Use a non-gallery enterprise application in Microsoft Entra ID to create, update, and deactivate Studio members. Configure single sign-on separately for authentication.
Before you start
- An Enterprise organization in Studio, with an owner or administrator who can manage provisioning.
- Each user email domain verified in Studio.
- An Entra administrator who can create enterprise applications and manage provisioning.
- A Studio deployment reachable by Entra over HTTPS. Self-hosted deployments must also meet the SCIM rollout requirements.
Automated user provisioning is available with Entra ID Free. Group provisioning and group-based application assignment require Entra ID P1 or higher. See Microsoft's licensing comparison.
Start with dedicated test users. Provisioned members use a seat and receive workspace access only through a mapping or an existing grant.
Connect Entra to Studio
Enable provisioning in Studio
Open Settings → Organization → Single sign-on → Provisioning and turn on Enable directory provisioning. Copy the Base URL from Connection. Under Tokens, choose an expiry and select Issue token. Copy the token before closing its dialog; Studio shows it once.
Create the enterprise application
In Microsoft Entra ID, open Enterprise applications → New application → Create your own application. Enter a name, such as Studio provisioning, select Integrate any other application you don't find in the gallery (Non-gallery), and select Create.
Configure the connection
In the new application's Provisioning page, select New configuration. Choose Bearer authentication and enter:
| Field | Value |
|---|---|
| Tenant URL | The HTTPS Base URL copied from Studio, ending in /api/scim/v2 |
| Secret token | Your Studio token, without a Bearer prefix |
Select Test connection, then Create after the test succeeds. Entra adds the bearer prefix itself. A successful connection test verifies connectivity and authentication; continue with a test assignment to verify provisioning.
These steps use Entra's current provisioning experience. In the legacy experience, choose Automatic provisioning, enter the same credentials under Admin Credentials, test the connection, and save. See Microsoft's SCIM configuration guide.
Limit the scope and review mappings
Under the provisioning configuration's Properties, keep Scope set to Sync only assigned users and groups. Review accidental deletion protection before broadening the rollout.
In the application's Users and groups, select Add user/group, choose a test user, and select Assign. On the Free plan, assign users individually.
Under Attribute mapping, review the user mappings. The defaults map userPrincipalName to userName, mail to the work email, and displayName to displayName. Use a valid email address from a verified Studio domain; if your UPN differs from the user's email, adjust the mappings before provisioning. Keep userName as the matching attribute.
If Mail is empty, Entra omits the work email and Studio uses userName as the account email. That UPN must be a valid email address in a verified Studio domain.
Verify a user lifecycle
Open Provision on demand, search for the assigned test user, and select Provision. Review the import, scope, matching, and action results. In Studio, confirm that the member appears under Organization → Members and that Single sign-on → Provisioning → Activity shows successful requests.
Change the test user's display name in Entra and provision them again. Confirm the new name in Studio. Repeating provisioning without changes should report that the source and target already match.
Remove the test user's app assignment, then run on-demand provisioning for that user again. Confirm that Studio deactivates the existing member. Reassign the user and provision again to verify reactivation of the same account. Assignment changes can take a few minutes to become available to provisioning.
Studio deactivation suspends access while retaining organization membership, ownership, and the seat. For users still managed by the provisioning job, soft deletion deactivates the Studio member and permanent deletion sends a SCIM DELETE that removes organization membership. Entra normally permanently deletes users 30 days after soft deletion, or sooner if an administrator purges them. After app unassignment, Entra stops managing the user and does not send a later directory deletion. See Microsoft's deprovisioning lifecycle and Studio's deactivation behavior.
Disabled or deleted Entra users cannot be selected for on-demand provisioning. Start automatic provisioning and complete the initial cycle before testing those changes through a scheduled cycle. See Microsoft's on-demand limitations.
Provision groups and map access
With Entra ID P1 or higher, create a dedicated security group with Assigned membership and add your test users as direct members. Assign that group to the enterprise application under Users and groups. Review the group mapping under Attribute mapping and keep group provisioning enabled.
Run Provision on demand for the group and select its test members, or wait for a scheduled cycle. On-demand provisioning supports one group with up to five selected members at a time. Nested group membership is not supported; see Microsoft's assignment guidance.
Once the group appears under Single sign-on → Provisioning → Group mappings in Studio, map it to a workspace, permission group, or the organization admin role. Start with a workspace mapping and confirm that the test members gain access.
Remove a test user from the group while keeping a separate direct app assignment. After the group membership sync, confirm that the directory workspace grant is withdrawn while the user remains an active organization member. Add them back and verify that access returns. Read how Studio withdraws directory access before mapping groups that overlap with existing manual access.
Start automatic provisioning
After the test succeeds, return to the provisioning Overview and select Start provisioning. Wait for the initial cycle to complete and inspect Provisioning logs for failures. Entra normally runs subsequent cycles about every 40 minutes; changes are not immediate. See Microsoft's provisioning lifecycle.
Keep the scope limited to assigned users and groups as you add more members. Use Provision on demand for a small test; use the regular cycle to verify directory account disablement and deletion.
During a scheduled lifecycle test, leave the job running after changing the test user. Restart provisioning clears the change watermark and begins a new initial cycle; changing mappings or scoping filters also resets it. Wait for the incremental cycle and inspect that user's provisioning log before making further changes.
Rotate the token
Issue a replacement token in Studio while the current token remains active. In Entra, open the provisioning configuration's Connectivity page, replace Secret token, select Test connection, and save. Confirm a successful provisioning request before revoking the old token in Studio. Studio allows two active tokens so rotation can overlap.
Troubleshooting
| Symptom | Check |
|---|---|
| Connection test fails | Enter only the token in Secret token. Check the complete HTTPS Tenant URL, token expiry, and whether provisioning is enabled in Studio. |
| User is out of scope | Assign the user to this enterprise application and check the provisioning scope and scoping filters. Allow time for assignment changes to propagate. |
| User creation fails | Verify the email domain in Studio, available seats, and whether the account belongs to another Studio organization. Review the mapped UPN and work email. |
| Repeat provisioning reports Skipped | Inspect the reason. RedundantExport means the source and target already match. |
| Directory disablement or deletion has not reached Studio | Check the user's scheduled provisioning log, the IsSoftDeleted mapping to active, enabled Update actions, and accidental deletion protection. Confirm Skip out of scope deletions is disabled. A successful connection test alone does not verify a lifecycle change. |
| Group assignment is unavailable | Check your Entra license. The Free plan supports individual user assignment but requires an upgrade for group assignment and provisioning. |
| Member has no workspace access | Provision the directory group and add a workspace mapping in Studio. User provisioning creates organization membership. |
| Disabled member still uses a seat | Studio suspends access on deactivation. Removing organization membership is a separate offboarding action. |
Use Entra's Provisioning logs and Studio's Provisioning → Activity to inspect failures. Invalid or revoked tokens appear only in Entra because Studio cannot associate those requests with a connection.