This page explains how to set up user and team provisioning with SCIM using the Client Credentials authentication method, which is required for Microsoft Entra. For an overview of SCIM functionality, see Managing users and teams with SCIM provisioning. If you use a different identity provider, see SCIM Setup with Authorization Code (Okta) or SCIM Setup with Google Workspace Directory Sync.
Step-by-Step Instructions
Please make sure to follow these steps carefully, as a misconfiguration may prevent the integration from working or result in unexpected provisioning behavior.
Step 1: Generate SCIM Credentials in Read AI
-
Go to Workspace Settings and expand the Advanced section.
-
Turn on the Enable SCIM Provisioning setting.
-
Select the OAuth 2.0 Client Credentials option.
-
Click Generate Credentials to obtain your Client ID and Client Secret (copy these; the secret is only shown once and will need to be regenerated if you lose it).
-
Note the Tenant URL and Token URL. You'll also need these later.
-
Decide whether you want license auto-charge to be enabled. If disabled, provisioning will fail and throw errors in Entra whenever you run out of available licenses in your workspace. You can configure a limit for the maximum number of seats your workspace can reach via auto-charge (more can always be purchased manually).
Step 2: Configure SCIM in Microsoft Entra
-
In the Entra admin portal, go to Enterprise apps (under Entra ID in the left side menu).
-
Create a New application for Read AI.
-
Click Create your own application, provide a name (e.g. "Read AI SCIM"), and make sure to select Integrate any other application you don't find in the gallery (Non-gallery). Do not use the Read AI app from the gallery.
- Click Create (it may take a minute or so for Entra to create the application).
-
Click Provisioning.
-
Click New configuration.
-
For the authentication method, select OAuth2 client credentials grant.
-
Now you'll need to paste the Tenant URL, Token URL, Client ID, and Client Secret from your Read AI workspace settings into the corresponding fields.
-
Select Body under How credentials are sent.
-
Click Test connection and you should eventually see a notification in the top right that your test was successful.
- Click Create at the bottom to save the configuration (may take a minute or so to finish).
Step 3: Attribute Mapping
-
Click on Provisioning (the mode should be set to Automatic).
-
Expand Mappings and click on Provision Microsoft Entra ID Groups.
- Decide whether you want your Entra groups to become teams in Read AI.
- To provision teams: leave Enabled set to Yes (the default) and leave the default attribute mappings (displayName, members, objectId) unchanged. Note that any existing Read AI team whose name matches a group will become IdP-managed, and its membership will be replaced by the group's. To learn more about this feature, see Team Provisioning.
-
For users only: set Enabled to No. Groups assigned to the application will still provision their members as users, but no teams will be created.
-
Click Save and then Yes to confirm.
- Click the X in the top right or the link in the top navigation to return to the Provisioning page.
-
Click Provision Microsoft Entra ID Users.
- Under Attribute Mappings, you must delete all attributes except for:
- userName
- active
- emails[type eq "work"].value
- name.givenName
- name.familyName
-
externalId
-
Click Save and then Yes to confirm.
- Click the X in the top right or the link in the top navigation to return to the Provisioning page.
-
Click Attribute mapping (Preview) to confirm that Users is enabled, and that Groups matches the choice you made in step 3.
Step 4: Select Users and Groups to Sync
-
Click on Users and groups.
-
Use Add user/group to assign individual users and/or groups to the application (these are the people you want to authorize to use Read AI).
- Only the users you assign here (individually or through an assigned group) will be provisioned and managed by SCIM/Entra.
- If group provisioning is enabled, every group you assign here also becomes a team in Read AI, named after the group. Only a group's direct members are provisioned — membership does not cascade into nested groups. Users provisioned through a group may not appear individually in the assigned users list.
Step 5: Complete and Monitor Provisioning
-
Click Overview (Preview) and then Start provisioning.
- Provisioning runs automatically every ~40 minutes, creating and deactivating users in your Read AI workspace as necessary to keep it in sync with your Entra application. If you enabled group provisioning in step 3, teams and their membership sync on the same cycle.
- You can monitor sync status and errors in Entra. We will also send you email notifications if users fail to get provisioned for any reason.
Notes and Troubleshooting
Make sure to review the notes here to fully understand how SCIM provisioning works, and if you have any issues, check the troubleshooting tips.
Some notes specifically related to provisioning with Entra ID Groups:
- Unassigning a group deletes the corresponding team in Read AI, revoking access to any reports shared with that team.
- Setting the Groups mapping back to No leaves existing teams in place, but Read AI stops receiving updates. So the team would remain IdP-managed without a way to change its membership, unless you disable SCIM provisioning entirely (see below).
- Unassigning a user who still belongs to an assigned group has no effect — they remain provisioned. A user who is unassigned and removed from all assigned groups is deactivated in Read AI.
To return all users and teams to manual management, simply disable SCIM provisioning in your Read AI workspace settings. All teams and users will remain as-is but stop being IdP-managed.
For detailed attribute mapping and advanced scenarios, see the official Microsoft Entra SCIM documentation.