Overview
Pitchly supports SCIM provisioning with Microsoft Entra ID, allowing your organization to automatically provision and deactivate users and synchronize groups with Pitchly.
With SCIM provisioning, you can:
Provision users assigned to Pitchly in Microsoft Entra ID.
Deactivate users when they should no longer have access to Pitchly.
Synchronize Entra groups and group memberships.
Map Entra groups to Pitchly teams to manage team assignments.
Note: SCIM provisioning is configured separately from SSO. If your existing Microsoft Entra enterprise application is used for SSO and does not support automatic provisioning, you can continue using it for SSO and create a second application specifically for SCIM provisioning.
Step 1: Create a Provisioning Application
In the Microsoft Entra Admin Center, navigate to:
Entra ID > Enterprise applications > New application
Click Create your own application.
Select Integrate any other application you don't find in the gallery.
Create the application.
Open the newly created application and navigate to Provisioning.
Click New configuration.
SSO Note: If your existing gallery enterprise application does not support automatic provisioning, keep the existing application for SSO and use the new non-gallery application for SCIM. Assign the same Entra users and groups to both applications as needed.
Step 2: Configure the SCIM Connection
Within the provisioning configuration, enter the SCIM credentials provided by Pitchly:
Entra Field | Value |
Tenant URL | Pitchly supplied |
Secret Token | Pitchly supplied |
Click Test Connection to verify the connection.
Do not continue with the configuration until Entra can successfully connect to the SCIM endpoint.
Step 3: Enable User and Group Mappings
Navigate to:
Provisioning > Attribute mapping
Confirm that both user and group provisioning are enabled:
Mapping | Status |
Provision Microsoft Entra ID Users | Enabled |
Provision Microsoft Entra ID Groups | Enabled |
Important: Both mappings must be enabled to provision users and synchronize groups. If Provision Microsoft Entra ID Groups is disabled, user provisioning may continue to work, but groups and group memberships will not synchronize.
For group mappings, configure at least:
Microsoft Entra Attribute | SCIM Attribute |
displayName | displayName |
members | members |
The exact mapping options displayed may vary depending on your Microsoft Entra provisioning configuration.
Step 4: Configure Group-to-Team Mapping
Pitchly supports mapping groups provisioned through SCIM to Pitchly teams. This allows users to be assigned to the appropriate Pitchly teams based on their Microsoft Entra group membership.
Provide the Pitchly team with a list of the Microsoft Entra groups you would like mapped to each Pitchly team. Pitchly will configure these group-to-team mappings for your account. Please note, this step is generally done during the SSO configuration. However, if you have not yet completed it, or if your preferences have changed, please provide the group mappings to the Pitchly team.
As group memberships are synchronized through SCIM, users will be assigned to the corresponding Pitchly teams based on these mappings.
Note: Users and groups must be included in the provisioning scope and assigned to the provisioning application for their group memberships to synchronize.
Step 5: Set the Provisioning Scope
Under Provisioning settings, set Scope to:
Sync only assigned users and groups
Next, navigate to:
Enterprise application > Users and groups > Add user/group
Assign the users and groups that should be provisioned to Pitchly.
With this scope selected, Microsoft Entra will only provision users and groups assigned to the provisioning application.
Step 6: Start Provisioning and Test
Return to:
Enterprise application > Provisioning
Turn provisioning on or click Start provisioning.
Use Provision on demand to test a specific user or group.
Review Provisioning logs to confirm what Microsoft Entra sent and whether the request completed successfully.
Timing: Microsoft Entra's standard incremental provisioning is not real-time. Entra typically runs an incremental synchronization cycle approximately every 40 minutes, so changes to users or group memberships may not appear in Pitchly immediately.
Deactivating Users
SCIM can be used to manage user access when a user should no longer have access to Pitchly.
When a provisioned user's access is removed through the configured Microsoft Entra provisioning process, SCIM communicates the change to Pitchly so that the corresponding Pitchly user can be deactivated.
This allows administrators to manage the user lifecycle through their identity provider rather than separately managing access within Pitchly.
Verification Checklist
After completing the configuration, verify that:
SCIM synchronization is enabled for both users and groups.
The SCIM user identifier is configured correctly.
Test Connection succeeds in Microsoft Entra.
Both Microsoft Entra user and group mappings are enabled.
Required users and groups are assigned to the provisioning application.
Provision on demand succeeds for a test user and test group.
Provisioning logs show successful SCIM operations.
The test user and group are successfully provisioned.
Expected group membership is synchronized.
Users are assigned to the expected Pitchly teams based on the group-to-team mappings configured by Pitchly.
Troubleshooting
If users or groups are not provisioning as expected:
Confirm that the user or group is assigned to the provisioning application.
Confirm that both user and group provisioning mappings are enabled.
Use Provision on demand to test an individual user or group.
Review the Microsoft Entra Provisioning logs for errors.
Confirm that your SCIM credentials are valid.
If users are not being assigned to the expected Pitchly teams, confirm that the appropriate Microsoft Entra groups have been provided to Pitchly for group-to-team mapping.
For further assistance, contact Pitchly Support at support@pitchly.com.