Skip to main content
Set up SCIM 2.0 provisioning from Microsoft Entra ID, formerly Azure Active Directory, so it pushes users to OutKept as they change.
You need Global Administrator or Application Administrator rights in your Azure tenant.

​
Generate a SCIM token

This bearer token authenticates every provisioning request from Entra ID to our platform.
1

Open the import wizard

Log into the OutKept platform as an administrator. Go to Manage your data and click Import data, or click Start onboarding.
2

Choose SCIM

Select SCIM as your sync type.
3

Generate

Click Generate SCIM Token.
4

Copy it

The token starts with outkept_scim_. Copy it now.
Store this token securely. It is only shown once. To regenerate, return to the same screen. The old token is invalidated immediately and stops working.

​
Create the enterprise application

1

Open Entra ID

Go to portal.azure.com and sign in with your admin account. Navigate to Azure Active Directory then Enterprise applications.
2

Create your own application

Click New application, then Create your own application.
3

Name it and set the type

Enter a name, for example OutKept SCIM. Select Integrate any other application you don’t find in the gallery (Non-gallery). Click Create.

​
Configure provisioning credentials

1

Open provisioning

Inside the new application, click Provisioning in the left sidebar, then New Configuration at the top or Connect your application from the list.
2

Set the authentication method

Choose Bearer authentication, then fill in:
3

Test the connection

Click Test connection. Entra ID calls GET /scim/v2/Users with your token. On success, a connected status appears both in the Azure admin center and on the OutKept platform.
4

Save

Click Save to confirm.
If the test fails, confirm there is no trailing slash on the Tenant URL and that the full token was pasted without extra spaces.

​
Configure attribute mappings

Attribute mappings define which fields from Entra ID are sent to OutKept and how they map to OutKept user fields. Correct mapping is what makes targeting and personalisation work.

​
Select users to sync

By default Entra ID can sync your entire tenant. For most campaigns you want to limit it to a specific group. Create a security group in Entra ID containing only the employees in scope, for example OutKept Campaign Users, then assign that group to the application.
1

Set the scope

Under Settings, set Scope to Sync only assigned users and groups.
2

Assign the group

Go to Users and groups then Add user/group, and assign your security group.
Only members of the assigned security group are synced. To add or remove someone from the sync, add or remove them from that group in Entra ID. Nothing in the SCIM configuration needs to change.

​
Map the attributes

On the Provisioning page, click Manage to expand the section, then Attribute mapping. Only email, country and language are mandatory. Everything else improves targeting quality and is strongly recommended.
Mapping department and jobTitle significantly improves phishing targeting. The more context available, the more realistic the simulations.

​
Start provisioning

​
Enable provisioning

1

Turn it on

Go back to the Provisioning page of the application, set Provisioning Status to On, and click Save.
2

Start it

Go to Overview and click Start provisioning.

​
Monitor the initial cycle

Entra ID runs an initial full sync. This can take 20 minutes to several hours depending on user count. On the Provisioning page, click Provisioning logs and look for Action = Create and Status = Success for each user.

​
Verify in OutKept

Log into the platform as an administrator, go to Manage your data, and confirm synced users appear with correct tags for country and language.
After the initial sync, Entra ID runs incremental cycles roughly every 40 minutes. New members of the security group are provisioned automatically.

​
How the sync works

Once provisioning is active, Entra ID is the source of truth for user data. Our SCIM endpoint receives and processes all provisioning requests automatically.

​
User lifecycle

Deactivated users are not deleted, and their interaction history is preserved. Use Include deleted persons in the dashboard to keep them in your statistics.

​
Tag mapping after sync

When a user arrives via SCIM, their attributes go through our tag mapping system. Values we have seen before, such as a known department, are applied automatically. New values must be mapped once by hand under Manage your data then Map data. See Mapping column values.

​
Supported SCIM operations

Base URL:
Every request from Entra ID includes the SCIM token in the Authorization: Bearer header. Invalid or missing tokens are rejected with HTTP 401.

​
Attribute reference

Email, country and language are mandatory. A user missing any of these cannot receive simulations.
The country tag determines the cultural context of simulations. Make sure it reflects where the employee works, not necessarily their nationality.

​
Troubleshooting

For anything not listed here, contact support@outkept.com with your organisation name and a screenshot of the Azure provisioning logs.

​
Next

Once users are in, continue to Email delivery.