> ## Documentation Index > Fetch the complete documentation index at: https://docs.andteam.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Entra ID provisioning > Sign in with Microsoft, and have andteam create and switch off Microsoft accounts on time. For the IT administrator of the customer's Microsoft directory. Three steps, about ten minutes. When you are done, people sign in to andteam with their Microsoft account, and andteam creates and switches off their Microsoft accounts on time. ## Before you start * You need a **Global Administrator** or a **Privileged Role Administrator** of the directory. Step 1 grants permissions to andteam's app, and only those roles can. * You also need an andteam administrator with the Integrations permission, who does steps 1 and 3 in andteam. They can be the same person, or two people working together. * Nothing is created or changed in your directory until you finish step 1, and andteam never deletes an account (see the end). ## Step 1. Connect in andteam 1. In andteam, open **Settings**, **Integrations**, **Microsoft Entra ID** and choose **Connect Microsoft Entra ID**. 2. Microsoft's consent screen opens. Sign in as the administrator and read the permissions it lists. The consent screen asks for these, and nothing else: | Permission | Why andteam asks for it | | - | - | | `openid`, `profile`, `email` | So people sign in to andteam with their Microsoft account. | | `SynchronizationData-User.Upload` | To send people to your provisioning app (step 2). | | `AuditLog.Read.All` | To read the app's provisioning log, so andteam can show whether each account was created or failed. | | `User.Read.All` | To read back the new account's sign-in name, so andteam does not ask anyone to type a work email twice. | | `Organization.Read.All` | To read your directory's name and verified domains when it connects. | The last four are application permissions: andteam's app acts as itself, not as a signed-in person. None of them can create apps, change directory settings or delete accounts. 3. Choose **Accept**. Microsoft returns you to andteam, which now shows **Connected** with your directory's name. Sign-in with Microsoft works from here, with nothing pasted. ## Step 2. Create the provisioning app in Entra andteam sends people to an app in your directory, which then creates the accounts. You create that app once, from Microsoft's gallery. 1. Open the **Microsoft Entra admin center** and go to **Entra ID**, **Enterprise apps**, **New application**. 2. Search the gallery for **API-driven provisioning to Microsoft Entra ID** and choose **Create**. 3. Open the new app's **Provisioning** page, set it to **Automatic**, and **Start provisioning**. 4. On the **Overview** page of the provisioning job, copy the **Provisioning API endpoint**. It looks like this: ``` https://graph.microsoft.com/v1.0/servicePrincipals/{id}/synchronization/jobs/{jobId}/bulkUpload ``` ## Step 3. Paste it in andteam 1. Back in andteam, under **Microsoft Entra ID**, **Provisioning**, paste the endpoint into **Provisioning API endpoint** and choose **Save**. 2. andteam sends a request that changes nothing, to check that the permission and the job work. The section then says **Connected**. If it does not, check that the permission was consented (step 1) and that the job is running (step 2). That is all that is required. The defaults below mean nothing else needs setting. ## The attribute mapping in Entra andteam sends each person as SCIM, and the gallery app's default mapping already matches the standard attributes: `externalId` (the employee number) is matched to the user's `employeeId`, so a person is found, not duplicated. | andteam sends | Entra attribute | | - | - | | `externalId` (employee number) | `employeeId` (the matching key) | | `active` | account enabled | | `name.givenName`, `name.familyName`, `displayName` | first name, last name, display name | | `userName` (work email, when andteam has one) | user principal name | | `title` | job title | | `enterprise:department`, `division`, `organization`, `costCenter` | department, division, company name, cost centre | | `enterprise:manager` | manager | | `addresses[work].locality` | city | **The andteam extension, for Lifecycle Workflows.** andteam also sends two dates in its own extension, `urn:ietf:params:scim:schemas:extension:andteam:1.0:User`: * `hireDate`, the start date, which maps to Entra's `employeeHireDate`. * `leaveDate`, the moment sign-in ends, which maps to Entra's `employeeLeaveDateTime`. These are what Entra **Lifecycle Workflows** use to run joiner and leaver tasks. To use them, add the extension to the provisioning app's schema and map the two attributes: 1. In the provisioning app, open **Attribute mapping**, then **Show advanced options**, then **Edit attribute list for API**. 2. Add `urn:ietf:params:scim:schemas:extension:andteam:1.0:User:hireDate` and `…:leaveDate`, both of type DateTime. 3. Add two mappings: `hireDate` to `employeeHireDate` and `leaveDate` to `employeeLeaveDateTime`. Optional attributes, off by default, can be switched on in andteam under **Microsoft Entra ID**, **Attributes**: work phone, employment type, grade and personal email. The same page has **Preview for one person**, which shows the exact request andteam would send. andteam never sends ID or passport numbers, date of birth, gender, race, disability, health, medical aid, bank, tax or pay details: there is no setting that adds them. ## When accounts are created and switched off These are set in andteam under **Microsoft Entra ID**, **Provisioning**. The defaults are what most customers want. | Setting | Default | What it does | | - | - | - | | **Create the account \[N] days before the start date** | 14 | The account is created this many days ahead (0 to 60). If the hire becomes final later than that, the account is created then. | | **Sign-in starts** | On the start date | Sign-in works from 00:00 on the start date. **When the account is created** lets people sign in early, for pre-boarding. | | **Sign-in ends** | At the end of the last day | Sign-in ends at 23:59 on the last day. **At the start of the last day** ends it at 00:00 on that day. **\[N] days after the last day** extends it. | **End access now** on a dismissal switches the account off immediately. It is always available and is not a setting. Times are in the company's time zone. andteam sends people at the pace Microsoft allows (50 people a request, a few requests a minute), so a large first sync takes a while. ## What andteam never does * **It never deletes an account.** When someone leaves, the account is switched off (disabled) on time and left for you to retire by your own process. * **Entra is the target.** andteam is the source of truth for the attributes it sends: a value changed in Entra is overwritten by the next push. Change it in andteam instead. * **It only reaches people in scope.** Under **People** you choose which companies and employment types are sent. Candidates, whose hire is not yet final, have no account. * **It never asks for more than the permissions above.** Disconnecting in andteam stops provisioning and returns everyone to the email-code sign-in. Accounts already in Entra are left as they are. ## If something fails andteam's **Microsoft Entra ID** section shows how many accounts need attention. Failures are listed with the person they belong to. The usual causes are a missing permission consent (repeat step 1), a provisioning job that is not running (step 2), and a person with no employee number in andteam, which Entra cannot match. andteam tells the people you chose under **Tell when something fails**. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.