This article covers the SCIM provisioning setup steps that follow enterprise application creation. If you have not yet created the enterprise application in Entra ID, start with Setting Up Entra ID Integration.
Assign the Tenant Administrator Role
The Tenant Administrator role must be assigned to at least one user before SCIM provisioning can be configured. Only users with this role can access the tenant administration portal and generate provisioning credentials.
The user must first be assigned to the Foundation Cloud for Energy enterprise application before the role can be granted.
Open the Microsoft Entra administration portal.
Navigate to Enterprise Applications and select Foundation Cloud for Energy.
Open Users and Groups.
Add the required user if they are not already assigned to the application.
Select the user and choose Edit Assignment.
Assign the Tenant Administrator role.
To update role assignments for a user or group at any time, return to Users and Groups, select the entry, and choose Edit Assignment.
Generate SCIM Provisioning Credentials
SCIM provisioning requires a secret token and a provisioning URL. These are generated in the platform's tenant administration portal. The tenant administration portal can be accessed via admin.energysys.com
Open the tenant administration portal and sign in with an account that has the Tenant Administrator role.
Select Generate Token.
Copy the token immediately when it appears — it is only displayed once and cannot be retrieved again.
Note the tenant provisioning URL shown alongside the token.
A maximum of two active tokens can exist at any time. Tokens expire after twelve months. Replace tokens before they expire to maintain uninterrupted provisioning. Remove expired tokens promptly.
Configure SCIM Provisioning in Entra ID
In the Entra ID administration portal, navigate to Enterprise Applications and select Foundation Cloud for Energy.
Open the Provisioning section and select Get Started.
Set Provisioning Mode to Automatic.
Enter the Tenant URL and Secret Token generated in the previous step.
Select Test Connection to confirm Entra ID can communicate with the platform.
If the connection test succeeds, save the configuration.
Configure Attribute Mapping
Attribute mappings define how Entra ID user fields correspond to platform fields during synchronisation. Review the mappings for both users and groups to ensure they are configured correctly.
The userName attribute must be mapped to originalUserPrincipalName. Incorrect mapping of this attribute will cause users to be created incorrectly or not at all.
Enable Provisioning
Return to the Provisioning configuration page.
Set Provisioning Status to On.
Once enabled, Entra ID will synchronise user and group changes with the platform on a scheduled basis.
Provisioning Users On Demand
Scheduled provisioning cycles may not be immediate. To synchronise a specific user or group without waiting for the next cycle:
Open the Provisioning section of the enterprise application.
Confirm Provisioning Mode is set to Automatic.
Select the Provision on demand tab.
Search for the user or group to provision.
Select Provision.
After running on-demand provisioning, check the Provisioning Logs to confirm the result, and verify in the platform that the user account has been created or updated.
Assigning Platform Roles
Provisioning creates the user account in the platform but does not assign application roles. Roles must be assigned separately within the platform before the user can access any applications. See Configuring User Roles.