If you are an external tenant administrator and need to provision users into the app, you do not need to create your own App Registration or define app roles. The app roles are already defined on the existing multi-tenant app registration. By consenting to that app, an Enterprise Application (service principal) is automatically created in your tenant with all the pre-defined app roles.

Prerequisites

Before you begin, request the following from the app administrator:

Item	Description
Admin consent URL	Test: https://login.microsoftonline.com/common/adminconsent?client_id=5297c3c4-1e1a-4d0f-9c71-c82dad658318 Production: https://login.microsoftonline.com/common/adminconsent?client_id=560f4554-4d0a-4cf3-8130-a684717912ba
SCIM endpoint URL	The tenant-specific URL, e.g. `https://your.leadcast.app/scim/v2`
API token	A bearer token with SCIM permissions scoped to your tenant
Available app roles	The list of pre-defined role display names you can assign to users (optional)

Step-by-step instructions

Open the admin consent URL provided by the app administrator in your browser

Review the requested permissions and click Accept

This creates an Enterprise Application (service principal) in your tenant with the pre-defined app roles — you do not need to create anything manually

Tip: After consenting, you can find the new Enterprise Application under Identity → Applications → Enterprise Applications.

2. Configure provisioning

Open the Enterprise Application that was created by the consent step

Go to Provisioning

Click Get started

Set Provisioning Mode to Automatic

Under Admin Credentials, enter:

Tenant URL — the SCIM endpoint URL provided by the app administrator

Secret Token — the API token provided by the app administrator

Click Test Connection to verify connectivity

Click Save

3. Configure attribute mappings (optional)

Under Provisioning → Mappings, click Provision Azure Active Directory Users

Review the default attribute mappings — most fields (name, email, etc.) work out of the box

To provision app roles, click Add New Mapping and configure:

Setting	Value
Mapping type	Expression
Expression	`SingleAppRoleAssignment([appRoleAssignments])`
Target attribute	`roles[primary eq "True"].value`

Click OK, then Save

Important: Do not use Direct mapping type with appRoleAssignments — this sends the raw internal object instead of the role display name.

Note: SingleAppRoleAssignment returns the display name of the assigned app role. If you need multiple roles per user, use AppRoleAssignmentsComplex([appRoleAssignments]) instead.

4. Assign users and groups

In the Enterprise Application, go to Users and groups

Click + Add user/group

Select the users or groups to provision and assign them the appropriate app role (the roles from the original app registration are available here)

Click Assign

5. Start provisioning

Go back to Provisioning

Click Start provisioning

Entra ID will begin an initial provisioning cycle — this may take a few minutes

You can monitor progress under Provisioning → Provisioning logs.

SCIM Provisioning with Microsoft Entra ID (Azure AD)

Prerequisites#

Step-by-step instructions#

1. Grant admin consent to add the app to your tenant#

2. Configure provisioning#

3. Configure attribute mappings (optional)#

4. Assign users and groups#