Navigation
10.19. Provision Internal Users from Microsoft Entra with SCIM 2.0
Connect Microsoft Entra to AlgaPSA over SCIM 2.0 so deactivating a staff member in your directory deactivates their AlgaPSA account and revokes their sessions immediately.
When someone leaves an MSP, the offboarding checklist is long and the PSA is rarely at the top of it. That account keeps its ticket access, its client data, and its session until somebody remembers. SCIM provisioning removes the checklist item entirely: deactivate the person in Microsoft Entra and AlgaPSA deactivates them too, revoking their sessions immediately.
SCIM user provisioning is available on Pro, behind a feature flag.
What SCIM does and does not control
The scope here is deliberately narrow, and understanding it prevents most of the confusion this feature causes.
| Entra controls | AlgaPSA remains authoritative for |
|---|---|
| Whether an internal user is active | Profiles |
| Reactivating a previously deactivated user | Roles and permissions |
| Teams | |
| License assignment |
Entra drives the lifecycle. It does not drive who is an administrator, which team someone dispatches for, or how many seats you consume. A directory group is the wrong place to decide that a technician can finalize invoices, and AlgaPSA does not let it.
This also means SCIM operates on existing internal users. It is a deactivation and reactivation channel, not a bulk user-creation route — for adding staff, use email invitations.
For client portal users, the equivalent capability is client portal SSO, which is a separate feature with separate switches.
Setting up the connection
Navigate to Settings > Security > User provisioning.
Figure 1: The SCIM connection. The tenant URL and token go into the Provisioning section of your Entra enterprise application.
In AlgaPSA
- Open Settings > Security > User provisioning.
- Copy the Tenant URL. It is unique to your tenant and takes the form
https://app.algapsa.com/api/scim/v2/<connection-id>. - Generate the secret token and copy it. Store it somewhere you can retrieve it — it is shown once.
In Microsoft Entra
- Open your AlgaPSA enterprise application in Entra.
- Go to Provisioning and set the mode to Automatic.
- Paste the Tenant URL and the secret token as the admin credentials.
- Test Connection, then save.
- Assign the users and groups that should be in scope.
Attribute mapping
Keep the Entra defaults. AlgaPSA expects userName, externalId, active, names, title, and emails — and of these, only active controls AlgaPSA access.
| Setting | Value |
|---|---|
| Initial match | Exact primary email only |
| Provisioning scope | Assigned users and groups |
| Not supported | Groups, passwords, roles, teams |
Initial match is exact primary email only. A directory user whose primary email does not exactly match an existing AlgaPSA user will not link. This is the single most common setup problem; resolve it by correcting the email on one side rather than by loosening the match, which is not configurable by design.
Entra will attempt to sync groups, passwords, roles, and teams if you map them. AlgaPSA ignores those attributes. Leave them unmapped so the Entra provisioning log stays clean and genuine failures remain visible.
Connection health
The Connection health panel reports the last authenticated request, the last successful sync, and when the current token was created. Entra provisioning cycles run roughly every 40 minutes, so a "last success" older than an hour is worth investigating.
Pausing
Accept provisioning requests turns the connection off without dismantling it. Pausing preserves every user link and the current state of every user — nothing is deactivated, nothing is unlinked, and requests from Entra are simply refused until you resume.
Pause it when you are making a large directory change and do not want it mirrored into AlgaPSA mid-flight.
Rotating the token
Rotate token issues a new secret without breaking the links between directory identities and AlgaPSA users. Rotate on your normal credential schedule, or immediately if the token may have been exposed.
Rotation invalidates the old token straight away, so update Entra in the same maintenance window or provisioning will fail until you do.
Managed users
The Managed users table lists every AlgaPSA user under SCIM control, the directory identity each is linked to, and the current state. Use it to confirm a link before you rely on it, and to spot users you expected Entra to manage that it does not.
A user who is not in this list is not managed by Entra — deactivating them in the directory will do nothing to their AlgaPSA account.
What happens on deactivation
When Entra marks a user inactive:
- The AlgaPSA account is deactivated.
- Active sessions are revoked immediately, rather than expiring naturally.
- The user's ticket, project, and time-entry history is retained in full.
- The action is written to the audit log.
Reactivating in Entra reverses the first two steps and restores the account with its previous roles and teams.
Audit evidence
All connection actions — token rotation, pausing, resuming, and every provisioning decision — are audit-logged. For MSPs answering a SOC 2 or Cyber Essentials question about joiner-mover-leaver controls, this log is the evidence that offboarding is enforced by a system rather than by a checklist.