# Configuring SCIM User Sync with Microsoft Entra ID
> Configure SCIM User Sync between Microsoft Entra ID and your UiPath organization using OAuth2 or bearer token.
:::warning
**Critical:** Microsoft Entra ID's default SCIM attribute mappings are not compatible with UiPath. You must update them as described in [Step 4](#step-4-update-attribute-mapping).
:::
This page describes how to configure SCIM (System for Cross-domain Identity Management) User Sync between Microsoft Entra ID and your UiPath organization.
## Prerequisites
- An Enterprise or Enterprise Trial license for your UiPath organization.
- Admin permissions in both your UiPath organization and your Microsoft Entra tenant.
- A working Microsoft Entra ID or Security Assertion Markup Language (SAML) Single Sign-On (SSO) integration with UiPath.
## Before you begin
Set up SSO before you enable SCIM. For a new configuration, complete the steps in this order:
1. Create the application in Microsoft Entra ID and configure SSO with UiPath. See [Microsoft Entra ID integration](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/microsoft-entra-id-integration), or [Configuring the SAML integration](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/configuring-the-saml-integration) if you sign in with SAML.
2. Enable SCIM in UiPath (Step 1 below).
3. Configure SCIM in Entra ID (the remaining steps).
## Step 1: Enable SCIM in UiPath
1. Sign in to [cloud.uipath.com](https://cloud.uipath.com) using an account with organization admin permissions.
2. In the left-hand menu, select **Admin**, then select **Security**.
3. Under **Directory integration and single sign-on (SSO)**, select **Enable SCIM**.
4. Select one of the following authorization methods:
- **OAuth2 client credentials grant** (recommended)
- **Long-lived bearer token**
5. Select **Configure**.
6. Record the following values — you will need them when configuring Entra ID:
- **SCIM URL** (for example, `https://cloud.uipath.com/{orgId}/identity_/api/scim/v2`)
- If using OAuth2: **Client ID** (the OAuth application ID) and **Client Secret** (the OAuth secret)
- If using a bearer token: **Bearer token value**
The **OAuth token endpoint** is not shown in the UiPath admin portal — construct it using the same org id that appears in your SCIM URL above:
`https://cloud.uipath.com/{orgId}/identity_/connect/token`
Your organization ID (`{orgId}`) is the identifier in your UiPath organization URL. Your organization name also works in place of it and is easier to read.
:::note
Leave this browser tab open. Do not select **I have completed identity provider configuration** until you finish the steps in the following sections.
:::
## Step 2: Set up the application in Entra ID
Use an Entra enterprise application to connect to UiPath. When you sign in with **Entra ID SSO**, create a dedicated application for SCIM provisioning. When you sign in with **SAML SSO**, use the Entra enterprise application you already have for SAML.
Find your scenario and follow the matching option:
| Your current integration | What to do |
| --- | --- |
| Entra ID SSO | Create a dedicated application for provisioning — follow the steps below. |
| SAML SSO connected to an Entra enterprise application | Use that enterprise application and continue to Step 3. If you have not created one yet, follow the steps below. |
:::important
Regardless of which application you use, you must update the attribute mapping in Step 4. Without it, user attributes do not map correctly.
:::
**Create the application**
1. Sign in to [portal.azure.com](https://portal.azure.com) using an account with admin permissions in your Microsoft Entra tenant.
2. Select **Microsoft Entra ID**, then navigate to **Enterprise applications** > **All applications** and select **+ New application**.
3. Select **Create your own application**.
4. Enter a name for your application (for example, `UiPath SCIM Connector`).
5. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
6. Select **Create**.
## Step 3: Connect Entra ID with UiPath
1. In your application, navigate to **Manage** > **Provisioning**.
2. Select **Connect your application**.
3. Select your authorization method and complete the required fields using the values recorded in Step 1:
**OAuth2 client credentials grant (recommended)**
| Field | Value |
| --- | --- |
| Tenant URL | SCIM URL from Step 1 |
| OAuth token endpoint | OAuth token endpoint from Step 1 |
| Client identifier | Client ID from Step 1 |
| Client secret | Client Secret from Step 1 |
**Bearer authentication**
| Field | Value |
| --- | --- |
| Tenant URL | SCIM URL from Step 1 |
| Secret token | Bearer token value from Step 1 |
4. Select **Test connection**.
5. Select **Create**.
## Step 4: Update attribute mapping
Update your application's attribute mappings to match the mappings shown below. This step is required for all applications.
1. From the Azure home page, navigate to **Microsoft Entra ID** > **Enterprise applications** > **UiPath SCIM Connector** > **Provisioning**.
2. Select **Edit attributes**.
3. Select **Provision Microsoft Entra ID Users**.
4. Update the mappings so that they match the mappings shown below. Remove any mapping that is not shown.
5. Confirm that `active` is mapped. This mapping deactivates users in UiPath and releases their licenses when they are disabled, unassigned, or deleted in Entra ID.
6. Save.
After you save, the **Attribute Mapping** page shows the following mappings.
The following table lists the exact attribute values for reference:
Source Attribute (Microsoft Entra ID)
Target Attribute (uipath)
Mapping Type
Matching Precedence
objectId
externalId
Direct
1
userPrincipalName
userName
Direct
2
city
addresses[type eq "work"].locality
Direct
companyName
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization
Direct
department
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
Direct
displayName
displayName
Direct
givenName
name.givenName
Direct
jobTitle
title
Direct
mail
emails[type eq "work"].value
Direct
surname
name.familyName
Direct
Switch([IsSoftDeleted], , "False", "True", "True", "False")
active
Expression
## Step 5: Assign target users
1. Navigate to **Enterprise Application** > **UiPath SCIM Connector** > **Users and groups**.
2. Select **Add user/group**.
3. Add the users from your source directory that you want to provision into UiPath.
:::note
Keep this user list in sync with the user list for the application registration used for SSO.
:::
## Step 6: Test provisioning
Before enabling provisioning, test the configuration to verify the connection and attribute mapping are working correctly.
1. Navigate to **Enterprise Application** > **UiPath SCIM Connector** > **Provision on demand**.
2. Select a test user.
3. Select **Provision**.
4. Confirm the user is created in UiPath as expected.
## Step 7: Enable provisioning
1. Navigate to **Enterprise Application** > **UiPath SCIM Connector** > **Provisioning**.
2. Set **Provisioning Status** to **On**.
## Step 8: Complete configuration in UiPath
Return to the UiPath browser tab from Step 1 and select **I have completed identity provider configuration**.
## Result
SCIM User Sync is now active between Microsoft Entra ID and your UiPath organization. Users assigned to the application in Entra ID will be provisioned into UiPath automatically, and subsequent updates or deprovisioning events in your directory will be pushed to UiPath asynchronously.
To verify the setup, navigate to **Admin** > **Security** in UiPath and confirm that the SCIM status shows as enabled. You can also navigate to **Admin** > **Accounts and Groups** and confirm that provisioned users appear in the directory.