> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto-Provisioning and Deprovisioning Users from M365 into MSP Process

> Overview:Onboarding and offboarding employees is something MSPs always look to make as efficient as possible. By taking advantage of Microsoft's support for…

### Overview:

Onboarding and offboarding employees is something MSPs always look to make as efficient as possible. By taking advantage of Microsoft's support for the SCIM protocol, it's easy to provide your technicians with access to MSP Process simply by adding and removing them from Security Groups in Microsoft 365. This KB article will walk you through the steps you'll need to follow.

**Please note**: If you became an MSP Process partner before Dec. 2025, you will have setup an earlier version of our Microsoft SSO module. Any of your employees setup in that way will be seamlessly migrated to this new version of our Microsoft SSO module, without any interaction on their part.

### Creating the Groups in Microsoft Azure

You'll be creating two Groups in Azure - one for users who should have the Admin role in MSP Process, and another for users who should have the Technician role in MSP Process.

1. Launch the Azure management portal ([https://portal.azure.com](https://portal.azure.com))
2. Browse to **Groups**.
3. On the left side click on **All Groups**.
4. At the top of the page click on **New group.**
5. You'll be creating two groups, one at a time, with the following properties:

![](https://mintcdn.com/triggr/-njaXAnAb5AWpJCy/images/msp-process-kb/491670bb40e6.webp?fit=max\&auto=format\&n=-njaXAnAb5AWpJCy\&q=85\&s=96d2ff7a70d7f781126bc8fb5a394648)

Click on the **Create** button to create each Group.

### Adding Users to the Groups

Next, edit each Group in Azure, and add the appropriate users into their respective groups.

1. Admin-level users should go in the *MSP Process - Admins* group.
2. Technician-level users should go in the *MSP Process - Technicians* group.

### **Important: Please follow the instructions outlined above carefully for "Creating the Groups in Microsoft Azure" and "Adding Users to the Groups", as these are critical steps. Failure to complete these steps as directed may result in additional charges, as MSPs are billed on a per-technician basis.**

### Grabbing the Tenant URL and Secret Token from MSP Process

There are two values - a *Tenant URL*, and a *Secret Token* - that you'll need to grab from MSP Process before heading into Microsoft Azure:

1. In a separate browser tab, login to the MSP Process platform ([https://app.mspprocess.com](https://app.mspprocess.com)) as an Admin-level user
2. Navigate to the **Settings -> User Management -> SSO** page
3. Copy the *Tenant URL* and *Secret Token* values

###

### Creating the Enterprise Application in Microsoft Azure

1. Launch the Azure management portal ([https://portal.azure.com](https://portal.azure.com))
2. Browse to **Microsoft Entra ID**.
3. On the left side click on **Enterprise applications**.
4. At the top of the page click on **+ New application.**
5. Click on the **+ Create your own application**.
6. Add the name of the application, for instance *MSP Process SCIM.*
7. Click on the radio button **Integrate any other application you don't find in the gallery (Non-gallery)** and click **Create**.
8. On the **Overview** blade, click the **+ New configuration** button

![](https://mintcdn.com/triggr/2kaOQdWPjLF3xX8p/images/msp-process-kb/26710bd93cd4.png?fit=max\&auto=format\&n=2kaOQdWPjLF3xX8p\&q=85\&s=a0124face6d575821329e55d9ed09204)

9. The **New provisioning configuration** page will be displayed; you'll be filling in the *Tenant URL* and *Secret Token* with values from MSP Process

10. ![](https://mintcdn.com/triggr/-njaXAnAb5AWpJCy/images/msp-process-kb/66a97f31cdc2.png?fit=max\&auto=format\&n=-njaXAnAb5AWpJCy\&q=85\&s=1f085607c7de8a457a5a094b126edcda)

11. Click the **Test connection** button to confirm that Azure can communicate with MSP Process

12. Click the **Create** button to finish creating the provisioning configuration

###

### Configuring the Enterprise Application in Microsoft Azure

1. Navigate to the **Manage -> Provisioing** section of the Enterprise application

2. Expand the **Mappings** section

3. Click on **Provision Microsoft Entra ID Groups,** make it disabled and **Save** the change.

4. Click on **Provision Microsoft Entra ID Users.**

5. Make sure that the following attribute mappings are set:

6. userName -> userPrincipalName

7. displayName -> displayName

8. externalId -> objectId

9. **NOTE: Make sure to update this setting, or it will cause failed login attempts.**

10. ![](https://mintcdn.com/triggr/o9r5jEtjdR2oUtiW/images/msp-process-kb/d4d6356b7d2e.webp?fit=max\&auto=format\&n=o9r5jEtjdR2oUtiW\&q=85\&s=61ecab7d87453cc219494db1d991a1e5)

11. Click on **Add New Mapping** button at the bottom of the page

12. Configure it as shown below:

13. Mapping Type= **Expression**

14. Expression = **SingleAppRoleAssignment(\[appRoleAssignments])**

15. Target Attribute = **roles\[primary eq "True"].value**

![](https://mintcdn.com/triggr/dXDzJtUmPBaHtkPV/images/msp-process-kb/eedcec623da9.webp?fit=max\&auto=format\&n=dXDzJtUmPBaHtkPV\&q=85\&s=23ae4a0839302a978ad17c5fd8471db2)

7. Save the user mappings changes.

### Configuring the App Registration in Azure

1. In a new browser tab login to Azure, go to **App registrations** and find the App Registration that's been created.
2. On the left side under **Manage,** click on **App roles**.
3. Edit the **User** role, and uncheck the "*Do you want to enable this app role?* " option

![](https://mintcdn.com/triggr/-njaXAnAb5AWpJCy/images/msp-process-kb/6d05ebfe643d.webp?fit=max\&auto=format\&n=-njaXAnAb5AWpJCy\&q=85\&s=2d914665b35a58f6fdc8a7b7920690df)

4. Save the change
5. Edit the User role again, and click on the **Delete** button
6. Click the **Create app role** button
7. You will go through this process twice to create two roles: **Admin** and **Technician** roles
8. Both the *Display name* and the *Value* here needs to exactly match "Admin" or "Technician", as this is what assigns the user a specific role in MSP Process.

Here's what the **Technician** app role should look like:

![](https://mintcdn.com/triggr/-njaXAnAb5AWpJCy/images/msp-process-kb/3f885092f029.webp?fit=max\&auto=format\&n=-njaXAnAb5AWpJCy\&q=85\&s=dad8289034e6b84e25cef0eb031172a0)

And here's what the **Admin** app role should look like:

![](https://mintcdn.com/triggr/-njaXAnAb5AWpJCy/images/msp-process-kb/6be7573aec41.webp?fit=max\&auto=format\&n=-njaXAnAb5AWpJCy\&q=85\&s=513cdf659138cd6af2c421097082478c)

###

### **Pushing Users from Microsoft Into MSP Process**

**You'll be running through the following steps twice - one for each Group you created at the beginning of this KB article.**

1. In the other browser tab, where you were editing the Enterprise Application, click on the **Manage -> Users and Groups** tab.
2. Click **+ Add user/group.**
3. Click the **MSP Process - Admins** group.
4. Click the *Admin* Role for the group and click **Assign**.
5. Repeated steps 1-4 for the **MSP Process - Technicians** group; assign it the **Technician** Role
6. On the left side under **Manage**, click on **Provisioning**.
7. Click the **Start provisioning** button.

###

### Results!

It'll take anywhere from **10-40 minutes** for Microsoft to provision users into MSP Process; it depends on how many users you've got in the Security Groups.

If you're interested in how Microsoft describes why provisioning through SCIM can take a bit of time, and what you should expect in your specific circumstance, check out this KB article:

[Check the status of user provisioning](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user)

You can see how things are going from the **Settings -> User Management -> Users** page in MSP Process.

### Logging in as as Provisioned User

Your technicians just need to click on the **Microsoft** button on the MSP Process login page:

![](https://mintcdn.com/triggr/2kaOQdWPjLF3xX8p/images/msp-process-kb/1d8c69f448b6.webp?fit=max\&auto=format\&n=2kaOQdWPjLF3xX8p\&q=85\&s=40fc3485ce10492dc5ee5b79485f9c63)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.