Skip to content

Microsoft Entra ID

This guide connects Entra ID (formerly Azure Active Directory) to Jenz, so that the users you assign to the Jenz app in Entra are created, kept up to date and deactivated in Jenz automatically.

You need: an Entra role that can manage enterprise applications (Application Administrator or Cloud Application Administrator), and a Jenz SCIM token (how to get one).

1. Create the enterprise application

  1. In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications and select New application.
  2. Select Create your own application, name it Jenz, choose Integrate any other application you don't find in the gallery (Non-gallery) and select Create.

2. Connect it to Jenz

  1. In the new application, open Provisioning and select Get started (or Connect your application).
  2. Set Provisioning Mode to Automatic.

  3. Under Admin Credentials, fill in:

    Field Value
    Tenant URL https://api.jenz.app/scim/v2
    Secret Token the SCIM token Jenz gave you

  4. Select Test Connection. Entra reports success when the URL and token are right.

  5. Save.

One token per company

The token tells Jenz which company the requests belong to, so the Tenant URL is the same for every Jenz customer. Do not reuse a token between Entra tenants.

3. Check the attribute mappings

Open Provisioning → Mappings.

Turn off group provisioning. Select Provision Microsoft Entra ID Groups and set Enabled to No. Jenz provisions users only; leaving it on makes every sync cycle report errors for groups.

Review the user mappings. Select Provision Microsoft Entra ID Users. Entra's defaults work with Jenz; these are the attributes Jenz uses:

Entra ID attribute Jenz (SCIM) attribute Notes
userPrincipalName userName Must be the person's e-mail address: it is what they sign in to Jenz with. If your UPNs are not e-mail addresses, map mail here instead. Keep it as the matching attribute.
mail emails[type eq "work"].value The work e-mail. Required to create a user.
givenName name.givenName
surname name.familyName
jobTitle title Shown on the profile. A user without one gets the title "Unknown".
department urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department Jenz creates a department that does not exist yet.
mobile phoneNumbers[type eq "mobile"].value Use international format (+385…). An invalid number, or one already used by another Jenz account, is skipped without failing the user.
Switch([IsSoftDeleted], , "False", "True", "True", "False") active Entra's default. Deactivates the user in Jenz when they are disabled or unassigned.
mailNickname externalId Entra's default. Map a stable identifier here, such as employeeId, if you have one.

Mappings Entra sends that Jenz does not use, such as displayName, preferredLanguage or addresses, are ignored; you can leave or delete them.

Keep userName as the only matching attribute (the Match objects using this attribute setting), so Entra finds people who already have a Jenz account by e-mail.

4. Choose who is provisioned

  1. Open Users and groups and Add user/group. Assign the people, or the groups whose members, should have Jenz. Assigning a group provisions its members; the group itself is not created in Jenz.
  2. Back in Provisioning → Settings, set Scope to Sync only assigned users and groups.

5. Test with one person, then switch on

  1. Select Provision on demand, pick one assigned user and select Provision. Entra shows each step; the user then appears in Jenz.
  2. When that looks right, set Provisioning Status to On and Save.

Entra runs a first cycle over everyone in scope, then an incremental cycle about every 40 minutes. A change you make in Entra therefore reaches Jenz within the next cycle, not instantly. Use Provision on demand when someone needs access right away.

Troubleshooting

Entra records every request in Provisioning logs (under Monitoring in the application), with Jenz's answer for each.

What you see Cause and fix
Test Connection fails with 401 Unauthorized The token is wrong, has been rotated, or has a space or line break around it. Paste it again, or ask us for a new one.
409 with uniqueness The e-mail address belongs to another active Jenz account. Check for a duplicate person in Entra, or for someone whose address changed.
400 with must have a primary email address The user has no mail value in Entra. Fill it in, or adjust the emails mapping.
A user's phone number does not appear in Jenz It is not a valid international number, or another Jenz account already has it. The rest of the profile is still updated.
Groups fail on every cycle Group provisioning is still enabled. Turn it off (step 3).

Still stuck? Contact us with the time of the attempt and the user's e-mail address. Never send the token itself.