Microsoft Entra ID provisioning

Sign in with Microsoft, and have andteam create and switch off Microsoft accounts on time.

For the IT administrator of the customer’s Microsoft directory. Three steps, about ten minutes. When you are done, people sign in to andteam with their Microsoft account, and andteam creates and switches off their Microsoft accounts on time.

​

Before you start

• You need a Global Administrator or a Privileged Role Administrator of the directory. Step 1 grants permissions to andteam’s app, and only those roles can.
• You also need an andteam administrator with the Integrations permission, who does steps 1 and 3 in andteam. They can be the same person, or two people working together.
• Nothing is created or changed in your directory until you finish step 1, and andteam never deletes an account (see the end).

​

Step 1. Connect in andteam

1. In andteam, open Settings, Integrations, Microsoft Entra ID and choose Connect Microsoft Entra ID.
2. Microsoft’s consent screen opens. Sign in as the administrator and read the permissions it lists.

The consent screen asks for these, and nothing else:

Permission	Why andteam asks for it
openid, profile, email	So people sign in to andteam with their Microsoft account.
SynchronizationData-User.Upload	To send people to your provisioning app (step 2).
AuditLog.Read.All	To read the app’s provisioning log, so andteam can show whether each account was created or failed.
User.Read.All	To read back the new account’s sign-in name, so andteam does not ask anyone to type a work email twice.
Organization.Read.All	To read your directory’s name and verified domains when it connects.

The last four are application permissions: andteam’s app acts as itself, not as a signed-in person. None of them can create apps, change directory settings or delete accounts.

3. Choose Accept. Microsoft returns you to andteam, which now shows Connected with your directory’s name. Sign-in with Microsoft works from here, with nothing pasted.

​

Step 2. Create the provisioning app in Entra

andteam sends people to an app in your directory, which then creates the accounts. You create that app once, from Microsoft’s gallery.

1. Open the Microsoft Entra admin center and go to Entra ID, Enterprise apps, New application.
2. Search the gallery for API-driven provisioning to Microsoft Entra ID and choose Create.
3. Open the new app’s Provisioning page, set it to Automatic, and Start provisioning.
4. On the Overview page of the provisioning job, copy the Provisioning API endpoint. It looks like this:

https://graph.microsoft.com/v1.0/servicePrincipals/{id}/synchronization/jobs/{jobId}/bulkUpload

​

Step 3. Paste it in andteam

1. Back in andteam, under Microsoft Entra ID, Provisioning, paste the endpoint into Provisioning API endpoint and choose Save.
2. andteam sends a request that changes nothing, to check that the permission and the job work. The section then says Connected. If it does not, check that the permission was consented (step 1) and that the job is running (step 2).

That is all that is required. The defaults below mean nothing else needs setting.

​

The attribute mapping in Entra

andteam sends each person as SCIM, and the gallery app’s default mapping already matches the standard attributes: externalId (the employee number) is matched to the user’s employeeId, so a person is found, not duplicated.

andteam sends	Entra attribute
externalId (employee number)	employeeId (the matching key)
active	account enabled
name.givenName, name.familyName, displayName	first name, last name, display name
userName (work email, when andteam has one)	user principal name
title	job title
enterprise:department, division, organization, costCenter	department, division, company name, cost centre
enterprise:manager	manager
addresses[work].locality	city

The andteam extension, for Lifecycle Workflows. andteam also sends two dates in its own extension, urn:ietf:params:scim:schemas:extension:andteam:1.0:User:

• hireDate, the start date, which maps to Entra’s employeeHireDate.
• leaveDate, the moment sign-in ends, which maps to Entra’s employeeLeaveDateTime.

These are what Entra Lifecycle Workflows use to run joiner and leaver tasks. To use them, add the extension to the provisioning app’s schema and map the two attributes:

1. In the provisioning app, open Attribute mapping, then Show advanced options, then Edit attribute list for API.
2. Add urn:ietf:params:scim:schemas:extension:andteam:1.0:User:hireDate and …:leaveDate, both of type DateTime.
3. Add two mappings: hireDate to employeeHireDate and leaveDate to employeeLeaveDateTime.

Optional attributes, off by default, can be switched on in andteam under Microsoft Entra ID, Attributes: work phone, employment type, grade and personal email. The same page has Preview for one person, which shows the exact request andteam would send. andteam never sends ID or passport numbers, date of birth, gender, race, disability, health, medical aid, bank, tax or pay details: there is no setting that adds them.

​

When accounts are created and switched off

These are set in andteam under Microsoft Entra ID, Provisioning. The defaults are what most customers want.

Setting	Default	What it does
Create the account [N] days before the start date	14	The account is created this many days ahead (0 to 60). If the hire becomes final later than that, the account is created then.
Sign-in starts	On the start date	Sign-in works from 00:00 on the start date. When the account is created lets people sign in early, for pre-boarding.
Sign-in ends	At the end of the last day	Sign-in ends at 23:59 on the last day. At the start of the last day ends it at 00:00 on that day. [N] days after the last day extends it.

End access now on a dismissal switches the account off immediately. It is always available and is not a setting.

Times are in the company’s time zone. andteam sends people at the pace Microsoft allows (50 people a request, a few requests a minute), so a large first sync takes a while.

​

What andteam never does

• It never deletes an account. When someone leaves, the account is switched off (disabled) on time and left for you to retire by your own process.
• Entra is the target. andteam is the source of truth for the attributes it sends: a value changed in Entra is overwritten by the next push. Change it in andteam instead.
• It only reaches people in scope. Under People you choose which companies and employment types are sent. Candidates, whose hire is not yet final, have no account.
• It never asks for more than the permissions above. Disconnecting in andteam stops provisioning and returns everyone to the email-code sign-in. Accounts already in Entra are left as they are.

​

If something fails

andteam’s Microsoft Entra ID section shows how many accounts need attention. Failures are listed with the person they belong to. The usual causes are a missing permission consent (repeat step 1), a provisioning job that is not running (step 2), and a person with no employee number in andteam, which Entra cannot match. andteam tells the people you chose under Tell when something fails.