A Security Admin turns on SCIM User Provisioning under Settings > Integrations > Microsoft Entra Identity Integration and generates a token. Your Entra administrator adds it to an OpenApply enterprise app. Entra then creates, updates and archives staff accounts, and Group Mapping puts each person in the right department.
For Security Admins and school IT: let Microsoft Entra ID manage OpenApply staff accounts.
Why it helps
- New staff arrive ready. Someone assigned to the OpenApply app in Entra gets an account in the right department, with no invitation.
- Profiles stay in step. Name and email follow Entra.
- Leavers lose access on time. Deactivating someone in Entra archives their OpenApply account. Nothing is deleted.
Before you start
- A Security Admin in OpenApply.
- Microsoft sign-in set up on Settings > Integrations > Microsoft Entra Identity Integration (Client ID, Client Secret and Tenant ID saved). See Microsoft SSO.
- An Entra administrator with the Application Administrator or Cloud Application Administrator role.
Step 1: In OpenApply
Go to Settings > Integrations > Microsoft Entra Identity Integration and scroll to SCIM User Provisioning.
Tick Enable SCIM provisioning and save.
Type a Token name, such as "Entra production app", and select Generate New Token.
Copy the token. It is shown only once; if you leave the page first, revoke it and generate another.
Copy the Tenant URL (yourschool.openapply.com/scim/v2) and pass both to your Entra administrator.
Step 2: In the Microsoft Entra admin centre
| # | Where | What to do |
|---|---|---|
| 1 | Enterprise applications > New application > Create your own application | Name it after your school and choose the non-gallery option. Create one app per OpenApply school |
| 2 | The app > Provisioning | Set Provisioning Mode to Automatic |
| 3 | Provisioning > Admin Credentials | Paste the Tenant URL and, as Secret Token, the token. Select Test Connection, then Save |
| 4 | Provisioning > Mappings > Provision Microsoft Entra ID Users | Change the source of the externalId row from mailNickname to objectId |
| 5 | Same list | Check the userName row. OpenApply stores userName as the staff email |
| 6 | Provisioning > Mappings > Provision Microsoft Entra ID Groups | Leave it enabled |
| 7 | Provisioning > Settings > Scope | Choose Sync only assigned users and groups |
| 8 | The app > Users and groups > Add user/group | Assign the groups (and any individuals) who need OpenApply accounts. Start with a test user |
| 9 | Provisioning > Provision on demand (optional) | Provision one person to check the set-up |
| 10 | Provisioning > Provisioning Status | Set it to On and save |
Entra's first sync sends everyone assigned, then it syncs about every 40 minutes. In OpenApply, the token shows Last used and the SCIM-managed count rises. Microsoft sometimes renames these menus.
Step 3: Map Entra groups to departments
On the same settings page, open Group Mapping and select Add Mapping.
Choose a department and an Entra group. Repeat for each group.
Use the arrows to put the rows in priority order. Someone in several groups gets the highest row.
Select Save Changes.
Someone removed from every mapped group stays active and keeps their department, but loses its permission groups, grades and campuses. OpenApply asks before you remove or switch off a row.
Joiners, changes and leavers
- A person added to a mapped group gets an account in that department and signs in with Microsoft.
- Name and email changes in Entra reach OpenApply at the next sync.
- Their staff page shows Managed by Microsoft Entra. Name, email, title, phone, department and photo are locked, and there is no Archive button.
- Deactivating or unassigning them in Entra archives their account at the next sync. Their records and history stay.
Make an exception for one person
Open the staff member's page and select Break SCIM Link, then confirm.
Their fields unlock and you can edit or archive them in OpenApply.
To hand them back to Entra, select Restore SCIM Link. Entra manages them again from its next sync.
Replace a token
Generate a second token with a new name.
Paste it into Entra in place of the old one.
Select Revoke on the old token.
At most two tokens can be active at once.
Things to know
- Provisioning covers staff only, not applicants or parents.
- Only Microsoft Entra can provision staff. Google Workspace remains sign-in only.
- A mapping sets a department; extra permission groups cannot be added to a mapping.
- Existing staff are linked one at a time as Entra creates or updates them. Check the Conflict count before you start.
- Entra can only archive accounts it has linked to.
- Groups nested inside an assigned group are not sent.
- School groups set up each school separately: one Entra app, one token and one set of group mappings per OpenApply school. One Entra directory and the same groups can serve every school. Staff at two schools get an account in each.
- SCIM User Provisioning is available in English, Japanese and Chinese. Group Mapping is in English and Chinese.