Set up SCIM user provisioning for Schedule2.IT
What is SCIM
SCIM stands for System for Cross-domain Identity Management. It is a standard that lets your organization’s identity system send user account changes to applications such as Schedule2.IT. Your IT team controls which people are included and which information is synchronized.
For example, when an employee is assigned access, provisioning can create their Schedule2.IT account. Later changes to their name or contact details can update that account. When the employee is disabled or removed from the provisioning scope, the identity provider can send a deactivation request.
How SCIM and SSO work together
| Feature | Purpose |
|---|---|
| Single sign-on (SSO) | Lets users sign in through your organization’s identity provider and its authentication policies. |
| SCIM provisioning | Creates and maintains user accounts based on the users and attributes your IT team has selected. |
SSO and SCIM are configured separately. Enabling SCIM does not, by itself, configure SSO, MFA, or your organization’s sign-in policies. Schedule2.IT staff will coordinate provisioning with your agency’s authentication setup.
What Schedule2.IT supports
- Create users and update their username, name, email address, and phone number.
- Activate, deactivate, and reactivate user accounts.
- Record SCIM-driven account changes in user audit history.
- Provision users as Provider by default. Optional role mapping supports Provider and Witness; coordinate that mapping with Schedule2.IT before enabling it.
Manager, Admin, and View Only permissions are managed in Schedule2.IT and cannot be assigned through this SCIM role mapping. SCIM does not synchronize passwords, PINs, signatures, or inventory configuration.
User provisioning only: The current Schedule2.IT SCIM endpoint does not provision group objects or synchronize group memberships into Schedule2.IT. Your IT team may still use an assigned Entra group to select which users are provisioned. That does not create a corresponding group or permission mapping in Schedule2.IT.
Before you begin
Identify an IT administrator who can manage the enterprise application and provisioning settings in your identity provider. Ask Schedule2.IT support to coordinate setup for the correct agency and environment.
- Agree on the users to include, beginning with a small pilot.
- Review existing Schedule2.IT usernames and email addresses so existing accounts can be matched correctly.
- Confirm the sign-in identifier used for SSO and the identifier that will be sent as the SCIM username.
- Identify users who have access to multiple agencies or whose access is managed through a corporate organization.
Account deactivation: A SCIM deactivation disables the user account rather than permanently deleting it, preserving the account and its historical records. It is an account-level change and can affect that person’s access to other agencies. Review users with multiple agency associations with Schedule2.IT before testing or enabling deactivation.
Step 1 — Obtain the provisioning connection details
Schedule2.IT staff enable SCIM User Provisioning and generate the agency’s SCIM Secret Token. These controls are in the system administrator’s settings. Contact support if you do not see them.
| Setting | Value |
|---|---|
| Production Tenant URL | https://api.schedule2.it/scim/v2 |
| Secret Token | The agency-specific SCIM token supplied securely by Schedule2.IT. |
| Authentication | Bearer token. This is separate from your SSO certificate, user password, and general API credentials. |
Use the exact URL supplied for your environment. Enter the base URL above in the Tenant URL field; do not append /Users. Keep the token confidential and out of help articles, screenshots, and ordinary email.
Step 2 — Configure Microsoft Entra provisioning
These steps apply to Microsoft Entra ID. If your organization uses another identity provider, ask Schedule2.IT to validate its configuration before rollout.
- Open the appropriate enterprise application in the Microsoft Entra admin center. Coordinate with Schedule2.IT before creating a separate provisioning application or changing an existing SSO application.
- Open Provisioning and create or edit the provisioning configuration. Where shown, select Automatic mode.
- Enter the Schedule2.IT Tenant URL and Secret Token in the connection credentials.
- Select Test Connection and resolve any errors before continuing.
- Limit the scope to assigned users and groups, and assign the pilot users. Disable the Groups provisioning mapping because Schedule2.IT supports user objects only.
- Review the user attribute mappings below and save the configuration.
Microsoft changes its administrative screens periodically. Use the linked Microsoft setup guide if labels differ in your tenant.
Step 3 — Review user attribute mappings
Use these supported target attributes as the starting point. Your IT team and Schedule2.IT should agree on source fields and matching rules before the first synchronization.
| Schedule2.IT SCIM attribute | Mapping guidance |
|---|---|
userName |
Required for new users. Send the agreed sign-in identifier. Check whether your organization’s UPN and email differ before choosing the source field. |
emails[type eq "work"].value |
Send the user’s work email address. Schedule2.IT stores one email address, using the primary or first value supplied. |
name.givenName and name.familyName |
Send first and last name. A formatted name or displayName is also supported; agree on a consistent name mapping. |
phoneNumbers[type eq "work"].value |
Optional. Send the phone number your organization wants stored in Schedule2.IT. |
active |
Send the intended active/inactive state. Validate both disabled-account and removal-from-scope behavior in Entra. |
externalId |
Optional stable identifier from the identity provider, such as an Entra object ID. It does not automatically resolve existing-account mismatches. |
roles |
Optional. Supported role values are Provider and Witness. Omit this mapping unless it has been agreed with Schedule2.IT. |
Use a matching rule that identifies the existing Schedule2.IT account. Do not assume that matching by email, UPN, and external ID is interchangeable. A duplicate username or email can prevent creation; contact support to resolve the match rather than creating a replacement account.
Step 4 — Test before expanding access
Use Entra’s on-demand provisioning where available and confirm the results in both Entra provisioning logs and Schedule2.IT.
- Existing user: Confirm the correct account is matched and updated without creating a duplicate.
- New user: Confirm the account is created in the correct agency with the expected name, email, active status, and permission.
- Update: Change a pilot user’s name or phone number in the identity provider and confirm the update reaches Schedule2.IT.
- Deactivate: Disable or unassign a pilot account, confirm the provisioning request succeeds, and verify that Schedule2.IT access is disabled.
- Reactivate: Restore the pilot account to the intended active state and scope, then verify reactivation and sign-in.
After successful testing, start provisioning or set its status to On, expand the approved scope, and monitor the initial synchronization. Sign-in should be tested separately because successful provisioning does not prove that SSO is configured correctly.
Ongoing administration
Make changes to synchronized fields in your identity provider. Local edits to those fields in Schedule2.IT may be overwritten when the identity provider next sends an update. Continue managing application-specific permissions and operational configuration in Schedule2.IT.
Provisioning is asynchronous. Microsoft documents a typical 40-minute cycle for its non-gallery SCIM integration, but actual processing time can vary. Check provisioning logs for completion; do not assume a directory change has already reached Schedule2.IT.
Token rotation: Generating a new SCIM token immediately replaces the previous token. Coordinate the change, update the Secret Token in Entra, test the connection, and confirm that synchronization resumes.
Troubleshooting
| Problem | What to check |
|---|---|
| Connection fails or returns 401 | Confirm the environment URL, SCIM enablement, and current agency token. Check for copying errors or a recently replaced token. |
| No users appear | Check provisioning status, user assignments, scope filters, and logs. A successful connection test does not provision users. |
| Duplicate username or email | Review the existing account and matching attributes with Schedule2.IT support. |
| A local change is overwritten | Update the synchronized value in the identity provider and review the mapping. |
| A group or role operation fails | Disable group-object provisioning. For optional user role mapping, send only Provider or Witness. |
| Corporate-managed access cannot be changed | Coordinate the change through the corporate administrator and Schedule2.IT support; child-agency provisioning cannot override protected corporate-managed access. |
When requesting help, include the agency, affected username, operation, timestamp with time zone, and the provisioning error or correlation ID. Remove tokens and other credentials from screenshots and logs.
Helpful links
- Microsoft — What is app provisioning and SCIM?
A useful starting point for agency leaders and IT staff. - Microsoft — Connect a SCIM endpoint to Entra provisioning
Technical setup guidance. Apply the Schedule2.IT capabilities and mappings described in this article. - Microsoft — Customize user attribute mappings
Explains how to choose source fields, target attributes, and matching rules. - Microsoft — How provisioning works
Explains scope, synchronization cycles, and troubleshooting. - IETF — SCIM protocol specification
The technical standard for teams that need protocol details.
To get started, contact Schedule2.IT support with your agency name, identity provider, IT contact, and proposed pilot users.