The integration uses OAuth only. API keys and Integration Users are not supported.

Problem

Provisioning stopped. Microsoft Entra ID shows one of these:

  • {"code":"access_denied","message":"You are not authorized to perform this action."}
  • 401 Unauthorized or 403 Forbidden
  • 404 Not Found on the SCIM endpoint (after the Freshservice URL was changed)
  • The job is in quarantine

Test Connection may still pass while some users fail.

Cause

  • The OAuth token is valid for 365 days. After that, it expires. No account needs to be deactivated for this to happen.
  • The user who installed the app was deactivated, left, or lost the Account Admin role.
  • The app was installed by an Occasional Agent. A day pass lasts 24 hours, so the connection stops when it ends.
  • The Freshservice URL was renamed.

Steps

  1. In Freshservice, go to Admin > Apps > Manage Apps and uninstall Azure Active Directory provisioning (SCIM). You do not need to change anything in Microsoft Entra ID. Provisioned users are not deleted or deactivated.
  2. Reinstall the app as an Account Admin or a user with admin privileges. Never use an Occasional Agent. A dedicated admin account for this is a good idea.
  3. Copy the new OAuth token. Reinstalling is the only way to get a new token.
  4. In Microsoft Entra ID, go to Enterprise applications > Freshservice Provisioning > Provisioning. Paste the new token in Secret Token.
  5. Click Test Connection, then Save.
  6. Run Provision on demand for one user to confirm. See How to Test One User with Provision on Demand.

Good to know

  • The old token keeps working in Microsoft Entra ID until you replace it.
  • With several tenants on one Freshservice account, paste the new token in every tenant.
  • Note the install date and reinstall before the 365 days end.
  • Never send the token in a ticket or email.
  • If some users still fail after the reinstall, open the provisioning log for one of them and read the exact error. See How to Read Provisioning Logs and Find the Cause of an Error.
  • After the fix, errors that were hidden behind the sign-in problem, such as mapping errors, can appear. The same article lists the common ones and their fixes.

Sources

  • KB: How to Read Provisioning Logs and Find the Cause of an Error
  • KB: How to Test One User with Provision on Demand