This guide will walk you through setting up SCIM (System for Cross-domain Identity Management) integration between Microsoft Entra ID and the Right-Hand platform for automated user provisioning.
Prerequisites
Before you begin, confirm you have:
Administrator access in Microsoft Entra ID, with permission to create and configure Enterprise Applications (Global Administrator or Application Administrator role).
Administrator access in the Right-Hand platform, with permission to access Company Management > Employees.
Confirmation that no other SCIM provider is actively provisioning to this Right-Hand platform account. Only one SCIM connection should be active at a time - running two simultaneously can cause conflicting updates.
Step-by-Step Instructions
Step 1: Generate your SCIM credentials in the Right-Hand platform
1.1 In the Right-Hand platform, go to Company Management > Employees.
1.2 In the top right corner, click Import, then select SCIM.
1.3 Toggle on Enable SCIM Provisioning.
1.4 Copy the Webhook URL (this is your Tenant URL in Entra ID) and the Token (this is your Secret Token in Entra ID). You'll enter both in Step 3.
Keep this window open in a separate tab. You may need to return to it.
Step 2: Create the Enterprise Application in Microsoft Entra ID
2.1 Log in to the Azure Portal and click Microsoft Entra ID from the list of Azure services.
2.2 In the left panel, under Manage, click Enterprise Applications.
2.3 Click New Application.
2.4 Click Create your own application.
2.5 Name the application Right-Hand SCIM, select Integrate any other application you don't find in the gallery (Non-gallery), then click Create.
2.6 Once the application is created, click Get Started under Provision User Accounts.
2.7 On the Overview page, click + New Configuration.
Step 3: Enter your credentials and test the connection
3.1 In the provisioning configuration screen, paste the Tenant URL and Secret Token you copied from the Right-Hand platform in Step 1.
3.2 Click Test Connection. You should see a successful connection message in the top right corner of the screen.
Expected result: a success message confirms Entra ID can reach the Right-Hand platform. If it fails, double-check that the Tenant URL and Secret Token were copied in full, with no extra spaces.
Once the test succeeds, click Create.
Step 4: Configure attribute mapping for users
4.1 Go to Provisioning under the Manage tab.
4.2 Click the Mappings drop-down.
4.3 Under Mappings, select Provision Microsoft Entra ID Users.
4.4 Review the attribute list. Delete any attributes your organization doesn't need, keeping only the ones you intend to sync to the Right-Hand platform. The table below shows the attributes the Right-Hand platform supports and how each one is used:
4.5 Click Save.
Microsoft Entra ID does not propagate null or empty attribute values to downstream applications. If an attribute is cleared in Entra ID, the update will not be sent to the Right-Hand platform and the existing value will be retained.
Example: If a user has Department, Office Location, Job Title, and Employee Type populated in the Right-Hand platform, and all four fields are subsequently cleared in Entra ID, the Right-Hand platform will continue to display the previously synced values. To remove an attribute value, you must update it directly in the Right-Hand platform.
For more information, see Microsoft's documentation on null attribute provisioning behavior.
Step 5: Configure attribute mapping for groups
5.1 Go to Provisioning under the Manage tab.
5.2 Click the Mappings drop-down.
5.3 Under Mappings, select Provision Microsoft Entra ID Groups.
5.4 Delete any unnecessary attributes and keep only the ones that the application will use.
5.5 Click Save.
Step 6: Assign Users and groups
6.1 Return to the application and select Users and groups.
6.2 Click Add User/Group.
6.3 Click None Selected under Users and groups, then search for and assign the users and/or groups you want provisioned to the Right-Hand platform.
Step 7: Test with Provision on Demand
Before activating full provisioning, test with a single user first.
7.1 Go to the Provisioning section.
7.2 At the top, click Provision on demand.
7.3 Select the specific user (or group) you want to test - they must already be assigned to the application from Step 6 - then click Provision.
7.4 Confirm in the Right-Hand platform that the test user was created correctly with the expected attributes.
A note on group behavior during on-demand testing: If you provision a user on demand and that user belongs to 4 groups, but you only selected 1 group during the test, the Right-Hand platform will only reflect that 1 group for the user - not all 4. This is expected on-demand behavior, not a sync failure. Once you activate full Automatic provisioning (Step 8), all of a user's groups that are assigned to the application will sync together.
Step 8: Activate full provisioning
8.1 Go back to the Provisioning section and click Overview.
8.2 Click Start provisioning at the top to activate full provisioning.
All users and groups assigned to the application will now be synchronized to the Right-Hand platform on an ongoing basis.
Validation / Expected Outcome
To confirm provisioning is working:
After the first full sync completes, check the Provisioning logs in Entra ID to see which users and groups were successfully synchronized.
In the Right-Hand platform, go to Company Management > Employees and confirm your provisioned users appear with the correct attributes.
If you assigned groups, confirm group membership in the Right-Hand platform matches what's assigned in Entra ID.
If any of these don't match what you expect, see FAQs below.
Important Notes
Only one SCIM provider should be active at a time.
Users unassigned from the application will be archived in the Right-Hand platform.
The following user attributes are supported for synchronization:
SCIM Attribute | Microsoft Entra ID Attribute | Right-Hand Attribute |
userName | onPremisesSamAccountName | userName |
emails[type eq "work"].value | ||
active | Switch([IsSoftDeleted], , "False", "True", "True", "False") | Status of Employee (Active/Archived) |
displayName | displayName | Fall back for First Name, in case First Name is not available |
name.givenName | givenName | First Name |
name.familyName | surname | Last Name |
addresses[type eq "work"].streetAddress | streetAddress | Office Location |
externalId | userPrincipalName | Field is needed for user creation |
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department | department | Department |
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager | manager | Manager |
title | jobTitle | Job Title |
userType | employeeType | Employee Type |
Note: Division (the employee profile field in the Right-Hand platform) is not supported for synchronization via Entra SCIM at this time.
FAQs
A field I cleared in Entra ID still shows the old value in the Right-Hand platform. This is expected behavior, not a bug. Entra ID does not transmit cleared (null or empty) attribute values, so the Right-Hand platform has no signal to remove the existing data. Update the field directly in the Right-Hand platform to clear it.
A user's group membership in the Right-Hand platform doesn't match what I expected after on-demand testing. On-demand provisioning only syncs the specific group(s) you selected during that test - not all of a user's groups. This resolves itself once you activate full Automatic provisioning (Step 8), which syncs all of a user's assigned groups together.
A group isn't syncing at all. Confirm the group has been explicitly assigned to the application under Users and groups (Step 6). A group that isn't in the application's scope will not sync, regardless of how provisioning is triggered.
I manually created a user in the Right-Hand platform, and now their attributes look different after Entra ID provisioned them. When a manually created Right-Hand user is later added to Entra ID and provisioned (on demand or automatically), all their attributes are updated with the latest values from Entra ID - except any attribute that is empty or null in Entra ID, which is left as-is per the null-value behavior described above.
Best Practices
Only run one SCIM provider at a time. Running two active SCIM connections into the same Right-Hand platform account simultaneously can cause conflicting updates.
Test with Provision on Demand before activating full provisioning. This lets you confirm that attribute mapping is correct and that a single user's data lands correctly in the Right-Hand platform before it affects your entire assigned population.
Remember that unassigning a user from the application archives them in the Right-Hand platform. If you remove a user's assignment to the Entra ID application, they will be archived in the Right-Hand platform - this is the expected deprovisioning path.
Clear attribute values directly in the Right-Hand platform when needed. Since Entra ID won't propagate a cleared field, don't rely on clearing data in Entra ID alone if you need it removed from the Right-Hand platform.