How to Configure and Test SCIM Provisioning with Microsoft Entra ID

SCIM connects an identity provider to an Apidog organization so administrators can add and remove organization users through the identity lifecycle. Provisioned users remain inactive until they sign in with the organization's SSO identity.

This tutorial configures Microsoft Entra ID for Apidog SCIM, verifies provisioning, and provides a controlled test for user removal.

Before you start

You need:

• an Apidog Enterprise organization;
• SAML authentication already configured for that organization;
• Organization Owner or Organization Admin access in Apidog;
• administrator access to the Microsoft Entra enterprise application;
• a disposable test account for provisioning and removal tests.

Current Apidog documentation lists the following SCIM support:

SAML group mapping is a separate feature for mapping identity-provider groups to Apidog teams.

Step 1: Confirm the SAML identifier

Microsoft Entra must use a stable identifier that matches the SCIM mapping.

In the Entra enterprise application used for Apidog:

1. open Single sign-on;
2. edit Attributes & Claims;
3. open Unique User Identifier (Name ID);
4. set the Name ID format to Persistent;
5. set the source attribute to user.objectid;
6. save the change.

If the application is already in use, test this change with a pilot user before applying it broadly.

Step 2: Generate the SCIM token in Apidog

1. Open the Apidog organization settings.
2. Go to the SAML SSO page.
3. Select Generate a SCIM token.
4. Copy the SCIM token.
5. Copy the SCIM API endpoint URL.

Generate the token from the organization that Microsoft Entra should provision.

Treat the SCIM token as a credential. Store it in the approved secret-management system and do not place it in screenshots, tickets, or shared notes.

Step 3: Configure automatic provisioning in Microsoft Entra ID

1. In Microsoft Entra ID, open Enterprise applications.
2. Select the application used for Apidog.
3. Open Provision User Accounts, then select Get started.
4. Set Provisioning Mode to Automatic.
5. Paste the Apidog SCIM API endpoint into the tenant URL field.
6. Paste the SCIM token into the secret token field.
7. Test the connection.
8. Save only after the connection test succeeds.

Use the endpoint and token generated by the same Apidog organization.

Step 4: Configure the attribute mappings

Open the provisioning mappings for the enterprise application.

1. Disable Groups Mapping.
2. Open Users Mapping.
3. Remove the default externalId mapping.
4. Map Entra objectId to SCIM externalId with matching precedence 1.
5. Add a mapping from userPrincipalName to userName.
6. Remove the other mappings so only the required mappings remain.
7. Save the configuration.

The documented mapping uses objectId for externalId and userPrincipalName for userName.

Do not enable SCIM group push for this integration. Apidog does not currently support SCIM groups.

Step 5: Start provisioning and verify the user

1. Return to the Entra provisioning overview.
2. Select Start provisioning.
3. Assign the disposable test user to the application if required by your Entra configuration.
4. Wait for the provisioning cycle or use an approved on-demand test.
5. Open the Apidog organization's member list.
6. Confirm that the user appears in a provisioned or inactive state.

A provisioned user does not occupy a paid seat until the user signs in through SSO and becomes active.

Next, have the test user sign in through the organization's SSO entry point. Confirm that the account is linked to the SSO identity, becomes active, and occupies a seat.

Microsoft's synchronization interval is documented by Apidog as approximately 40 minutes. Treat this as an estimate, not a service-level guarantee.

Step 6: Test user removal before rollout

Identity providers can expose several offboarding actions, including unassignment, disablement, and deletion. Do not assume that these actions produce the same SCIM request.

Use a controlled test:

1. confirm that the disposable user is active in the intended Apidog organization;
2. record the user's organization and team memberships;
3. apply the exact Microsoft Entra offboarding action your organization plans to use;
4. wait for provisioning to process;
5. confirm the provisioning result in Entra;
6. confirm that the linked user has been removed from the corresponding Apidog organization;
7. review the organization's Audit Logs for the SCIM deprovisioning or member-removal event;
8. confirm that the user can no longer enter that organization through SSO.

Apidog's general SCIM documentation states that when an enterprise administrator deletes a user from the identity provider, a linked user is removed from the corresponding Apidog organization. The current Microsoft Entra setup page does not document the result of every Entra offboarding action. Validate the action used by your tenant before making SCIM the only offboarding control.

Removal from an Apidog organization is not the same as deleting the person's entire Apidog account or removing access from unrelated organizations and external systems.

Verify the lifecycle workflow

Before production rollout, verify all four states with disposable accounts:

Also define a manual removal path for failed or delayed provisioning.

Troubleshooting

Important limitations

SCIM manages membership in the corresponding Apidog organization. It does not remove credentials issued by other systems, repository access, cloud roles, gateway permissions, or production API keys. Include those systems in the same offboarding checklist.

Related API governance tutorials:

These tutorials cover complementary controls for governing an enterprise API workspace:

• API Governance Framework — connect ownership, controls, evidence, and lifecycle decisions.
• SAML Group Mapping with Microsoft Entra ID — assign team access from identity-provider groups.
• Secret Scanner — review possible exposed credentials in supported Apidog assets.
• Audit Logs — investigate and export administrative organization activity.
• SCIM Provisioning — manage organization users through the identity lifecycle.
• Enterprise Policies — configure credential, membership, SSO-session, and invitation controls.
• Self-Service API Teams — allow member-created teams while retaining ownership oversight.
• GitHub Enterprise Cloud Integration — connect supported GHE.com repositories for OpenAPI workflows.

Related official documentation:

• Introduction to SCIM Provisioning
• Microsoft Entra ID SCIM Setup
• Okta SCIM Setup
• Mapping Groups to Teams
• Audit Logs