With SCIM provisioning, Microsoft Entra ID keeps your Marvia users and groups up to date for you. When someone joins, changes or leaves your organization, Entra ID creates, updates or deactivates their Marvia account automatically. You no longer need to add or import users by hand.

Entra ID is the source of truth: changes are pushed from Entra ID to Marvia, never the other way around.

Before you start

You are an administrator in Microsoft Entra ID.
Single Sign-On is set up for Marvia. You configure SCIM in the same Marvia enterprise application, and users created through SCIM sign in with SSO, not with a Marvia password. See How do I configure Single Sign-On (SSO) in my Microsoft environment for Marvia?

1. Request SCIM credentials from Marvia

Ask your Customer Success Manager for:

Tenant URL: https://api.getmarvia.com/scim/v2
Secret Token: a unique token for your organization that Entra ID uses to connect to Marvia.

⚠️ Important: Treat the Secret Token like a password. Don't share it by email or chat, and store it only in Entra ID.

2. Turn on provisioning in Entra ID

In the Microsoft Entra admin center (entra.microsoft.com), go to Identity › Applications › Enterprise applications.
Select your existing Marvia application (created during the SSO setup).
Under Manage, select Provisioning.
Click Get started (or Edit provisioning).
Set Provisioning Mode to Automatic.

3. Enter the credentials

Expand Admin Credentials.
Enter the Tenant URL and the Secret Token from step 1.
Click Test Connection. You should see a message that the connection works.
Click Save.

4. Check the mappings

Expand Mappings.
Make sure Provision Microsoft Entra ID Users is enabled (Yes).
Click Provision Microsoft Entra ID Users and check that these attributes are mapped:

Marvia (SCIM) attribute	Becomes in Marvia	Notes
`userName`	Username	Usually mapped to userPrincipalName or mail. Must be unique.
`name.givenName`	First name
`name.familyName`	Last name
`emails[type eq "work"].value`	Email address	Primary work email
`active`	Status Active / Inactive	Controls activation and deactivation

Want Entra ID groups synced to Marvia as well? Also enable Provision Microsoft Entra ID Groups. Click Save after making changes.

5. Assign users and groups

Go back to the Marvia application and select Users and groups.
Click + Add user/group and assign the users and groups that should be created and kept up to date in Marvia.

6. Start provisioning

Go back to Provisioning.
Under Settings, set Scope to Sync only assigned users and groups (recommended).
Set Provisioning Status to On.
Click Save.

Entra ID now starts provisioning. The first run can take a while, after that changes follow on Entra ID's regular schedule.

What happens in Marvia

Users

New users are created with the language English. Users can change this themselves.
Users are never deleted. When a user is removed or disabled in Entra ID, their Marvia account is set to Inactive.

Groups

Entra ID creates the group in Marvia with the same name and keeps its members up to date. Only active users can be members.
A new group has no permissions yet. Give it the right permissions in Marvia under Accounts › Groups. SCIM only manages who is in the group.
When a group is removed in Entra ID, it is deleted in Marvia as well.

Note: SCIM only manages users and groups that were created through SCIM. Users and groups you created in Marvia yourself are not changed.

Troubleshooting

Test Connection works, but provisioning fails: the token is missing permissions. Contact your Customer Success Manager.
A user isn't created: check whether another Marvia user already has the same username. Usernames must be unique.

How do I set up SCIM user provisioning with Microsoft Entra ID?