Provision from Microsoft Entra ID

Enable directory sync in Keycard and configure Microsoft Entra ID to provision Users and Groups into your organization over SCIM. For what is synced, see SCIM Provisioning. For how Users are matched to existing accounts, see Users.

• Entra ID configured as the identity provider for SSO, with the application created under Enterprise applications. See SSO with Microsoft Entra ID.
• The Admin organization Role in Keycard.
• The Cloud Application Administrator role or higher in Entra ID.
• Microsoft Entra ID P1 or P2 to provision groups.

1. Turn on directory sync in Keycard

   In Keycard Console, open Settings → SSO and turn on Enable directory sync. The toggle is unavailable until SSO is enabled.

   Copy the SCIM Base URL shown once the toggle is on.

2. Generate a sync token

   Click Generate new token and copy the token. It is shown only once.

   Sync tokens do not expire. A token authenticates only your organization’s SCIM endpoint.

3. Open the enterprise application

   In the Microsoft Entra admin center, go to Enterprise applications and open the application used for Keycard SSO.

4. Connect to Keycard

   Go to Provisioning and click New configuration. Set Authentication Method to Bearer Authentication and fill in the following:

   Field	Value
   Tenant URL	The SCIM Base URL from step 1
   Secret Token	The sync token from step 2

   Click Test Connection, then Save.

5. Confirm attribute mappings

   Under Manage, open Attribute mapping. Make sure these mappings are set for Users.

   Source Attribute	Target Attribute	Required
   userPrincipalName (matching attribute)	userName	Yes
   mail	emails[type eq "work"].value	Yes
   Switch([IsSoftDeleted], , "False", "True", "True", "False")	active	Yes
   mailNickname	externalId	Optional

   Other mapped attributes are accepted but ignored, and can stay.

   Under Groups, make sure these mappings are set:

   Source Attribute	Target Attribute	Required
   displayName	displayName	Yes
   members	members	Yes
   objectId	externalId	Optional

6. Set the scope

   Under Settings, set Scope to Sync only assigned users and groups. Then go to Users and groups and assign the users and groups to sync.

7. Start provisioning

   Set Provisioning Status to On and click Save. The initial cycle starts within minutes; later cycles run about every 40 minutes.

Under Provisioning → Provisioning logs, each assigned user and group shows a Success entry. In Keycard Console, open People: assigned Users carry the Synced badge and assigned Groups appear on the Groups tab.

Entra ID action	Effect in Keycard
Assign a user	User is created, or linked to their existing account if they already signed in through SSO
Set Account enabled to No	User is disabled and their sessions are revoked
Remove a user’s assignment, or move them out of scope	User is disabled, not deleted
Delete a user, then delete them permanently from Deleted users	User is deleted on the next cycle
Assign a group	Group is created with its members
Rename a group or change membership	Name and membership are updated
Remove a group’s assignment	Group is deleted on the next cycle

Check that the tenant URL ends in /scim/v2 and that the token has not been deleted in Keycard. A 404 means directory sync is turned off.

This happens when a required attribute does not reach Keycard, most often because the user has no email in Entra ID. Set the user’s email, and check that the step 5 mappings are in place.