SCIM Provisioning

SCIM provisioning (enterprise) connects CompassDocs to your identity provider’s user lifecycle. Once configured, Microsoft Entra ID pushes changes on its provisioning cycle:

• New hires get a CompassDocs account automatically (as Viewers — an admin promotes editors/approvers in Users & roles).
• Name and email changes flow through.
• Departed employees are deactivated — their sessions are revoked immediately, and sign-in stops working. Accounts are disabled, never deleted, so document authorship, comments, and audit history stay intact.

Provisioned users sign in with single sign-on; SCIM and SSO are designed to be used together.

Set it up

You need an enterprise license (the scim entitlement is included in all enterprise licenses) and admin rights in both CompassDocs and Entra.

1. In CompassDocs

1. Go to Settings → Single sign-on → SCIM provisioning.
2. Copy the Tenant URL (it’s https://your-workspace/api/scim/v2).
3. Click Generate secret token and copy it — it’s shown once and stored only as a hash. (Generating again later rotates it; the old token stops working immediately.)

2. In Microsoft Entra

1. Open your CompassDocs enterprise application (the same one used for SSO, or a dedicated one) → Provisioning → Automatic.
2. Paste the Tenant URL and Secret Token, then Test Connection.
3. In attribute mappings, map externalId → objectId (recommended — it lets SSO link accounts even before a user’s first login; with the default mapping, linking falls back to email on first sign-in, which also works).
4. Assign the users (or groups) to provision, and Start provisioning.

Entra runs its cycle roughly every 40 minutes. The CompassDocs card shows “Entra last called …” so you can confirm traffic is flowing, and every provisioning action is recorded in the audit log (scim.user_create, scim.user_update, scim.user_disable, …).

How changes map

Entra action	CompassDocs result
Assign user	Account created (Viewer, signs in via SSO)
Update name / email	Profile updated
Set inactive / unassign	Account disabled, sessions revoked
Delete (after soft-delete window)	Account disabled (never destroyed)
Re-activate	Account re-enabled

Groups

Group provisioning intentionally stays with Entra group sync (the Graph-based enterprise connector), which carries richer membership data than SCIM. The SCIM /Groups endpoint answers with an empty list so Entra doesn’t complain.

Notes

• Roles are not managed by SCIM: everyone arrives as a Viewer, and role changes made in CompassDocs stick.
• Rotating the secret token (or toggling Enabled off) stops provisioning instantly; Entra shows errors until you paste the new token.
• The token is a credential — treat it like a password. CompassDocs stores only its SHA-256 hash.