If you are using Microsoft Entra ID, you can connect your directory to Systam Studio, eliminating the need to manually create Systam Visit hosts. This guide describes how to enable automatic user synchronization from Microsoft Entra ID.

Note!

This is a paid extension and requires activation. Please contact our customer support at support@systam.io.

Once the setup is complete, Microsoft Entra ID:

• Creates users in Systam.
• Updates users in Systam (including primary workspace, name, emails, phone numbers, and active state).
• Removes (Hard Delete) users in Systam when they do not require access anymore.
• Keeps user attributes synchronized between Microsoft Entra ID and Systam.

Important things to note 

Prerequisites

• A Microsoft Entra tenant.
• A user account in Microsoft Entra ID with permission to configure provisioning (for example, Application Administrator, Cloud Application Administrator, Application Owner, or Global Administrator).
• A Systam organization account.
• A user account in Systam with Admin permissions.

Important Considerations

• Organization Owners: Users designated as "Organization Owners" in Systam are protected. Any attempt to update or delete these users via SCIM will result in a [object Object] error in the provisioning logs. This is expected behavior.
• No Soft Delete: Systam does not support a suspended or "soft-deleted" state. When a user is removed from scope or disabled in Entra ID (sending [object Object]), Systam permanently deletes the user account. If the user returns to the scope later, they will be re-created as a new user.
• Matching Logic: If a user already exists in Systam with the same email address, provisioning links that account to the SCIM [object Object] for this tenant; otherwise, a new user is created.
• Groups: Systam does not currently support group provisioning.

Step 1: Plan your provisioning deployment

1. Learn about how the provisioning service works.
2. Determine who will be in scope for provisioning.
3. Determine what data to map between Microsoft Entra ID and Systam.

Step 2: preparation and actions in Systam Studio

Preparation

1. Go to Systam Studio → Extensions → Microsoft Entra ID and click "Enable".
2. Copy the Tenant URL and Secret Token shown in Studio. You will need these for the Entra ID configuration (see Step 5).
3. You may also enter your organization’s Tenant ID, which will help us in possible troubleshooting situations.

Set synchronization settings

In Systam Studio, choose how employees will be added to workspaces. You can decide whether employees are added to only one workspace in the organization or to all workspaces. Select the option that suits your organization before starting provisioning.

• Primary workspaces
  • Synchronize hosts to only one workspace.
    
• All workspaces
  • Synchronize hosts to all workspaces.

Note!
If you later change the setting to Primary workspaces, hosts will not be automatically removed from other workspaces.

Define primary workspaces (if using Primary workspaces)

If you use the Primary workspaces setting, you must define workspace-specific Entra values.

You can assign employees to different workspaces by defining a workspace and its corresponding Entra value.

Follow these steps:

• Click Add configuration.

• Select the workspace.

• Define the corresponding Entra value.

Note!
The Entra value must exactly match the value defined in the Entra ID attribute mapping (see Step 5).

Step 3: Add Systam as a Non-Gallery Application

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Browse to Identity > Applications > Enterprise applications > New application.
3. Select Create your own application.
4. Enter a name for your application (e.g., "Systam").
5. Select Integrate any other application you don't find in the gallery (Non-gallery).
6. Click Create.
   
   

Step 4: Define who is in scope for provisioning

• Start small. Test with a small set of users and groups before rolling out to everyone.
• When the scope for provisioning is set to assigned users and groups, you can control this by assigning one or two users or groups to the app.
  
  

Step 5: Configure automatic user provisioning to Systam

Part A: Admin Credentials

1. In the Systam application in Entra ID, select the Provisioning tab.
2. Under "Manage", select Provisioning and set the Provisioning Mode to Automatic.
3. Under the Admin Credentials section, input the values from Systam Studio:
   • Tenant URL: [object Object]
   • Secret Token: Enter the Bearer Token provided by Systam.
4. Select Test Connection to ensure Microsoft Entra ID can connect to Systam. If the connection fails, ensure your Token is valid and try again.
5. Continue to part B.

Part B: Configure Custom Attributes (Crucial)

1. Within the same page, open Mappings.
2. Under Mappings, select Provision Microsoft Entra ID Users.
3. Scroll to the bottom of the page and check Show advanced options.
4. Click Edit attribute list for Systam.
5. At the bottom of the attribute list, enter the following new attribute:
   • Name: [object Object]
   • Type: [object Object]
6. Click Save.

Part C: Attribute Mappings

Identity and status

• [object Object]
• Unique identifier for the user in Systam.
• This is taken from the source attribute you configure in the [object Object] mapping (typically the user’s sign-in name, such as UPN or email address).
• [object Object]
• Indicates whether the user account should exist in Systam.
• The value is determined by the expression you configure in the active mapping.

Contact details

• Email addresses
  • The value mapped as "work" email attribute (for example [object Object]) is used as the user’s primary email address in Systam.
  • A "work" email address is required. If a user does not have a "work" email, provisioning for that user will fail.
• Phone numbers
  • If you choose to map phone numbers, the value mapped as the "work" phone attribute (for example [object Object]) is used as the user’s primary phone number in Systam.
  • A "work" phone number is required if any phone numbers are mapped.
    • If you do not want to manage phone numbers in Systam, leave phone numbers unmapped.
    • If you do map phone numbers, make sure every in-scope user has a "work" phone number, or provisioning for those users will fail.

• The "work" email address is always the main email used for the user in Systam.
• When phone numbers are mapped, the "work" phone number is the main number used for the user in Systam.

Part D: Custom Attribute mapping

• The value mapped to [object Object] is used as the user’s main workspace in Systam.
• [object Object] is required. If this attribute is not provided for a user, provisioning for that user will fail.
• The value must match one of the workspace identifiers configured in Systam. If the value does not match any existing workspace, provisioning for that user will fail.
• If the [object Object] value changes in Microsoft Entra ID, the change is applied to the user in Systam on the next provisioning cycle.

1. Back in the Attribute Mapping blade, review the default mappings.
2. Add the Workspace Mapping:
   • Scroll to the bottom of the mapping list and click Add New Mapping.
   • Source attribute: Select the attribute in Entra ID, that will be used to determine the employees primary physical location (e.g., [object Object], [object Object], [object Object],  [object Object], or an extension attribute).
   • Target attribute: Select the custom attribute you added in Part B: [object Object].
   • Click OK.
3. Select Save to commit the changes.

Step 6: Test and start provisioning

1. Test with on-demand provisioning
   • Select Provision on demand, choose a test user that is in scope, and run the operation.
2. Enable automatic provisioning
   • Set Provisioning status to On and choose the desired scope for provisioning.
3. Monitor provisioning
   • Use the provisioning logs to determine which users have been provisioned successfully
   • Check the progress bar to see the status of the provisioning cycle.

Additional resources

• Managing user account provisioning for Enterprise Apps
• What is application access and single sign-on with Microsoft Entra ID?