> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://zuora.ferndocs.com/docs/platform/security-and-identity/oneid-identity-and-access-management/setup-sso-with-microsoft-entra-id-using-saml-in-oneid/enable-provisioning-using-scim-api-for-microsoft-entra-id/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server. # Enable provisioning using SCIM API for Microsoft Entra ID > Learn how to configure System for Cross-domain Identity Management (SCIM) 2.0 provisioning in Microsoft Entra ID to automatically manage Zuora users and groups through Zuora OneID. Learn how to configure System for Cross-domain Identity Management (SCIM) 2.0 provisioning in Microsoft Entra ID to automatically manage Zuora users and groups through Zuora OneID. * You are an administrator in both Microsoft Entra ID and Zuora OneID. * Your custom SAML application is active and working for single sign-on (SSO). To set up the application, see [Set up SSO with Microsoft Entra ID using SAML in OneID](/docs/platform/security-and-identity/oneid-identity-and-access-management/setup-sso-with-microsoft-entra-id-using-saml-in-oneid). * If your provisioning scope is restricted to assigned objects only, the required users or groups are assigned to the enterprise application. * Your custom SAML application has the required attributes configured for SCIM provisioning. * You have created an OAuth 2.0 client in Zuora OneID to generate the client identifier and client secret that Microsoft Entra ID uses to authenticate requests to the OneID SCIM API. For more information, see [Manage OAuth 2.0 clients](/docs/platform/security-and-identity/oneid-identity-and-access-management/manage-oauth-20-clients). System for Cross-domain Identity Management (SCIM) 2.0 is a standard that enables Microsoft Entra ID to automatically manage your users and groups in Zuora. When you add or remove a user in Microsoft Entra ID, the change is applied in Zuora through the Zuora OneID service. Although Zuora OneID is not listed as an official Microsoft Entra ID marketplace application, you can integrate SCIM provisioning by using the same custom SAML application that you created for SSO. After the application is configured for SSO, you can enable SCIM provisioning within the same application. In the Microsoft Entra ID admin center, open your custom SAML application, and then in the left menu, click **Provisioning**. Click **Get started**, and then set **Provisioning Mode** to **Automatic**. Under **Admin Credentials**, enter the following Zuora SCIM values: | Field | Value | | ----------------------------------- | ------------------------------------------------- | | Authentication Method | OAuth2 Client Credentials Grant | | Tenant URL | `https://one.zuora.com/scim/v2/?aadOptscim062020` | | Token Endpoint | `https://one.zuora.com/oauth2/token` | | Client Identifier and Client Secret | The values that you created in Zuora OneID. | > **Note** > > The `?aadOptscim062020` parameter is required in the **Tenant URL**. > > By default, Microsoft Entra ID sends SCIM PATCH requests in a legacy format that is not SCIM 2.0 compliant. For example, it capitalizes operation values, sending `"op": "Add"` instead of `"op": "add"`. The Zuora SCIM endpoint rejects these requests with a `400 Bad Request` JSON parse error, and group membership updates fail. Appending `?aadOptscim062020` to the **Tenant URL** instructs Entra ID to send SCIM 2.0-compliant requests. > > Keep this parameter in the **Tenant URL** permanently. It is not a temporary workaround. Click **Test Connection** to confirm that Microsoft Entra ID can connect to Zuora. Save your settings, and then review **Mappings** to confirm that user information, such as email and name, is sent correctly. Keep the default user mappings unless the application vendor recommends a different schema. Confirm that **Provision Microsoft Entra ID Groups** is enabled if you intend to provision groups. Group membership can only be applied to users that already exist in Zuora, so the members of a provisioned group must also be in scope for the application. Set **Provisioning Status** to **On** to start automatic synchronization. Click **Save**. Microsoft Entra ID begins provisioning the assigned users and groups to Zuora OneID. The initial synchronization can take several minutes to complete, depending on the number of objects in scope. Validate that Microsoft Entra ID provisions users and group memberships to Zuora correctly: 1. To validate individual user creates, select **Provision on demand** and select a test user. 2. Set **Scope** to **Sync only assigned users and groups**, and then assign a single test group. Limiting the scope reduces the size of the synchronization cycle, so results appear faster. 3. Select **Restart provisioning** to start a fresh synchronization cycle. 4. Review the results in **Provisioning logs**. > **Note** > > The `?aadOptscim062020` parameter does not apply to **Provision on demand**. Microsoft documents this limitation. On-demand requests are sent in the legacy format, so on-demand group membership updates fail against Zuora with a JSON parse error even when your configuration is correct. Validate group membership through a full synchronization cycle instead. > > For more information, see [Known issues and resolutions with SCIM 2.0 protocol compliance of the Microsoft Entra user provisioning service](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility) in the Microsoft Entra documentation. > Learn how to configure System for Cross-domain Identity Management (SCIM) 2.0 provisioning in Microsoft Entra ID to automatically manage Zuora users and groups through Zuora OneID. ## Docs - [Assign users and groups for Integrating Microsoft Entra ID with Zuora](https://zuora.ferndocs.com/docs/platform/security-and-identity/oneid-identity-and-access-management/setup-sso-with-microsoft-entra-id-using-saml-in-oneid/enable-provisioning-using-scim-api-for-microsoft-entra-id/assign-users-and-groups-for-integrating-microsoft-entra-id-with-zuora.md): Learn how to assign a user or group to an application in Microsoft Entra so that the application can provision the assigned objects. - [Push a user or group manually](https://zuora.ferndocs.com/docs/platform/security-and-identity/oneid-identity-and-access-management/setup-sso-with-microsoft-entra-id-using-saml-in-oneid/enable-provisioning-using-scim-api-for-microsoft-entra-id/push-a-user-or-group-manually.md): Learn how to run an on-demand provisioning action to test a single user or group without waiting for the next automatic synchronization cycle.