SCIM Provisioning with Microsoft Azure Active Directory/ EntraID

This guide covers everything you need to configure SCIM provisioning between EntraID and Sprout Social, including prerequisites, step-by-step setup, testing, and troubleshooting.

What's in this guide

• Prerequisites
• Prepare your Sprout roles and permissions
• Enable SCIM in Sprout
• Configure SCIM provisioning in EntraID
• Assign groups to the Sprout application
• Test, then go live
• Managing users after setup
• Common errors and troubleshooting
• FAQ

Prerequisites

Before you begin, make sure the following are in place.

In Sprout Social:

• Account Owner role, or the Manage Single Sign-On permission plus API permissions
• SSO already configured for Sprout Social in EntraID – SCIM provisioning builds on top of an existing SSO connection. Do not proceed until SSO is working.
• Organizational Roles and Profile Permission Sets ready to use;  legacy roles are not supported with SCIM

In EntraID AD / Microsoft Entra ID:

• Application Administrator role or higher in your EntraID tenant
• An existing Sprout Social enterprise application in EntraID (the same one used for SSO)

Beta Guide will cover:

• Prerequisites to configuring SCIM for Sprout
• Enabling SCIM as a feature in Sprout
• Configuring SCIM for Sprout in EntraID AD / Entra ID
• Testing / Go Live
• Managing users once SCIM is enabled
• Troubleshooting
• FAQ

1: Prerequisites to configuring SCIM for Sprout

Before enabling SCIM in "Live" mode, we recommend removing all manually-assigned Roles and Profile Permission Sets for users that will be managed by SCIM if the currently assigned roles for those users will differ from those you’re setting up in your IdP. 

SCIM enforces one role per category (Organization Role and Permission Set) – if a user already has a different role assigned in the same category, SCIM will not be able to assign the new one and you'll get a sync error. Super Admin role does not allow a Profile Permission Set to be assigned as it already has full permissions.

1a. Review the preset Org Roles and create custom roles if needed

If your organization needs roles beyond Sprout's defaults, create them first:

1. Go to Settings > Users & Social Profiles > Roles
2. Create your custom roles and assign appropriate permissions

1b. Create Profile Permission Sets (PPS)

Profile Permission Sets control what actions users can take on social profiles (publish, reply only, needs approval, etc.):

1. Go to Settings > Users & Social Profiles > Profile Permission Sets
2. Create a PPS for each access tier you plan to map from EntraID

Note: Name your roles and PPS carefully – the display name of your EntraID groups must exactly match these names (case-insensitive) when configuring group mappings. A mismatch will cause mapping errors.

More details on Sprout Org Roles and Profile Permission Sets can be found in our Help Center:

• Roles
• Permissions

1c. Set up groups in EntraID to align with Org Roles and Profile Permission Sets

In EntraID AD / Entra ID, go to EntraID Active Directory > Groups and create one group per Organizational Role and one group per Profile Permission Set. For example:

Roles:

• Sprout_SuperAdmin
• Sprout_SocialMediaManagers
• Sprout_ContentCreators
• Sprout_CareAdmins

Profile Permission Sets:

• Sprout_AllPermissions
• Sprout_SocialMediaMgmtPPS
• Sprout_ContentCreationPPS
• Sprout_CareAdministrationPPS

Groups can map to either an Org Role or a Profile Permission Set, or both. Keep in mind that only one Org Role and one PPS can be assigned to a user via SCIM. Assigning a user to two groups that both map to a role (or both map to a PPS) will cause a sync error.

Example: If all content team members need the Content Creators Org Role but some need a Publish PPS while others need a Needs Approval PPS, create three groups: one for the role (all users are members), and one per PPS (each user is added to the PPS group matching their needs).

If your organization uses SCIM, you can't edit a SCIM-managed user's Role or Profile Permission Set directly in Sprout. Those fields will appear grayed out, with a tooltip explaining that you must update the user's group membership in your IdP (Okta or Entra). This is intentional: it prevents a change in Sprout from silently getting undone the next time SCIM syncs.

Note: If someone has custom permissions set up in Sprout (permissions outside the standard Roles and Permission Sets), they should not be added to any Okta or Entra group that's mapped to Sprout. Doing so will cause a sync error. These users need to be managed manually in Sprout instead.

1d. Create users and assign them to groups

In Entra ID, ensure your users exist and are assigned to the appropriate groups. Only direct members of assigned groups are provisioned; nested group membership is not supported.

2: Enable SCIM as a feature in Sprout

1. Go to Settings > Authentication & Provisioning > Identity Provider Integrations (tab)

2. Select Enabled Via SCIM and click Start Configuring SCIM

3. In the configuration wizard, expand Section 1 to find your SCIM Connector Base URL – you will use this as the Tenant URL in EntraID

4. Go to Settings > API and click Generate API Token. Give the token a descriptive name (e.g., "EntraID SCIM") and copy it – you will use this as the Secret Token in EntraID

The steps in Section 2 must be done in EntraID/EntraID because this is where your organizational SCIM groups are centralized and your users will be managed. Mapping IdP Groups to Sprout Roles and Profile Permission sets is what ensures that the IdP and Sprout remain in sync. 

3: Configure SCIM Provisioning in EntraID AD / Entra ID

These instructions are for informational purposes. EntraID can change at any time and your environment could differ from what is outlined below, using a demo environment. As such, we recommend you always refer to EntraID documentation and support as the source of truth for SCIM configuration.

Link: How Application Provisioning Works in EntraID

3a. Open the Sprout Social enterprise application

1. Sign in to the EntraID portal or the Microsoft Entra admin center
2. Navigate to EntraID Active Directory > Enterprise apps
3. Find and open your existing Sprout Social application (the same one used for SSO)
4. In the left menu, select Provisioning

3b. Configure provisioning credentials

1. Click Connectivity
2. Enter:

3. Click Test Connection. If the test fails, switch Sprout to Test mode and retry
4. Click Save

3c. Configure attribute mappings

Expand the Attribute mapping section. You will see two mappings: Provision Microsoft Entra ID Users and Provision Microsoft Entra ID Groups.

User attribute mappings

Click Provision Microsoft Entra ID Users and configure the following:

Sprout does not support: phoneNumbers, addresses, profileUrl, title, department, manager. Remove these from the mapping or leave them unmapped to avoid sync noise.

Group attribute mappings

Click Provision Microsoft Entra ID Groups and ensure group provisioning is Enabled.

Important: The group displayName sent to Sprout must exactly match the Org Role or PPS name in Sprout (case-insensitive). If your EntraID group names use a different naming convention, use an Expression mapping to transform the display name before it reaches Sprout. See the FAQ for guidance on expression mapping.

If a group name in your IdP doesn't exactly match the Role or Permission Set name in Sprout, the mapping won't work. You'll see an error on the IdP side (Okta or Entra) right away. On the Sprout side, there's no visible error, the group will just silently fail to assign a role, but the failed sync is recorded in the logs. If a user isn't getting the expected role and nothing looks wrong in Sprout, check the IdP for a sync error first, and pull the Sprout audit log if you need to confirm it from the Sprout side.

3d. Set provisioning scope

Under Settings, set Scope to Sync only assigned users and groups. This ensures only users in groups you explicitly assign to the Sprout app are provisioned, not your entire EntraID directory.

4: Assign groups to the Sprout application

Groups must be explicitly assigned to the Sprout enterprise application before their members will be provisioned. Adding users to an EntraID group is not sufficient on its own.

1. In the Sprout Social enterprise app in EntraID, go to Users and Groups

2. Click Add user/group

3. Select each group you want to manage via SCIM and click Assign

Note: Only direct members of assigned groups are provisioned. Nested group membership is not supported by EntraID's provisioning service.

Here is an example mapping using the groups from Step 1:

Important: The group display names you use must exactly match what exists in Sprout. If the name doesn't match, the mapping will fail and you'll see an error indicating the role or permission set wasn't found on Sprout's side.

5: Test, then go live

5a. Switch Sprout to Test mode

1. In Sprout, go to Settings > Authentication & Provisioning
2. Change the provisioning mode from Live to Test

In Test mode, EntraID can send data to Sprout and you'll see events in the audit log, but no users or permissions are actually created or modified.

5b. Trigger a test provisioning cycle

In EntraID, go to Provisioning and click Provision on demand to test with a specific user 

The provisioning status will appear automatically:

If needed check EntraID's Provisioning logs (under Provisioning > View provisioning logs) for any errors

Check the audit log in Sprout (Settings > Authentication & Provisioning > Export Audit Logs) to confirm events were recorded 

A successful test will show provisioning events in both EntraID and Sprout logs with no errors.

5c. Switch Sprout to Live mode

Once you are satisfied with the test results:

1. In Sprout, go to Settings > Authentication & Provisioning
2. Change the provisioning mode from Test to Live and confirm

5d. Start provisioning in EntraID

1. In EntraID, go to Provisioning and set Provisioning Status to On 
2. Click Save

EntraID runs automatic provisioning cycles approximately every 40 minutes. To trigger an immediate sync, click Provision on demand for a specific user, or click Restart provisioning to run a full initial cycle.

Once complete, check Settings > Roles & Team Members in Sprout to confirm users appear with the correct roles and permissions assigned.

6: Managing users after setup

6a. Changing a user's role or permissions

Update the user's group membership in EntraID. Sprout syncs automatically on the next provisioning cycle (approximately every 40 minutes), or trigger an on-demand sync for immediate effect.

Example --promoting a content creator to social media manager:

1. Remove the user from Sprout_ContentCreators in EntraID
2. Add the user to Sprout_SocialMediaManagers
3. Sprout updates their Org Role on the next sync
4. Repeat for PPS groups if needed

6b. Offboarding a user

Soft-delete a user in Azure, or remove them from the Sprout app assignment, to immediately suspend their Sprout access. Their account is preserved and can be reactivated by restoring the user in Azure.

After 30 days - or if you permanently delete the user manually - Azure triggers a full removal from Sprout. This is irreversible. If the user returns, they will need to be fully re-provisioned rather than simply reactivated.

In both cases, changes sync automatically - no action is needed in Sprout.

6c. Adding a new user

Add the user to the appropriate EntraID groups and ensure those groups are assigned to the Sprout enterprise application. Sprout provisions the account automatically on the next sync. Make sure you have available user seats in Sprout --if the limit is reached, provisioning will fail and your Sprout admins will be notified.

7: Common errors and troubleshooting

What happens if you switch to Live too early (Validate → Live recovery)

Entra ID handles this on its own. After switching to Live, Entra automatically checks each user again on its next sync cycle, sees they don't really exist yet, and creates them properly. The only thing to know: groups don't always sync in the same cycle as users. Entra may wait about 6 hours to retry the group on its own. If users show up in Sprout without a role right after going Live, don't wait, go to the Entra provisioning page and click Provision on demand on the group to force it through immediately instead of waiting out the 6 hours.

Connection test fails in EntraID

Verify the Tenant URL and Secret Token are correct. 

Users provisioned but no role or PPS assigned 

The EntraID group display name doesn't match the Org Role or PPS name in Sprout. Check exact names at Settings > Users & Social Profiles > Roles and update the group display name or expression mapping in EntraID to match precisely. Also confirm the group is assigned to the Sprout enterprise application under Users and Groups.

Sync fails with a role conflict or duplicate assignment error 

A user belongs to two groups that both map to the same category;  two Org Role groups, or two PPS groups. Review their group memberships in EntraID and ensure they are in only one role-mapped group and one PPS-mapped group. If they had manually-assigned roles in Sprout before SCIM was enabled, remove those first.

Users aren't being provisioned after group assignment 

Check in order:

1. Is Sprout in Live mode?
2. Is the group assigned to the Sprout enterprise application under Users and Groups, not just added to the EntraID group directory?
3. Is Scope set to Sync only assigned users and groups?
4. Has a provisioning cycle run? Trigger an on-demand sync in EntraID.
5. Check EntraID's Provisioning logs for specific errors.

Provisioning in quarantine 

If most operations fail consistently (e.g., invalid credentials or endpoint issues), EntraID enters quarantine mode–sync frequency drops to once per day and admins are notified by email. Fix the root cause (verify credentials and SCIM URL), then click Restart provisioning to exit quarantine.

A deactivated user in EntraID is still active in Sprout 

Check that the active attribute mapping is configured correctly (the Switch([IsSoftDeleted]...) expression). If the mapping is correct and the issue persists, trigger an on-demand sync for the affected user.

Role conflicts after migration to Live mode 

Users had manually-assigned roles or PPS in Sprout before SCIM was enabled. Remove those manual assignments in Sprout (Settings > Roles & Team Members), then trigger a re-sync in EntraID.

"Email already exists" when re-provisioning a user 

The user was previously deactivated in Sprout --they are not deleted, just inactive. Reactivate them via EntraID rather than trying to create a new account.

8: FAQ

Can I use SCIM and manage some users manually at the same time? 

Yes. SCIM only manages users provisioned through it. Users created manually in Sprout before SCIM was enabled won't be affected unless their email matches an account in EntraID, in which case Sprout will link the accounts on the next sync and SCIM will take over management for that user. If those users have existing manually-assigned roles or PPS, remove those first.

What happens to existing users when I switch to Live mode?

 Existing users remain unchanged. If a user's email matches an account in EntraID, Sprout will link the accounts on the next sync and SCIM will take over. If those users already have manually-assigned roles or a PPS in Sprout, you'll need to remove those first.

How do I switch from JIT provisioning to SCIM?

 Go to Settings > Authentication & Provisioning, disable JIT, and follow the setup steps in this guide. Existing JIT-provisioned users will be matched by email when SCIM first syncs and won't be duplicated.

Can a user belong to multiple groups? 

Yes, with one constraint: a user can be in one role-mapped group and one PPS-mapped group simultaneously. Placing a user in two role-mapped groups or two PPS-mapped groups will cause a sync error.

How long does a sync take after I make a change?

EntraID runs automatic cycles approximately every 40 minutes. You can trigger an on-demand sync for a specific user from the Provisioning page in EntraID for immediate effect.

What if my EntraID group names don't match my Sprout role names? 

Use an Expression attribute mapping on the group displayName field to transform group names before they're sent to Sprout. For example, if your EntraID groups use a "Sprout-" prefix, a Replace expression can strip it automatically. Contact your Sprout representative for help configuring expression mappings.

Do I need to map every default EntraID attribute to Sprout? 

No. Sprout only uses first name, last name, email, and username. Remove other default attribute mappings (department, jobTitle, manager, etc.) to keep your configuration clean.

What happens if we run out of user seats? 

SCIM will not provision new users if no seats are available. Your Sprout admins will receive a notification. Contact your Sprout account representative to discuss adding seats.

Where can I see a record of SCIM-driven changes? 

Go to Settings > Authentication & Provisioning and click Export Audit Logs. All SCIM-driven changes are labeled with source "SCIM" so you can distinguish them from manual changes.