Problem

  • Microsoft Entra ID says "out-of-the-box provisioning is not supported", or there are no Tenant URL and Secret Token fields.
  • You want to know what happens to users who already exist in Freshservice.
  • You are moving from the Freshservice Probe (Discovery Agent) to SCIM.

Cause

The SCIM app is not the native "Freshservice" app or the SAML Toolkit in the Microsoft gallery. SCIM also matches users by userName, so existing users need care on the first sync.

Use the right app

  1. In Freshservice, install Azure Active Directory provisioning (SCIM) from Admin > Apps as an Account Admin (or a user with admin privileges, never an Occasional Agent). This gives you the Tenant URL and OAuth token.
  2. In Microsoft Entra ID, go to Enterprise applications > New application, search Freshservice Provisioning, and add it.
  3. Open Provisioning, enter the Tenant URL and token, click Test Connection and set the mappings before you start.

First sync with existing users

  1. SCIM checks if a user with that userName (the primary email) exists. If yes, it updates the user. If not, it creates one. Existing users are not duplicated.
  2. Set the scope to "Sync only assigned users and groups" and assign a small test group.
  3. Run Provision on demand for one existing user (see How to Test One User with Provision on Demand). Confirm the user was updated, not duplicated. Then widen the scope.
  4. Microsoft Entra ID cannot scope by OU. Create a security group that contains the OU members and assign that group.
  5. isAgent set to true creates an agent. False creates a requester.

Moving from the Probe to SCIM

  1. Turn off Probe user sync before you turn on SCIM. If both run, the Probe can create a duplicate.
  2. Turn on SCIM and let one full cycle finish. It links each existing user and stores the Microsoft Entra ID object ID in the user's external ID. Keep the externalId mapping.
  3. Check a sample of users before you widen the scope.

Other notes

  • Hybrid setups work: changes in on-premises AD sync to Microsoft Entra ID, and SCIM sends them on the next cycle.
  • Okta: if the app is missing, or you see "Cannot create application instance", Okta support or your Okta account team can help. SWA sign-on credentials are not used for SCIM.

Sources

  • KB: How to Test One User with Provision on Demand
  • KB: OAuth Token Expired or Not Authorized Error: How to Fix