# Configure SCIM - Microsoft Entra

This describes how to sync users and groups to **Row Zero** with **Microsoft Entra ID** using SCIM (System for Cross-domain Identity Management). Once set up, any users or groups assigned to the application in Entra ID will automatically sync to Row Zero.

---

## Prerequisites

Before starting, ensure you have:

- Administrator access to **Microsoft Entra ID**.
- A **SCIM Secret Token** provided by the Row Zero team.

---

## Step 1: Create an Enterprise Application

Log into the Microsoft Entra admin center.

1. Navigate to your company’s Microsoft Azure Home and in the left navigation menu of the, select **Enterprise applications**.  

   ![scim entra enterprise applications](https://cdn.sanity.io/images/2w8agf2t/production/eb6801594805f0b25f39749c1d52b80b5576a0b0-484x592.png)

2. Click **+ New application**  

   ![scim entra new application](https://cdn.sanity.io/images/2w8agf2t/production/26fb0937a35a910cb06301c6b976febe06afef24-996x134.png)

3. Choose **+ Create your own application**  

   ![scim entra create application](https://cdn.sanity.io/images/2w8agf2t/production/6e89ed954dd3b04eba482484d8a1658ff7de5679-711x230.png)

4. Enter **Row Zero** as the application name and select **Integrate any other application you don’t find in the gallery (Non-gallery)**.  

   ![scim entra integrate any](https://cdn.sanity.io/images/2w8agf2t/production/cb5a216c148c9845d2072a0354ffa8d318bd07dc-722x451.png)

5. Click **Create**

---

## Step 2: Assign Users and Groups

You must assign users and/or groups to the application before provisioning will sync them to Row Zero.

1. Open the **Row Zero** enterprise application.
2. In the left panel, select **Users and groups**.  

   ![scim entra users and groups](https://cdn.sanity.io/images/2w8agf2t/production/0f2f53a49422cb1ecc6a638594fc9798ec276917-401x465.png)

3. Under **Getting Started**, select **Assign users and groups**.  

   ![scim entra assing users](https://cdn.sanity.io/images/2w8agf2t/production/7d93d03915f5db0c5a7c66d42fd9ff2856de04a5-565x304.png)

4. Click on **Add user/group**
5. Click **None Selected** to open the selection panel.  

   ![scim entra none selected](https://cdn.sanity.io/images/2w8agf2t/production/32345db4935c0ad75c9ce6df308ec25a93dfbb09-428x257.png)

6. Choose the users and/or groups you want to provision into Row Zero.
7. Click **Assign**

---

## Step 3: Configure SCIM Provisioning

1. In the **Row Zero** Enterprise application, select **Provisioning** from the left menu.  

   ![scim entra provisioning](https://cdn.sanity.io/images/2w8agf2t/production/29eaee43ca8a32df33b3b96570d93e4ba23c71ee-440x555.png)

2. Click **Connect your application**.  

   ![scim entra create configuration](https://cdn.sanity.io/images/2w8agf2t/production/6c3457a460736021c918f50b6ebdd322f14693a9-626x209.png)

3. Enter the following details and click **Test connection**:  

   ![scim entra test connection](https://cdn.sanity.io/images/2w8agf2t/production/679c51951fd204c05b7ad9b6ae9ff503a4a49730-768x326.png)

4.  - **Tenant URL**: `https://scim.rowzero.com/scim/v2` - **Secret Token**: Enter the token provided by Row Zero. - If successful, you’ll see a confirmation message.
5. Click **Create** to save the settings.

---

## Step 4: Start Provisioning

From the **Row Zero** Enterprise Application, in the **Overview** tab in the left panel, click **Start provisioning**.

## Once enabled, assigned users and groups will sync into Row Zero automatically on the Microsoft Entra provisioning schedule.

## Notes

- Provisioning typically runs every **40 minutes** by default.
- You can also use **Provision on demand** in the Provisioning blade to trigger a manual sync.  

  ![scim entra test connection](https://cdn.sanity.io/images/2w8agf2t/production/3be32e8ce6f5f07703073e3e059acd749abcdc5e-426x335.png)

- For seamless access, ensure the same users/groups are also assigned to your **Row Zero SSO** application (if SSO is configured). Note that SSO gates access to the Row Zero application for your enterprise while SCIM enables typeahead to easily share / restrict workbooks with your company's defined users and groups.

---

## Frequently Asked Questions

### For Microsoft Entra why does SCIM provisioning use an Enterprise Application?

- SCIM provisioning in Microsoft Entra is configured at the **Enterprise Application** level.
- This is where you connect Row Zero’s SCIM endpoints, provide your SCIM bearer token, and map attributes.
- Users and groups assigned to the Enterprise Application will be automatically synced to Row Zero _**for the type-ahead feature to share workbooks**_, users and groups configured via SSO gate the actual _**access**_ to the Row Zero application.
- Entra does not allow you to configure SCIM provisioning directly on an **App Registration** (which is required for SSO): [Automatic provisioning isn’t available on my OIDC-based application](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/known-issues?pivots=app-provisioning#automatic-provisioning-isnt-available-on-my-oidc-based-application)

### Why is Row Zero not in the Microsoft Gallery?

- Microsoft maintains a gallery of pre-integrated applications for SSO and provisioning but at this time has paused new submissions: [Learn more about the app gallery listing process](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/v2-howto-app-gallery-listing)