Microsoft Entra ID (Azure AD) SCIM Provisioning — FAQ
1. Setup
1.1. Which app should I install?
In Freshservice, install Azure Active Directory Provisioning (SCIM) from Admin > Apps. In Microsoft Entra ID, add Freshservice Provisioning from the gallery.
Do not use the Single Sign-On app or the SAML Toolkit.
See First Setup: Wrong App, First Sync and Moving from the Probe.
1.2. Who can install the app?
An Account Admin or a user with the required admin privileges can install the app. Do not use an Occasional Agent account, as its day pass is valid for only 24 hours.
1.3. Do I need special permissions in Azure?
No special permissions are required for the provisioning setup beyond the access needed to configure the application. You configure provisioning using the endpoint, OAuth token, and attribute mappings.
1.4. Does SCIM use an API key?
No. SCIM uses OAuth authentication. API keys and Integration Users are not supported.
1.5. How long is the OAuth token valid?
The token is valid for 365 days. To obtain a new token, uninstall and reinstall the Freshservice app, then update the token in Microsoft Entra ID.
See OAuth Token Expired or Not Authorized Error: How to Fix.
1.6. How often does provisioning run?
Automatic provisioning runs approximately every 40 minutes. To test provisioning immediately, use Provision on demand in Microsoft Entra ID.
See How to Test One User with Provision on Demand.
1.7. What happens to users who already exist in Freshservice?
Users are matched using the userName attribute. If a match is found, the existing user is updated. If no match is found, a new user is created.
2. Mappings and Fields
2.1. Which attribute is used to match users?
Microsoft Entra ID's userPrincipalName is mapped to Freshservice's userName. This is the attribute used to match users during provisioning.
2.2. Should I remove the externalId mapping?
No. Keep the externalId mapping to ensure provisioning works correctly.
2.3. How do I map a custom field?
Create the custom field in Freshservice.
Open the app's Settings page and copy the field's exact name.
Add the SCIM attribute using the following format:
urn:ietf:params:scim:schemas:extension:freshservice:2.0:User:<field_name>Map the new attribute to the appropriate source attribute in Microsoft Entra ID.
2.4. Why does the Location field remain empty?
The SCIM attribute must be named _location, including the leading underscore. The value sent from Microsoft Entra ID must also match an existing Freshservice location exactly.
2.5. Why does Employee ID provisioning fail?
Microsoft Entra ID sends Employee ID as a string, so the corresponding Freshservice field must be a text field.
See Invalid Field Values: Dropdown, Mandatory Field and Data Type Errors.
2.6. Which language codes are supported?
Use only supported language codes, such as en, fr, and de. Regional codes such as fr-FR and de-DE are not valid.
2.7. Why is the Manager field empty?
The manager attribute must be configured with the Reference data type. The manager must also exist in Freshservice before the direct report is provisioned.
2.8. Can I sync the Department field?
Yes. Map the Microsoft Entra ID enterprise department attribute to the corresponding Freshservice field. The department must already exist in Freshservice, and the value must match exactly.
3. Users and Access
3.1. Does SCIM delete users from Freshservice?
No. SCIM deactivates users rather than deleting them.
3.2. Why were users deactivated in Freshservice?
Users may be deactivated if they are disabled in Microsoft Entra ID, removed from the application, or moved out of the provisioning scope.
See Users Deactivated in Freshservice: How to Find the Cause.
3.3. Can I prevent SCIM from deactivating users?
Yes. Remove the active attribute mapping. Users who leave the organization must then be deactivated manually in Freshservice.
3.4. Why did an agent return as an Occasional Agent?
When SCIM reactivates an agent, Freshservice may assign the Occasional Agent role. If the user requires a different role, reassign the appropriate role in Freshservice.
3.5. Why was a duplicate user created after an email change?
This can happen if Microsoft Entra ID loses the Freshservice user ID, often after the application is removed or the user is unassigned and then assigned again.
See Duplicate Users After an Email Change: How to Fix.
3.6. Are groups supported by SCIM?
No. Groups are skipped during provisioning, but their members are provisioned as users.
See What the SCIM Integration Does Not Support.
3.7. Can I use SCIM with multiple Microsoft Entra ID tenants?
Yes, using a workaround: configure the same SCIM endpoint URL and OAuth token in each tenant.
4. Troubleshooting and Errors
4.1. How do I fix the error "You are not authorized to perform this action"?
This error may occur if the OAuth token has expired or the user who installed the app no longer has the required admin privileges.
Reinstall the Freshservice app to generate a new token, then update the token in Microsoft Entra ID.
See OAuth Token Expired or Not Authorized Error: How to Fix.
4.2. What does RedundantExport mean?
RedundantExport indicates that there are no changes to apply for the user. It is informational and does not indicate a provisioning error.
4.3. How can I identify the cause of a provisioning error?
Open the provisioning logs in Microsoft Entra ID.
Select the affected user and review the error details.
Match the error message to the relevant troubleshooting steps.
See:
How to Read Provisioning Logs and Find the Cause of an Error
Mapping Errors: Find the Fix by Error Message
4.4. Does Okta provisioning work the same way?
The overall provisioning process is similar, but custom fields, manager attributes, and deactivation settings require different configurations.
See Okta Provisioning for Freshservice: Common Fixes.
5. Related Knowledge Base Articles
Refer to the articles linked throughout this FAQ for detailed setup instructions and troubleshooting steps.