Microsoft Entra ID User Provisioning
Overview
Microsoft Entra ID User Provisioning keeps your Learn Amp user base automatically in step with your Entra directory — creating, updating, and deactivating accounts without any manual admin work.
Unlike some other providers, Microsoft Entra ID offers two valid ways to provision users into Learn Amp:
Native Microsoft Graph API sync — Learn Amp connects directly to the Microsoft Graph API, watching a security group you define.
SCIM 2.0 — Learn Amp's standard, provider-agnostic provisioning protocol, configured through Microsoft Entra's own SCIM provisioning feature.
Both are genuinely supported, and neither is a "legacy" or deprecated option — this page explains what each does well, so you can pick the one that suits your setup. If you've read anywhere that Entra "doesn't support SCIM", that's out of date — both routes work.
Functionality Breakdown
Option 1: Microsoft Graph API Sync
Learn Amp connects to your Microsoft Entra ID tenant using the Microsoft Graph API. You designate a security group, and Learn Amp:
Automatically creates users added to that group (including nested sub-groups).
Syncs profile changes (job title, department, location, language, and more).
Automatically deactivates users removed from the group.
Can sync manager relationships (via Direct Reports) as Override Managers.
Can sync profile photos.
Uses Microsoft Graph change notifications (webhooks) for near real-time updates, alongside an automatic sync every 24 hours as a backup.
Option 2: SCIM 2.0
Microsoft Entra ID has built-in SCIM provisioning support, which you can point at Learn Amp's standard /scim_v2 endpoint — the same generic SCIM integration used by Okta and other SCIM 2.0-compatible providers. Entra pushes user changes to Learn Amp using the SCIM 2.0 schema (plus the Enterprise extension for manager, department, and hire date).
Choosing Between Them
Consideration | Graph API Sync | SCIM 2.0 |
|---|---|---|
Setup style | Self-serve: enter Tenant ID + Group ID in Learn Amp, grant admin consent | Configured within Microsoft Entra's own Enterprise Application provisioning settings |
Scoping users | By security group membership (including nested groups) | By assignment to the Enterprise Application in Entra |
Manager sync | Yes, via Direct Reports | Yes, via the SCIM Enterprise extension |
Profile photo sync | Yes | Not supported via SCIM |
Standard, cross-provider protocol | No — Microsoft-specific | Yes — same protocol as Okta and other SCIM providers |
Good fit if... | You're Entra/Graph-native and want photo sync or don't need a standards-based approach | You want consistency with other SCIM-provisioned providers, or your IT team already manages provisioning centrally through Entra's SCIM tooling |
There's no wrong choice here — both are fully supported. If you're unsure, talk it through with your account manager, who can help you weigh up your specific requirements.
On cost: both options work out of the box for standard attributes. As with any provisioning setup, custom attribute mappings or bespoke business logic beyond the standard fields may involve additional development work and cost — speak to your account manager to scope anything non-standard.
Pre-requisites
Requirement | Details |
|---|---|
Microsoft Entra ID Admin Access | Administrator-level access to your Microsoft Entra ID tenant |
Learn Amp Admin Access | Owner or Admin role in Learn Amp |
Microsoft Entra ID Tenant ID | Your organisation's unique Microsoft Entra ID identifier |
For Graph API sync | A Security Group Object ID for the group of users to provision |
For SCIM | A Learn Amp API token, and access to configure provisioning on your Entra Enterprise Application |
Role Requirements
Platform | Role Required |
|---|---|
Learn Amp | Owner or Admin |
Microsoft Entra ID | Administrator (to grant Graph API permissions or configure SCIM provisioning) |
Quick Start Guide
From the sidebar, select the Settings gear icon, then Integrations.
Decide which method fits your organisation (see the comparison table above) — get in touch with your account manager if you'd like a second opinion.
For Graph API sync: follow Setting Up Microsoft Entra ID User Provisioning (Graph API) to enter your Tenant ID and Group ID and grant admin consent.
For SCIM: follow Microsoft Entra ID SCIM Setup to generate a Learn Amp API token and configure provisioning on your Entra Enterprise Application.
Test with a small group of users before rolling out company-wide.
FAQs
Q: Does Microsoft Entra ID support SCIM?
Yes. Microsoft Entra ID fully supports SCIM 2.0 provisioning into Learn Amp, as an alternative to the native Graph API sync. Both are valid, supported options.
Q: Can I use both methods at once?
No — choose one provisioning method per tenant to avoid conflicting or duplicate updates. You can always switch later; contact Learn Amp Support to help plan a migration.
Q: Which method syncs faster?
Both use near real-time push notifications (Graph change notifications, or SCIM push), so day-to-day speed is comparable. Graph API sync also has a 24-hour scheduled sync as a backup.
Q: Does either method sync Team/Department managers?
No. Both sync individual manager relationships (Override Managers) — Graph API via Direct Reports, SCIM via the manager attribute. Team/Department managers are configured separately within Learn Amp.
Q: Can I use either method alongside Microsoft Entra ID SSO?
Yes. Provisioning and SSO are independent — you can combine either provisioning method with Microsoft Entra ID SSO for a complete identity solution.
Q: What if I need custom fields or business logic beyond the standard mappings?
This is possible with either method, but requires development work by our technical team and may come at an additional cost. Speak to your account manager to scope your requirements.
Troubleshooting
Issue | Solution |
|---|---|
Not sure which method to use | Review the comparison table above, or contact your account manager for guidance based on your setup. |
Users not syncing (Graph API) | Verify the user is in the correct security group; see Setting Up Microsoft Entra ID User Provisioning (Graph API) for details. |
Users not syncing (SCIM) | Verify the SCIM connector configuration and API token; see Microsoft Entra ID SCIM Setup for details. |
Considering switching methods | Contact Learn Amp Support before switching to avoid duplicate or conflicting user records. |