User Provisioning

What This Is For

User provisioning means Skillhabit creates and updates people (and often groups) from outside the product—your Microsoft directory, a SCIM identity provider, or your own software—instead of typing every user into Users & Groups by hand.

Typical goals:

• New hires appear in Skillhabit when they join the directory or HR system
• Leavers are archived when they leave
• Group membership stays aligned with groups you choose to sync

Provisioning answers who exists in Skillhabit when a directory or your own system should own lifecycle (creates, updates, groups, leavers). It is not the same as choosing login methods. Sign-in options—and when first login may create an account—are in SSO and Authentication.

If you are unsure which problem you are solving, start with the Introduction.

Who This Is For

Workspace administrators, usually working with whoever owns Microsoft Entra ID / Azure AD, your SCIM IdP, or the team that builds against the External API.

Ways to Get Users Into Skillhabit

You can combine paths (for example Entra sync for employees and the API for partners). Agree which system owns creates and deactivations so two sources do not fight.

Provisioning vs First-Login Creation

Directory sync and the External API are still the right tools when you need groups, leavers, and profiles before someone signs in.

Magic Links and Microsoft can create a user on first login when the email domain is under Approved for Sign Up. OpenID Connect can do the same when auto-create is enabled. Those paths do not sync Entra groups or archive leavers for you.

For Entra-heavy workspaces you usually need:

1. Provisioning (this page) so accounts and groups stay aligned with the directory
2. SSO / authentication so people can open those accounts

How Skillhabit picks an email-shaped identifier from directory claims: SSO and Email Addresses.

---

Set Up Microsoft Entra ID Sync

Skillhabit talks to Microsoft Graph using an app registration in your Entra tenant. Skillhabit stores the app’s Application (client) ID and Directory (tenant) ID, then trusts a certificate you upload in Azure.

Before You Start

• Ask your Skillhabit contact to enable the Microsoft Entra ID integration if Configure → Connections → Microsoft Entra ID shows that the feature is not enabled.
• In the Azure portal, create (or reuse) an App registration. You need permission to register apps and upload certificates.
• Decide which Entra groups should sync into Skillhabit.

Steps in Skillhabit

1. Open Configure → Connections → Microsoft Entra ID.
2. Under Configuration, paste:
   • Application (client) ID
   • Directory (tenant) ID
     Find both in Azure: Microsoft Entra ID → App registrations → your app → Overview.
3. Click Generate Certificate. Confirm generation, then download the certificate file.
   This download is one-time—if you lose the file, generate a new certificate in Skillhabit.
4. In Azure, open the same app registration → Certificates & secrets → upload the downloaded certificate.
5. When credentials are correct, use Manage Groups: search groups, select which should sync, Save.
6. Optionally click Force synchronise for an immediate sync. Otherwise Skillhabit syncs about every 10 minutes.

What You Should See Afterward

• Synced groups appear in Users & Groups (filter by Azure-synced groups).
• Members show up as users; many are marked externally provisioned.
• Profile fields for those users are largely read-only—lifecycle follows the directory. See Bulk Actions and Email.

Keep Sync Healthy

• Certificates last one year. Generate a new one in Skillhabit and upload it in Azure before expiry, or sync stops.
• If the list looks wrong, recheck app IDs and the certificate, then Manage Groups / Force synchronise.

Email Addresses From Entra

Sync picks an email-like address from directory attributes. If nothing valid exists, Skillhabit may store @noemail.skillhabit.com and will not send system email. Full rules: SSO and Email Addresses.

---

Set Up SCIM

SCIM (System for Cross-domain Identity Management) lets an identity provider push user (and often group) changes into Skillhabit over HTTPS, using an API key.

Before You Start

• Contact your Skillhabit representative to enable SCIM for the workspace.
• Create an API key in Configure.
• In your IdP, create a SCIM connector aimed at Skillhabit with the details Skillhabit provides for your tenant.

Exact SCIM base URLs and attribute mappings are workspace-specific—your Skillhabit contact supplies them once SCIM is enabled.

After SCIM Is Running

• SCIM users appear as externally provisioned in Users & Groups.
• Prefer changing identity data in the IdP, not by editing those profiles in Skillhabit.

Entra Graph sync and SCIM can run together or separately—pick one owner for lifecycle when possible.

---

Provision Users With the External API

Use the External API when your own system (HR, CRM, middleware, partner portal) should create, update, or deactivate Skillhabit users on its own schedule—without Entra Graph sync or SCIM.

Before You Start

• Create an API key in Configure.
• Treat the key like a password; only give it to trusted backends.
• Decide how each user will sign in later (Magic Links, Microsoft, OpenID Connect, or an External API login link)—see SSO and Authentication.

Steps

1. Authenticate API calls with your key as a bearer token (External API).
2. Use the user (and group) endpoints in the External API reference to create and update accounts. Recipes: Create a User and Sign-In Link · Sync Manual Groups.
3. Every user needs an email-shaped identifier. If they should not receive Skillhabit email, use a unique address on @noemail.skillhabit.com—Skillhabit never sends system mail there (External API).
4. After users exist, grant app access and groups in Users & Groups or via the API, depending on your automation.
5. To open Skillhabit for that person from your portal, create a pre-signed login link (Authentication / Create sign-in link)—documented under SSO and Authentication.

API-provisioned users can also appear as integrated / externally managed depending on how you create them—confirm behavior in Users & Groups after your first sync job.

When to Prefer the API Over Entra or SCIM

• Custom joiners/leavers rules that are not in Entra groups
• Partners or contractors not in your corporate directory
• You already have a service that must own the user lifecycle

For standard Microsoft-only directories, Entra sync is usually simpler. For IdP-native push provisioning, prefer SCIM when Skillhabit has enabled it.

---

Map Directory Attributes Onto Skillhabit Attributes

Provisioning can also fill Skillhabit attributes (custom fields) from the directory—not only name and email.

Before You Start

• Create the target attributes under Configure → Attributes (Custom Attribute Fields).
• Know the source path your IdP sends (OIDC claim name, Microsoft Graph property such as department, or SCIM attribute path).
• Attribute mappings may require the feature to be enabled for your workspace—ask Skillhabit if the tab is missing.

Steps

1. Open Configure → Connections → Attribute mappings.
2. Choose Add mapping.
3. Set:
   • Source — OpenID Connect claim, Microsoft Entra property, or SCIM attribute
   • External IdP Property Name — the claim / property / attribute path
   • Skillhabit attribute — an existing Text, Single Select, or Multi Select attribute
   • Matching strategy (list fields only) — Match existing only or Create if missing
4. Save.

One mapping list applies across OIDC login / JIT, Microsoft Entra user sync, and SCIM user create/update—each mapping records which source type it uses.

How Values Apply

Choice pickers for large lists are searchable so auto-created values stay usable. Choice hierarchy (parent/child levels) is a separate feature and is not required for mappings.

Release the Field From Your IdP First

Skillhabit can only map values the IdP actually sends. Use Add Attributes to IdP Tokens and Profiles for Microsoft Entra (optional claims + Graph properties), Okta, Auth0, generic OIDC, and SCIM attribute paths.

---

Related

• Introduction — SSO vs provisioning
• Add Attributes to IdP Tokens and Profiles
• SSO and Authentication
• Custom Attribute Fields
• Sync Users With SCIM
• Invite Users and Set App Access
• External API
• API Keys
• Users & Groups