> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://docs.brainframe.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Automated provisioning using Microsoft Entra and SCIM

# Automated provisioning using Microsoft Entra and SCIM
This page describes how you can automatically create Brainframe users and/or Brainframe contacts (with group tags) based on your Identity provider users and groups configured in Microsoft Entra. 
We have built the SCIM user provisioning in such a way that none of your existing user/group configurations will be impacted. The IdP users/groups will be synced independently from existing entities, and the system will "link" these identities together based on rules explained in this documentation (e.g. if they are part of the brainframeUser or brainframeContact groups in your IdP)

## 1️⃣ Create the Application
(this step can be skipped if you already created an application for SSO)

1. Go to the **Entra admin center** → [__https://entra.microsoft.com/#home__](https://entra.microsoft.com/#home) and click **New application**.
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_108p6wc.png)


2. Select **Create your own application**.
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_fqedah.png)


3. Enter a **name** for your application, choose **Non-gallery application**, and click **Create**.

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_4zr979.png)

| 📌 Tip: Use a descriptive name (e.g., Brainframe GRC SSO) to make it easily identifiable.


## 2️⃣ Configure the Entra Application

1. Go to **Provisioning menu**
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1j11m88.png)

2. Click **New configuration**
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_dm4wmd.png)

3. Fill in the **tenant URL** and **secret code** from the Brainframe GRC user provisioning settings
Go to Brainframe GRC > Workspace Settings > User provisioning, and enable SCIM. This will show you the **SCIM URL** and **Token **that needs to be configured. These will allow your IdP to authenticate to Brainframe for automated provisioning of the IdP users and groups assigned to the Entra application. 

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-21014_1fix1qj.png =925xauto)
Keep "Bearer authentication" as authentication method, and **fill in the URL and token in Microsoft Entra**. Then click on **Test connection**, and if all worked well you should get a confirmation of success.
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_p58am5.png)
Now click on **Create **at the bottom of the screen, which will setup the provisioning part in Entra for this application.
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_vjxkps.png)

## 3️⃣ Configure the provisioning mapping
In order to correctly map the values of your Idp users and groups to what is expected in Brainfame GRC, we need to ensure the IdP attribute mapping is correctly configured.

**Attribute mapping of user:**
Select attribute mapping from the application you created in the previous steps, and select Provision Microsoft entra ID **Users**
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1k38588.png)

The next page will have many details that are aligned with your company defaults, and from the Brainframe side we only need you to ensure that the following app attributes (target sent to Brainframe) are mapped to the Microsoft Entra ID attributes (source from your identities).

Ensure the following target actions are enabled: **Create, Update and Delete**

| Brainframe Target attribute | Microsoft Entra ID source attribute | Description |
| ---- |
| userName | userPrincipalName | Typically mapped to the email of your users |
| externalId | objectId | The unique identifier to link IdP users between the two systems |
| active | accountEnabled | Indicates if the account is enabled or not and will disable users/remove contacts |
| name.givenName | givenName | The first name of the user |
| name.familyName | surname | The family name of the user |
| emails[type eq "work"].value | mail | This will be the email that will be used for all communications and username to workspace mapping during login |
| preferredLanguage | preferredLanguage |  |



Click save on top of the screen

**Attribute mapping of group:**
Select attribute mapping again from the application you created, and select Provision Microsoft entra ID **Groups**
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_okxlzj.png)
Ensure the following target actions are enabled: **Create, Update and Delete**

| Brainframe Target attribute | Microsoft Entra ID source attribute | Description |
| ---- |
| displayName | displayName | This will be the name of the group how it will be shown in Brainframe under SCIM groups (which can then be linked to Brainframe groups) |
| externalId | ObjectId | The unique identifier to link IdP groups between the two systems |
| members | members | List of members from the group |


## 4️⃣ Create dedicated brainframe groups in your IdP
The automated provisioning will be used to create a Brainframe user and/or a Brainframe contact, depending on if the user is part of a group called "brainframeUser" and/or "brainframeContact". 
||| If user are not part of any of these groups, they will be synchronised, but inside Brainframe nothing will happen

Still inside Microsoft entra, create 2 groups "brainframeUser" and "brainframeContact" by clicking All groups > New group with default values (no need to assign any users yet, we'll do this during the testing step below)

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_hptmlz.png)

Now open the Enterprise app again that you created in the beginning of this document, and assign these two groups to application by clicking "Users and groups" > "Add user/group"

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1d3chxr.png)
Then add both groups "brainframeUser" and "brainframeContact" and click select

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1bxse4.png)



## 5️⃣ Test the Brainframe contact creation
In this section we'll show you how to create a contact that can receive (auto) distributions. These contacts will never be able to log in unless they are also part of the brainframeUser group
Inside the enterprise application, again select Users and groups, and click on brainframeContact .

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_9lsbr3.png)
Add individual users or for contacts it might be interesting to 
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1is72ou.png)
Now again select your Enterprise application, and select the provisioning menu 
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1rmbnu2.png)



To force test the provisioning of the brainframeContact group, you select "Provision on demand", and select the "brainframeContact" group
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_uw6lfq.png)

Then select the checkbox for the actual members to sync and click **provision** at the bottom of the page

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1s9tlbe.png)
When successful, you will now see in Brainframe the user appear in the Workspace settings > User provisioning menu. The IDP group brainframeContact will not appear, because that is a special group that can not be mapped to Brainframe groups
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-21021_jxqh0u.png)
The user has now also been added to the Brainframe contacts (you might need to refresh the page to see them)
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-21024_1yc0osy.png =689xauto)

| Notice above that the Tags are empty. If you select any other company department group (e.g HR or Development) and assign them to the Enterprise application, these will be auto synced and created as Tags on the contact. These tags then allow you to auto trigger a distribution email being sent to people of a specific department.

Here is an example after doing a provision on demand of a "Human resources" group like we did before
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_upbmdx.png)
Which will result in the IDP group being synced: Tag being added to the contact (because the user is part of brainframeContact group), which can potentially trigger an automated distribution being sent if this tag is configured in the distribution with auto send


## 6️⃣ Test the Brainframe user creation

|| Attention, Brainframe users created through the actions in this section cannot be removed, as we only allow disabling created users. So test this initially with individual users

In this section we'll show you how you can create an actual Brainframe user.
Similar to how we proceeded in step 4, the only thing we need to do is to add a specific user to the brainframeUser group, and trigger a provision on demand. 



First we add the user to the brainframeUser group

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_34y2tm.png)
Then we need to add the brainframeUser group to the enterprise application (else it won't sync users from that group)

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1cmef77.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_1mqmif7.png)



Then we can trigger the provisioning of that brainframeUser group on the same enterprise application to push the results to Brainframe.

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_155ue5f.png)


|| **Attention, in the next step the user will immediately receive an invite to the workspace per mail, so make sure LDAP SSO is also configured so they can actually log in. They will not be allowed to log in with user/password and can not reset their credentials. In case the user already existed in the workspace, the IDP user will be linked with the existing Brainframe user without making any changes to it (if they had password login enabled before, it will remain).**

Then you select the user to provision, and click **provision **
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image_16i2wk.png)
If all went well, the user should now have been added/linked to IDP with password login Disabled (you might need to refresh the page to see the update)


## 7️⃣ IDP SCIM group mapping to Brainframe Groups
Because Brainframe groups are linked to folder permissions that can be replicated to different workspaces, and because every company has different IdP group names, we built the group mapping using SCIM provisioning in such a way that you can configure per workspace which IdP group will be mapped to which Brainframe group.


By clicking the edit button on the right of IDP Group "Human resources", you can map this IdP group to a Brainframe group