Skip to main content

Microsoft Entra ID Integration Guide (SCIM)

Sync Fellow users and teams automatically from Entra ID

SCIM (System for Cross-domain Identity Management) lets your identity provider manage user accounts in other apps for you. When you connect Microsoft Entra ID to Fellow with SCIM, the people you assign to Fellow in Entra ID are created, updated, and deactivated in Fellow automatically. This guide walks you through enabling SCIM in Fellow, connecting it in Entra ID, and testing it before you turn it on.

Note: SCIM provisioning is available on the Enterprise plan and can only be set up by a workspace administrator.

Supported Features

Feature

Description

Create users

People you assign to the Fellow application in Entra ID are automatically created in Fellow.

Update user attributes

Changes to a user's name, job title, or manager in Entra ID are synced to Fellow.

Deactivate users

Removing a user from the Fellow application, or blocking their sign-in in Entra ID, marks their Fellow account as Disabled.

Reactivate users

Reassigning a user to the Fellow application restores their access and marks their account as Enabled.

Group provisioning

You can sync Entra ID groups to Fellow as Teams (optional).

Requirements

  • A Fellow account on the Enterprise plan

  • A Fellow workspace administrator account

  • A Microsoft Entra ID account with at least the Application Administrator role, or help from your IT team

Step 1: Enable SCIM in Fellow

  1. Sign in to Fellow using a workspace administrator account.

  2. Click your workspace logo, then go to Workspace Settings > Integrations > SCIM2 card.

  3. Click the Connect button in the top-right corner of the page.

  4. Click Regenerate SCIM token and confirm when prompted.

  5. Copy the token from the Copy your SCIM token window and store it somewhere secure. You'll need it in Part 2. The token is only shown once, so copy it before you close the window.


Step 2: Configure SCIM in Microsoft Entra ID

2.1 Create the Fellow application

  1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com.

  2. Go to Identity > Applications > Enterprise applications > New application.

  3. Create your own application.

  4. Enter Fellow as the name, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

2.2 Connect provisioning to Fellow

  1. In the Fellow application, select Provisioning in the left menu, then click Get started.

  2. Set Provisioning Mode to Automatic.

  3. Under Admin Credentials, enter the following:

    • Tenant URL: https://fellow.app/scim/v2

    • Secret Token: the SCIM token you copied in Part 1

  4. Click Test Connection and wait for the success message.

  5. Click Create.

2.3 Review attribute mappings

Fellow identifies each user by their email address, so Entra ID needs to send each user's email as their username.

  1. In the "Attribute mapping" section, check that userPrincipalName attribute from Entra ID (source) is mapped to the userName attribute (it should be a default value)

  2. Then, you can check in your workspace users list that the "User principal name" field is the email address:
    ​

2.4 Choose who gets provisioned

  1. Under Provisioning → Settings, set Scope to Sync only assigned users and groups.

  2. (Optional) Add an email address under Notification Email to get alerts when provisioning fails.

  3. Select Users and groups in the left menu, click + Add user/group, and assign the users and groups who should have access to Fellow.

Note: Assign groups that contain users directly. Members of nested groups (groups inside other groups) aren't provisioned.
​

2.5 Test and turn on provisioning

  1. Go to Provisioning → Provision on demand, select one user, and click Provision. Check that the result shows success.

  2. In Fellow, go to Workspace Settings → Users & teams and check that the user now appears in the list.

  3. Back in Entra ID, set Provisioning Status to On and click Save.
    ​

You're all set. The first sync runs right away. After that, Entra ID syncs about every 40 minutes, so changes you make in Entra ID can take a little while to appear in Fellow.
​

Troubleshooting & Tips

  • Changing email addresses or domains? Contact the Fellow support team before you make the change in Entra ID. This also applies to merging user accounts or moving users between domains, and helps you avoid provisioning errors.

  • Review your assignments before turning provisioning on. Every provisioned user receives a Fellow welcome email.

  • Use the provisioning logs to find issues. If a user doesn't appear in Fellow, open Provisioning logs in the Fellow application in Entra ID to see which user failed and why.

  • Set up sign-in separately. SCIM manages user accounts, while SSO lets users sign in with their Entra ID credentials. To set up SSO, follow the Custom OIDC SSO Integration Guide.

  • Looking for Microsoft 365 User sync? Fellow's Microsoft 365 User sync is a separate feature, found under Workspace Settings > Integrations > User sync. This guide covers SCIM provisioning only.

If you need help with this process, contact Fellow Support through the Intercom bubble or through [email protected].

Related Articles
Did this answer your question?