> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gumloop.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SCIM with Entra
> Configure SCIM user provisioning for Gumloop with Microsoft Entra ID (formerly Azure Active Directory)
SCIM (the system for cross-domain identity management) lets Entra synchronize user data with Gumloop through recurring communication: Gumloop periodically receives updates about the users that should have access, and uses them to provision or deprovision users — or simply update data about a user (e.g., a first name). See [SSO, SAML & SCIM](/enterprise-features/sso_saml_scim#scim-provisioning).
Entra's SCIM implementation has many unresolved issues. (See [here](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility) for a known subset.) In rare cases, Entra's unusual behavior may result in an unsuccessful integration. Please contact [support@gumloop.com](mailto:support@gumloop.com) if you encounter unexpected behavior.
Connecting Entra to Gumloop requires sharing two pieces of information with Entra, both of which come from Gumloop:
1. A **base URL** that Entra will perform operations on (e.g. via HTTP PATCH)
2. A **bearer token** that Entra will include with its requests
When Entra has both of those pieces of information, the connection is complete. No additional Gumloop-side configuration is necessary. With that said, configuration within Entra can be somewhat involved.
## Before you start: get your base URL and bearer token from Gumloop
SCIM is an Enterprise add-on — a Gumloop organization admin requests enablement via [support@gumloop.com](mailto:support@gumloop.com), then generates a setup link at [gumloop.com/settings/organization/sso](https://www.gumloop.com/settings/organization/sso). The setup page shows your SCIM **base URL** and lets you generate the **bearer token**.
Gumloop **does not store bearer tokens** — the token is shown once, at generation time. You can generate a new one at any time, which immediately invalidates the previous token.
# Configuring Entra
Start at the Entra home page. Navigate to *enterprise applications* in the navigation bar.
You'll now see a list of applications. In this case, we have just one: *test\_application*. Click the blue text to see more details about the application.
If the relevant application does not exist, you may benefit from reading the [SAML with Entra](/enterprise-features/idp-guides/saml-with-entra) guide on creating an enterprise application.
You'll see an *Overview* page. Click on the menu item labeled *Provisioning* on the left.
This will take you to a new menu. Look toward the top/center of the page for a button with a plus icon labeled *New configuration*. Click this.
You'll land on a page with a few data input options. Start with the field labeled *Tenant URL*. This is what Gumloop calls the *base URL* — the location where Entra will send its SCIM communications. Copy this value from your Gumloop SCIM setup page and paste it here.
It should look something like the below:
Next, look at the field labeled *Secret token* directly below the *Tenant URL*. This is the other value that Gumloop provides: the *bearer token*. Paste it into Entra as the *Secret token*.
The *Secret token* is sensitive. Please treat it like a password. Do not share it.
In Entra, you need to click *Test connection* to move on. Click this button and wait a moment.
Once it's clickable, hit *Create* in the lower left.
You'll land on a new page showing an overview of the Entra application. Find the *Users and groups* button in the left navbar and click it.
We need to assign users and/or groups to the application. Start by clicking the *Add user/group* button toward the top/center of the page. It's marked with a plus icon.
Exactly what you'll see might vary here, but you'll see a searchable list of users and/or groups. Decide which users should have access to the application, select each, and then press *Select* in the lower left.
You'll see another menu. If you're content with your selection, press the *Assign* button in the lower left. Entra will now consider those users and/or groups to be *assigned* to the application.
Entra will not yet have begun SCIM provisioning. To get Entra to begin SCIM provisioning, press the *Overview* button in the left navbar.
Press the *Start provisioning* button. It has a play button icon — kind of like you'd see on a remote control.
Within a few moments, you'll see a pop-up in the top right. It will say *Provisioning is scheduled to start*.
This means that Entra has successfully begun its communications with Gumloop.
# Enabling synchronization in Gumloop
Provisioned users only reach your organization once synchronization is enabled on the Gumloop side. A Gumloop organization admin returns to [gumloop.com/settings/organization/sso](https://www.gumloop.com/settings/organization/sso), selects the SCIM directory, and enables synchronization — see [Setting Up SCIM](/enterprise-features/sso_saml_scim#setting-up-scim).
Once enabled, configuration is complete: assigned users appear in your organization's member list after the next sync (automatic every 15 minutes, or triggered manually by the admin).