, Pactly deactivates their account. Nothing is ever hard-deleted over SCIM.

While you’re in Attribute mapping: Pactly does not sync groups, so open the groups mapping and set Enabled to No. This stops Entra ID from attempting group operations that Pactly would reject anyway.

Pactly has a matching set of switches — Allowed SCIM operations, described below. Set both sides consistently: the Entra checkboxes stop an operation from being attempted, and the Pactly switches stop it from succeeding even if the directory attempts it. Doing it only in Entra works, but the Pactly side is the enforcement you control.

Under the provisioning configuration’s properties (Edit properties / Set properties on the overview), set a notification email and the accidental deletion threshold. If a sync would deactivate more accounts than the threshold, Entra ID pauses provisioning and alerts you instead — cheap insurance against a mis-scoped group unassigning your whole company.

Entra ID runs an initial sync and then provisions changes on its own cycle (roughly every 40 minutes). Assigned users appear in Pactly’s User management as they sync.

You don’t have to wait for the cycle to test: Provision on demand in the provisioning app’s left menu pushes a single user to Pactly immediately. Pick a test user there, confirm they appear in User management, and you know the connection works end to end.

By default, an enabled SCIM connection has full permissions: create, update, and deactivate. Under Allowed SCIM operations you can switch off any of the three independently. Reading users is always allowed, so Entra ID can match accounts that already exist.

• Allow create: Entra ID may create brand-new Pactly users. Turn this off to keep account creation Just-In-Time only (users are still created on their first SSO login) while SCIM continues to update and deactivate them.
• Allow update: Entra ID may change names and directory attributes, and reactivate users it previously deactivated.
• Allow deactivate: Entra ID may deactivate users when they are unassigned or offboarded.

When an operation is switched off, Pactly skips that part of the sync and answers the identity provider with a permission error for requests that only attempt the forbidden operation. These switches are the enforcement side of the same decision as Entra ID’s Target object actions (above) — mirror your choice there too, so Entra ID doesn’t keep attempting operations that Pactly refuses and filling the provisioning log with errors.

Users created over SCIM receive the Default Role configured under Just-In-Time provisioning in the same User Provisioning card (User, Manager, Approver, Lite, Viewer, or Requester). You can change an individual’s role afterwards in User management; see User roles for what each role can do.

When you unassign someone from the provisioning app in Entra ID (or offboard them), SCIM deactivates the Pactly account and ends their active sessions. They can no longer sign in, and their contracts and history stay intact.

Two rules protect against surprises:

• SCIM can reactivate only accounts that SCIM itself deactivated. Re-assigning the person in Entra ID restores their account.
• An account an admin deleted manually in Pactly is never revived by a sync. Pactly rejects the attempt so a directory change cannot silently restore access that an admin deliberately removed.

For integrations other than Entra ID’s built-in provisioning, Pactly exposes a standard SCIM 2.0 REST API. Every request authenticates with the bearer token from Step 1 in an Authorization: Bearer header. The base URL is the SCIM Endpoint URL shown in your SSO settings.

Notes for SCIM client implementers:

• Filtering supports userName eq "value" and externalId eq "value".
• Pagination uses startIndex (1-based) and count (maximum 100 per page).
• PATCH supports replace operations on active, name.givenName, name.familyName, and externalId.
• Bulk operations, sorting, and ETags are not supported. There is no Groups resource.
• DELETE is a soft-delete: it deactivates the account, identical to active: false.

• Test Connection fails (401): the token is wrong, was regenerated since you saved it in Entra ID, or SCIM (or SSO) is disabled in Pactly. Regenerate the token and update Entra ID.
• Users are not created (403): Allow create is switched off under Allowed SCIM operations, so only Just-In-Time login creates accounts.
• A specific user fails to provision: if your company has locked domains, the user’s email domain must be on one of them. Also check the email is not already in use by an account linked to a different directory identity; conflicting identities are rejected so one person cannot shadow another’s account.
• A leaver still has access: confirm Allow deactivate is on and the user was actually unassigned in Entra ID. Deactivation happens on the next provisioning cycle, not instantly.

• Single Sign-On with Microsoft Entra ID
• Entra ID App Setup for SSO (OIDC)
• Verify and lock your domains
• Adding and managing users
• User roles and permissions