The Microsoft Entra ID Provisioning Service: How It Works and How to Set It Up

Microsoft Entra ID, formerly called Azure Active Directory (Azure AD), has a sync engine built in. The Microsoft Entra provisioning service creates, updates, and removes user accounts in the apps your people use, and it can create users in Entra ID and Active Directory from your HR system.

Most teams meet it when they connect their first SaaS app. Then they find it does more: inbound provisioning from Workday or SAP SuccessFactors, an API for any other system of record, and connectors for on-premises apps. Knowing how it decides who to provision, what to send, and when to stop makes the difference between a setup that runs quietly and one that floods your helpdesk.

This guide covers each kind of provisioning the service runs, how scope and attribute mappings work, what happens in each cycle, how to monitor it, and how to set it up. If you’re looking for access provisioning in general, start with our guide to access provisioning.

TL;DR

• The Microsoft Entra provisioning service keeps accounts in sync between Entra ID and other systems. It works outbound, from Entra ID to apps, and inbound, from HR into Entra ID and Active Directory.
• Outbound, it talks SCIM 2.0 to SaaS apps, and an on-premises agent extends it to LDAP, SQL, and web service apps.
• Inbound, it reads workers from Workday and SAP SuccessFactors, and an API accepts records from any other system of record.
• Assignments and scoping filters decide who’s provisioned. Attribute mappings decide what’s sent, and matching attributes link existing accounts.
• It runs an initial cycle and then incremental cycles about every 40 minutes. Provisioning logs show every operation, and a job that keeps failing goes into quarantine.

What Is the Microsoft Entra Provisioning Service?

The provisioning service is the part of Microsoft Entra ID that creates, updates, and removes identities in other systems. Microsoft calls it automatic provisioning. It doesn’t only create accounts. It maintains them as people’s roles change and removes them when access should end.

It runs in two directions:

• Outbound: from Entra ID to the apps people use, such as Salesforce, ServiceNow, Slack, or Zoom. Entra ID is the source, and the app is the target.
• Inbound: from a system of record, usually an HR system, into Entra ID or on-premises Active Directory. The HR system is the source, and the directory is the target.

The connection is encrypted with TLS 1.2, and each app is configured with its own admin credentials, which you can test before you turn provisioning on.

The provisioning service is different from Microsoft Entra Connect Sync and Cloud Sync. Those synchronize users and groups from on-premises Active Directory into Entra ID. The provisioning service handles apps and HR systems.

The Four Kinds of Provisioning

1. App Provisioning to SaaS Apps Over SCIM

Outbound provisioning to cloud apps is the most common use. The service connects to the app’s SCIM 2.0 endpoint and uses SCIM’s standard user and group schema to create, update, and disable accounts.

Microsoft says the Entra app gallery holds thousands of pre-integrated apps, and most of their provisioning connectors use SCIM. Each has a setup tutorial with the credentials and mappings it needs. For an app outside the gallery, you can connect any endpoint that follows SCIM 2.0, or the app’s developer can build one.

Some apps, such as ServiceNow and Box, accept groups as well as users. With group provisioning on, the service pushes the groups and their members too.

2. HR-Driven Inbound Provisioning

Inbound provisioning makes the HR system the source of authority for identities. Entra ID has built-in connectors for Workday and SAP SuccessFactors, and they cover four events:

• New hires: the worker is created in Active Directory or Entra ID, and their email address and username can be written back to the HR system.
• Updates: changes to name, title, manager, or department flow to the account.
• Terminations: the account is disabled.
• Rehires: the old account can be reactivated or a new one provisioned.

For a hybrid environment, the service writes to Active Directory through a lightweight provisioning agent installed on a Windows server, and Entra Connect or Cloud Sync carries the user up to Entra ID. Without Active Directory, it creates cloud-only users in Entra ID.

For inbound flows, scoping filters are the main way to decide who’s provisioned, such as only active employees in certain countries.

3. API-Driven Inbound Provisioning

If your HR system isn’t Workday or SuccessFactors, API-driven inbound provisioning lets any system of record feed the same engine. You create an API-driven provisioning app in Entra ID, and a client you build or buy posts worker records to its /bulkUpload endpoint in Microsoft Graph.

The records use SCIM schema, so the client doesn’t decide whether to create, update, enable, or disable anyone. It sends the full record, and the provisioning service compares it with the directory, applies your scoping and attribute mappings, and makes the change in Entra ID or Active Directory. Microsoft’s own examples use a PowerShell script reading a CSV export or an Azure Logic App.

There are limits to plan for. Each call carries up to 50 records. A tenant can make 2,000 calls a day with Entra ID P1 or P2, or 6,000 with Entra ID Governance, and no more than 40 calls in any five-second window.

4. On-Premises App Provisioning

The service can also reach apps that don’t live in the cloud. A provisioning agent on a Windows server connects Entra ID to your network, and the ECMA Connector Host translates provisioning requests for the target app. Connectors cover LDAP directories, SQL databases, REST and SOAP web services, and PowerShell, and you can import custom ECMA2 connectors built for Microsoft Identity Manager. Microsoft Identity Manager itself isn’t required.

The agent only makes outbound connections, so you don’t open inbound firewall ports. On-premises apps that already speak SCIM can be reached through the agent without the ECMA host.

Who Gets Provisioned: Assignments and Scoping Filters

The service only acts on users who are in scope. For outbound provisioning, there are two ways to set that scope, and they work together.

Assignments

Most outbound setups use Sync only assigned users and groups. You assign users or groups to the enterprise app, and the service provisions their members. It’s the same assignment that grants single sign-on, so one action controls both. Assigning groups needs Entra ID P1 or P2.

Keep two limits in mind:

• Nested groups aren’t read. Only direct members of an assigned group are provisioned. Assign the inner groups directly or use a scoping filter.
• Dynamic groups add delay. A user is only provisioned or deprovisioned once the dynamic group has evaluated their membership, and losing membership counts as a deprovisioning event.

The other option, Sync all users and groups, evaluates every user in the tenant. It’s slower, and Microsoft recommends syncing assigned users and groups where you can.

Scoping Filters

A scoping filter is a set of attribute rules. A user is provisioned only if they pass. For example, a sales app might only take users whose department equals Sales.

• Each filter has one or more clauses, and all clauses in a filter must be true.
• If you create several filters, a user who passes any one of them is in scope.
• Operators include equals, not equals, is null, is not null, is true, is false, greater than, includes, and regex match.
• Filtering doesn’t work on multi-valued attributes, and a clause on an empty attribute is false.

Saving a new scoping filter starts a full sync. Anyone who falls out of scope is disabled or deprovisioned in the app, so test filters before you save them on a live app.

What Gets Sent: Attribute Mappings

Attribute mappings decide which user properties flow to the target, and how. Each gallery app comes with a default set that you can edit, add to, or remove from. A mapping can be:

• Direct: the source value is copied as-is, such as userPrincipalName to userName.
• Constant: the target always gets the same value, such as a fixed role or country.
• Expression: a script-like function transforms the value, such as building a username from first and last name or turning a department code into a name.

One mapping is the matching attribute. The service uses it to find an existing account in the target before it creates a new one, so it has to be unique on both sides. Get it wrong and you get duplicate accounts.

Mappings also let you limit what the service may do. Under Target object actions, you can allow or block creates, updates, and deletes, for example to update existing accounts without creating new ones.

How a Provisioning Cycle Works

When you turn provisioning on, the service runs an initial cycle. It reads every user and group in scope from the source, filters them by assignment and scoping filters, and looks for each one in the target by its matching attribute. It creates anyone who isn’t there, updates anyone who is, and stores the target’s ID for future changes. It then saves a watermark.

After that, it runs incremental cycles about every 40 minutes. Each one reads only what changed since the last watermark and applies it. On the way out:

• A user who’s unassigned or falls out of scope is disabled in the target.
• A user who’s disabled or soft-deleted in Entra ID is disabled in the target. For a SCIM app, disabling means setting active to false.
• A user who’s hard-deleted in Entra ID is deleted in the target. Entra ID hard-deletes users 30 days after a soft delete.

You can change some of that behavior, such as skipping deletions for users who go out of scope. For the access side of the process, see our guide to deprovisioning.

Initial cycles take longer than incremental ones. For assigned users and groups, Microsoft estimates between 0.01 and 0.08 minutes per user, group, and group member in scope, so 10,000 objects takes roughly 2 to 13 hours. Changing mappings or scoping filters, or selecting Restart provisioning, starts a new initial cycle.

To test without waiting, use Provision on demand. It runs one user, or a group with up to five members, through the whole sequence in seconds and shows each step: connection, import, scope, match, and action.

Monitoring: Provisioning Logs, Alerts, and Quarantine

Provisioning Logs

Every operation the service runs is recorded in the provisioning logs, under Entra ID > Enterprise apps > Provisioning logs. Each entry shows what the service read from the source and target, how it compared them, and what it created, updated, disabled, or skipped. You can search by name or by an identifier in either system, and stream the logs to Azure Monitor for longer retention and alerts.

Changes to the provisioning setup itself, such as new credentials or edited mappings, are recorded in the audit logs.

Errors and Retries

When a single user fails, the service retries them in later cycles, less often each time. The usual causes are a missing attribute that the target requires and a value that has to be unique in the target but isn’t. Fix the data in the source or adjust the mapping.

Quarantine

If most or all calls to the target fail, the job goes into quarantine. Invalid admin credentials are the classic cause. A job can also be quarantined when more than 40% of its provisioning events fail, once failures reach 5,000.

In quarantine, cycles slow down to once a day, and you get a notification email if you set one up. The job leaves quarantine once the errors are fixed and the next cycle runs, or when you restart it. If it stays quarantined for more than four weeks, it’s disabled.

Accidental Deletions Prevention

You can also set a deletion threshold. If one cycle would disable or delete more users than the threshold allows, the job is held in quarantine and you get an email. You then review the provisioning logs and either allow the deletions or fix the cause first. It’s worth turning on for every app, because one wrong scoping filter can unassign hundreds of people.

Licensing

What you need depends on the kind of provisioning:

• User provisioning to SaaS apps: included in Entra ID Free.
• Group provisioning, on-premises app provisioning, and HR-driven or API-driven inbound provisioning: Entra ID P1 or P2. Microsoft lists P1 at $7 and P2 at $10 per user per month, paid yearly, and P1 is included in Microsoft 365 E3 and Business Premium.
• Higher API limits and Account Discovery: Entra ID Governance or the Microsoft Entra Suite. Account Discovery finds existing accounts in a target app and shows which match Entra users and which are orphaned.

How to Set Up Provisioning for a SaaS App

Here’s the general sequence for an app from the Entra gallery.

1. Read the App’s Tutorial

Find the app in Microsoft’s list of SaaS app tutorials. It tells you which credentials to generate in the app, which mappings it expects, and whether it supports groups and deletes.

2. Connect Entra ID to the App

Sign in to the Microsoft Entra admin center as at least an Application Administrator. Browse to Entra ID > Enterprise apps, select the app, and open Provisioning. Set the mode to Automatic, enter the admin credentials (often a tenant URL and a secret token), and select Test Connection.

3. Review the Mappings

Open Mappings. Check the matching attribute first, then the attributes that flow to the app. Remove anything the app doesn’t need, and add expressions where formats differ.

4. Set the Scope and Settings

Under Settings, choose Sync only assigned users and groups, enter a notification email, turn on error alerts, and turn on accidental deletions prevention. Add scoping filters if assignment alone isn’t precise enough.

5. Assign a Pilot Group

Assign a small group of users to the app. If the app already has accounts, use Account Discovery where it’s licensed, or check matching carefully, so existing accounts are linked rather than duplicated.

6. Test With Provision on Demand

Run a few users through Provision on demand: a new user, an existing one, and one who should be out of scope. Read each step’s details.

7. Turn It On and Watch the Logs

Set Provisioning Status to On and save. Watch the first cycles in the provisioning logs, fix any errors, and widen the assignments in stages.

Where Lifecycle Workflows and Scripts Fit

The provisioning service keeps accounts and attributes in sync. It doesn’t send welcome emails, issue a first-day credential, or delete accounts on a schedule after someone leaves. In Entra ID Governance, those steps belong to Lifecycle Workflows, which act on the hire and leave dates that inbound provisioning sets.

For one-off bulk changes or attributes no connector covers, you can script updates through Microsoft Graph, as covered in our guide to automating Entra ID updates. And for how automated provisioning works in general, whatever the tool, see our guide to automated user provisioning.

Automate Provisioning From Any HR System With ezOnboard

Entra ID’s built-in HR connectors cover Workday and SAP SuccessFactors. If your HR system is BambooHR, Paylocity, or another without one, API-driven provisioning means building and running your own client.

ezOnboard connects those HR systems to on-premises Active Directory and Entra ID directly. You set your rules once, and approved HR changes create, update, and disable accounts and group memberships.

Your HR system

HR records

Sync

Active Directoryand Entra ID

Accounts

New hires get their account and groups on time. Movers’ attributes and groups follow their new role. Leavers are disabled when HR records the exit. Once the directory is right, Entra’s provisioning service can carry those accounts on to your SaaS apps.

To get started, request a demo or check the ROI calculator to see how much money ezOnboard can save you.

FAQs About the Microsoft Entra Provisioning Service

What is the Microsoft Entra provisioning service?

It’s the sync engine built into Microsoft Entra ID. It creates, updates, and disables user accounts in SaaS and on-premises apps, and it creates users in Entra ID and Active Directory from HR systems such as Workday and SAP SuccessFactors.

Does it work with non-Microsoft apps?

Yes. Most of its connectors are for third-party apps in the Entra gallery, and it can connect to any app with a SCIM 2.0 endpoint. On-premises apps can be reached through LDAP, SQL, and web service connectors.

How often does the provisioning service run?

After the initial cycle, incremental cycles run about every 40 minutes. Jobs in quarantine slow down to once a day. You can push a single user straight away with Provision on demand.

What does quarantine mean?

It means most calls to the target are failing, often because of invalid credentials or a high error rate. The service slows to one cycle a day until the cause is fixed, and disables the job after four weeks in quarantine.

Is the provisioning service free?

User provisioning to SaaS apps is included in Entra ID Free. Group provisioning, on-premises app provisioning, and HR-driven or API-driven inbound provisioning need Entra ID P1 or P2.

What is the difference between the provisioning service and Entra Connect?

Microsoft Entra Connect Sync and Cloud Sync synchronize users and groups from on-premises Active Directory into Entra ID. The provisioning service syncs Entra ID to apps, and HR systems into Entra ID and Active Directory.