SCIM provisioning with Microsoft Entra ID

Before you start

You are an owner or admin of the Farside workspace.
You can manage enterprise applications in Microsoft Entra.
You have the Farside SCIM tenant URL: https://api.farsideresearch.com/scim/v2

Create a provisioning token

An owner or admin creates the token in Farside under Settings, then Security, then Provisioning. Give it a name you will recognize later, such as the identity provider it belongs to.

Farside shows the token once. Copy it somewhere safe before you close the dialog, because it cannot be shown again. If you lose it, rotate the token and paste the new one into your identity provider. You can revoke a token at any time, and a workspace can have up to 5 active tokens.

Add the application in Entra

In the Entra admin center, go to Enterprise applications and choose New application, then Create your own application. Name it Farside and pick the option to integrate an application that is not in the gallery. If you already have a Farside enterprise application for single sign-on, open that one instead.
Open the application and choose Provisioning.

Connect Entra to Farside

Entra field	Value
Tenant URL	`https://api.farsideresearch.com/scim/v2`
Secret Token	Your fss_ token

Set Provisioning Mode to Automatic.
Under Admin Credentials, enter the tenant URL and secret token shown below.
Select Test Connection. Entra should confirm that it can reach Farside. A 401 here means the token is wrong or revoked.
Save.

Check the attribute mappings

Entra suggests mappings for users and groups. The defaults work, so keep them. Two matter most for Farside:

Farside attribute	Entra source
`userName`	`userPrincipalName, or mail if your sign-in names are not email addresses`
`active`	`Switch([IsSoftDeleted], , "False", "True", "True", "False")`

The active expression is the Entra default. It is what turns a deleted or disabled account into a deactivation in Farside.

Choose who gets provisioned

On the Settings page, set Scope to Sync only assigned users and groups. This is the safest choice while you are testing.
Under Users and groups, assign the people or groups who should have Farside access.
Switch Provisioning Status to On and save.

Wait for the first sync

Entra runs an initial sync and then repeats roughly every 40 minutes. Changes do not appear instantly. To check a single account without waiting, use Provision on demand from the Provisioning page.

Once groups have arrived in Farside, an admin maps each one to a role: Admin, Member or Read only.

What to expect once it is running

Groups pushed from your identity provider show up in Farside, where an admin can map each one to a Farside role: Admin, Member or Read only. The mapping lives in Farside, so changing a role never means editing the connector.

SCIM never changes an owner, and the last owner of a workspace cannot be removed this way.

Deactivating or deleting a user removes their membership in this workspace, revokes the API keys they created in it and signs out connected apps for it. Their Farside account and any other workspaces they belong to are untouched.

If a user's email domain is not verified by the workspace, Farside sends them an email invitation instead of creating an instant account. They join once they accept it.

Every SCIM change is written to the audit log.

Troubleshooting

Symptom	Likely cause	What to do
401 Unauthorized	The token was revoked, rotated, or pasted incorrectly.	Create or rotate a token in Settings, Security, Provisioning, then paste the new value. If your provider wants the whole header value, send it as Bearer followed by the token.
400 with scimType invalidValue on a new user	The userName is not an email address.	Map userName to the person's email in your provider. Farside uses it as their sign-in address.
400 with scimType mutability on deactivate or a role change	The person is a workspace owner. Owners are managed in Farside, never by SCIM, and the last owner can never be removed.	Change or remove the owner in Farside under Settings, Members. Unassign them in your provider afterwards if you like.
403 seat limit reached	The workspace has no free seats for another active member.	Add seats on the billing page or deactivate someone, then retry the push.
403 on every request with a valid token	The workspace IP allowlist blocks your provider's servers. SCIM calls follow the same allowlist as people.	Add your provider's published egress IP ranges to the allowlist under Settings, Security.
409 Conflict	A user with that userName or email already exists in the workspace.	Match the existing person instead of creating a duplicate. Check the userName and email values your provider sends, then retry.
429 Too Many Requests	The token went over 600 requests per minute.	Wait a minute and let the provider retry. For a very large first sync, assign people in batches.
A user got an email invitation	Their email domain is not verified by the workspace.	Verify the domain in Farside if you want instant accounts, or have the person accept the invitation.

Last updated November 11, 2026. More on how we protect access is on the security page.