SCIM User Provisioning with Salesforce (via External Client App)

Question

SCIM User Provisioning with Salesforce (via External Client App)

Dinu Dinuw 10

I understand that the original Entra Enterprise App for Salesforce Provisioning no longer works due to the change from "Connected App" to "External Client App" (OAuth Client Credentials) on the Salesforce side.
Is there an updated version of the Entra Enterprise App for Salesforce that work with the new approach?

Alternatively has anybody managed to successfully create a custom App and create a User in Salesforce?

Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-23T21:24:11.7466667+00:00
Hey Dinu, the short story is that the built-in Salesforce gallery app in Microsoft Entra today still only speaks the “Connected App + username / token” model. It hasn’t yet been updated to support Salesforce’s new External Client App (OAuth-client-credentials) flow for SCIM. If you need to go fully OAuth 2.0 Client Credentials you’ll have to:

Create a custom Salesforce External Client App • In Salesforce Setup → App Manager → New Connected App (or External OAuth Client, depending on your edition) • Enable API access and the scopes needed for user provisioning (e.g. Manage Users, full SCIM access) • Copy the Client ID, Client Secret, Token endpoint (https://login.salesforce.com/services/oauth2/token or your sandbox equivalent) • Note your SCIM Base URL (usually https://<yourInstance>.my.salesforce.com/services/scim/v2)

Stand up a non-gallery Enterprise App in Entra ID • In the Entra portal go to Enterprise Applications → + New application → Create your own application → “Non-gallery” • Name it something like “Custom Salesforce SCIM” • On the Provisioning tab switch to Automatic

Hook up the OAuth2-CC admin credentials • Under Admin Credentials choose OAuth 2.0 • Tenant URL = your SCIM Base URL (…/services/scim/v2) • Token URL = Salesforce token endpoint • Client ID & Client Secret = what you grabbed from the External Client App in Salesforce • Save and Test Connection

Configure attribute mappings & scope • Map core SCIM attributes: userName, emails (primary), displayName, active • In Scope you can assign the groups/users you want to provision • Hit “Provision on Demand” to sanity-check a single user

Monitor & troubleshoot • Watch the provisioning logs in Entra ID for HTTP/400-series errors or missing-field messages • On Salesforce’s side check SCIM logs or use Postman/cURL to hit GET /Users

If you really want to stay on the “gallery” path today you’ll have to keep using the older model (username+security-token). But for full OAuth2 client-credentials support that custom non-gallery SCIM app is the way to go.

Hope this helps! Let us know how the test connection goes or if you hit any errors.

Reference links

Configure Salesforce provisioning with Entra ID (basic username / token model): https://learn.microsoft.com/entra/identity/saas-apps/salesforce-provisioning-tutorial

Build & configure a SCIM endpoint in Entra ID: https://learn.microsoft.com/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups

SCIM protocol compliance in Entra provisioning: https://learn.microsoft.com/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-25T19:54:01.1833333+00:00

Hello Dinu Dinuw

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Dinu Dinuw 10 Reputation points

2026-03-26T21:05:50.61+00:00

Hi @Rukmini

Unfortunately we haven't managed to fully resolve the issue. While we can connect we can not create a new user.

We get the following error back from Salesforce:

Failed to create User ‘`******@ourcompany.com`' in customappsso;

Error: StatusCode: Conflict Message: Processing of the HTTP request resulted in an exception.

Web Response: {"schemas":"[\"urn:ietf:params:scim:api:messages:2.0:Error\"]", "detail":"REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid;", "status":409}

The problem seems to be that the ProfileID has not been specified correctly in the payload.
This works fine if we use Postman and add "entitlement" with the ProfileId to the POST payload.

Any idea how we can configure Entra to add the ProfileId into the payload as expected by Salesforce?
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-26T21:11:31.7166667+00:00

Hello Dinu Dinuw

The error is expected — Salesforce SCIM requires a ProfileId (entitlement), but Entra does NOT send it by default. You must add a custom attribute mapping for entitlements.
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-27T17:13:53.12+00:00

Hello Dinu Dinuw Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Dinu Dinuw 10 Reputation points

2026-03-30T03:01:17.9366667+00:00

Hi @Rukmini

While I appreciate that we need to send the ProfileId field, I am not sure how to configure Entra to do that. Here is how we have configured the mapping:

What should the Custom attribute/Entra Attribute mapping look like to specify a ProfileId?
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-30T18:59:27.94+00:00

Hello Dinu Dinuw

Thank you will check internally and get back to you!
Laurie Aldam 0 Reputation points

2026-04-20T12:15:40.4933333+00:00

@Dinu Dinuw did you manage to add the custom attribute?
Dinu Dinuw 10 Reputation points

2026-04-21T09:34:16.11+00:00

@Laurie Aldam
No, instead we managed to fix this in another way. We raised a Salesforce support case to enable the "reset my security token" setting, based on this article: https://help.salesforce.com/s/articleView?id=000386179&type=1
With that the option to reset my security token is back and the standard Salesforce Entra id enterprise App can be used.

1 answer

Your answer

Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-25T19:54:01.1833333+00:00

Hello Dinu Dinuw

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Dinu Dinuw 10 Reputation points

2026-03-26T21:05:50.61+00:00

Hi @Rukmini

Unfortunately we haven't managed to fully resolve the issue. While we can connect we can not create a new user.

We get the following error back from Salesforce:

Failed to create User ‘`******@ourcompany.com`' in customappsso;

Error: StatusCode: Conflict Message: Processing of the HTTP request resulted in an exception.

Web Response: {"schemas":"[\"urn:ietf:params:scim:api:messages:2.0:Error\"]", "detail":"REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid;", "status":409}

The problem seems to be that the ProfileID has not been specified correctly in the payload.
This works fine if we use Postman and add "entitlement" with the ProfileId to the POST payload.

Any idea how we can configure Entra to add the ProfileId into the payload as expected by Salesforce?
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-26T21:11:31.7166667+00:00

Hello Dinu Dinuw

The error is expected — Salesforce SCIM requires a ProfileId (entitlement), but Entra does NOT send it by default. You must add a custom attribute mapping for entitlements.
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-27T17:13:53.12+00:00

Hello Dinu Dinuw Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Dinu Dinuw 10 Reputation points

2026-03-30T03:01:17.9366667+00:00

Hi @Rukmini

While I appreciate that we need to send the ProfileId field, I am not sure how to configure Entra to do that. Here is how we have configured the mapping:

What should the Custom attribute/Entra Attribute mapping look like to specify a ProfileId?
Rukmini 36,955 Reputation points Microsoft External Staff Moderator

2026-03-30T18:59:27.94+00:00

Hello Dinu Dinuw

Thank you will check internally and get back to you!
Laurie Aldam 0 Reputation points

2026-04-20T12:15:40.4933333+00:00

@Dinu Dinuw did you manage to add the custom attribute?
Dinu Dinuw 10 Reputation points

2026-04-21T09:34:16.11+00:00

@Laurie Aldam
No, instead we managed to fix this in another way. We raised a Salesforce support case to enable the "reset my security token" setting, based on this article: https://help.salesforce.com/s/articleView?id=000386179&type=1
With that the option to reset my security token is back and the standard Salesforce Entra id enterprise App can be used.

Answer 1

Danstan Onyango 3,996 Microsoft Employee

As of now, the original Entra Enterprise App for Salesforce Provisioning may not function correctly due to changes in Salesforce’s API structure, specifically the transition from “Connected App” to “External Client App” (OAuth Client Credentials). However, The guides below are on how to set up automatic user provisioning with Salesforce, which includes steps to configure the necessary settings in both Microsoft Entra and Salesforce. This guide outlines prerequisites, configuration steps, and common issues that may arise

https://learn.microsoft.com/en-us/entra/identity/saas-apps/salesforce-provisioning-tutorial?source=docs

Ensure to check the common issues here https://learn.microsoft.com/en-us/entra/identity/saas-apps/salesforce-provisioning-tutorial?source=docs#common-issues

Dinu Dinuw 10 Reputation points

2026-03-26T21:14:33.28+00:00

Hi @Danstan Onyango

Sadly neither of these reference have helped us resolve the issue.
The root cause is that we do not know how to configure an Entra Custom App to add the Salesforce ProfileId to the "Create User" POST payload in the format expected by Salesforce.

Share via

SCIM User Provisioning with Salesforce (via External Client App)

1 answer

Your answer