Provision people from Microsoft Entra ID

Let Microsoft Entra ID (Azure AD) add, change and remove people and teams through SCIM.

In short

Connect Microsoft Entra ID once. People you assign to the app join the organization, changes follow, and groups become teams.

Who: an owner or admin here, and someone who may manage enterprise applications in Entra ID.
Plan: provisioning comes with the Enterprise plan, and the 14-day trial has it.

Open your organization, then Settings › "Security and data", and find "Provisioning (SCIM)".
Copy the "SCIM address".
Optional: tick "People it adds may take a paid seat". Leave it off to keep provisioning within the seats you have.
Press "Make a token" and copy the token. It is shown only this once.

In the Microsoft Entra admin center open "Enterprise applications" › "New application" › "Create your own application", and choose "Integrate any other application you don't find in the gallery".
Open the app's "Provisioning", press "Get started" and set "Provisioning Mode" to "Automatic".
Under "Admin Credentials" paste the SCIM address into "Tenant URL" and the token into "Secret Token". Press "Test Connection", then "Save".
Under "Users and groups" press "Add user/group" and assign the people and groups to provision.
Back in "Provisioning" set "Provisioning Status" to "On" and press "Save". The first cycle may take up to 40 minutes.

"Test Connection" fails with 401: paste the token again, or make a new one - the old one may have been replaced.
People are not added: check they are assigned to the app, and that seats are free or "People it adds may take a paid seat" is ticked.
"What it did" says what each call changed, so you can see which person or group a failure was about.

People the provider adds join as members; people it pauses or removes lose their sign-in and their seat. Their work stays.
Groups become teams with the same names, and their members follow the group.
"What it did" lists the last 50 changes the provider made, and the section shows when it last called.
"Make a new token" stops the old one at once; "Turn off provisioning" stops it without a new one.
Plan: provisioning comes with the Enterprise plan, and the 14-day trial has it.