Integrating SCIM (System for Cross-domain Identity Management) provisioning with Microsoft Entra ID (Azure AD) lets you automatically create, update, and deactivate Wellness360 user accounts directly from Entra ID. No manual user management required.
With SCIM provisioning enabled, organizations benefit from:
Automatic account creation - assigning a user to the app creates their Wellness360 account
Always-in-sync profiles - updates in Entra ID flow straight through to Wellness360
Automatic deactivation - unassigning or disabling a user in Entra ID deactivates their Wellness360 access
Follow the steps below to configure SCIM provisioning between Microsoft Entra ID and Wellness360.
Before You Start
Important: You must have the Application Administrator or Global Administrator role in Entra ID, and an Entra ID P1 or P2 license (required by Microsoft for automated SCIM provisioning).
Wellness360 will send you two values ahead of setup. Treat the Secret Token like a password.
Item | Description | Value |
Tenant URL | Your SCIM endpoint |
|
Secret Token | A unique Bearer token scoped to your company only |
|
Note: The Secret Token is company-specific and scopes all provisioning to your organization. Do not share it outside your IT administrators. If it's ever exposed, contact Wellness360 and we'll regenerate it. Your old token stops working immediately.
In scope
Create users (on assignment to the app)
Update user attributes (name, email, phone, department, etc.)
Deactivate / reactivate users (on unassignment or account disable in Entra ID)
Automatic matching of existing users so duplicates are not created
Not in scope
Group provisioning is not supported. Please provision users only - DO NOT enable group push(Follow the instructions below).
Configure Provisioning in Microsoft Entra Admin Centre
You already should have a Wellness360 enterprise application configured for SSO. SCIM provisioning is added to that same application. Do not create a new one, as a second app would split your user assignments and configuration.
Step 1: Open Your Existing Wellness360 Application
Sign in to the Microsoft Entra admin center → Identity → Applications → Enterprise Applications
Open your existing Wellness360 Application.
Important: Only If a Wellness360 enterprise application has not been created in Microsoft Azure AD, refer to the SSO Integration with Microsoft Azure AD help article for setup instructions. If SSO is already configured, you can skip this step.
Step 2: Configure Provisioning
In the Wellness360 application, go to Provisioning → Get started
Set Provisioning Mode to Automatic
Under Admin Credentials, enter the Tenant URL and Secret Token provided by Wellness360
Click Test Connection — you should see a success message confirming Entra ID can authenticate and reach the endpoint
Click Save
Note: If Test Connection fails, double-check the URL has no trailing spaces and the token was pasted in full. See Troubleshooting below.
Step 3: Disable Group Provisioning
Wellness360 supports user provisioning only.
Expand Mappings
Click Provision Microsoft Entra ID Groups → set Enabled to No → Save
Leave Provision Microsoft Entra ID Users set to Yes
Step 4: Review the User Attribute Mappings
Open Provision Microsoft Entra ID Users and align the mappings to the table below. Remove any mappings to attributes not listed here — Wellness360 ignores unsupported attributes, but trimming them keeps the sync clean.
Matching attribute:
Entra ID attribute | SCIM attribute | Notes |
userPrincipalName | userName | Primary matching attribute. Keep "Matching precedence" = 1 |
Recommended attribute mappings:
Entra ID attribute | SCIM attribute |
userPrincipalName | userName |
Switch([IsSoftDeleted], …) (default) | active |
givenName | name.givenName |
surname | name.familyName |
displayName | displayName |
mail (or userPrincipalName) | emails[type eq "work"].value |
telephoneNumber (or mobile) | phoneNumbers[type eq "mobile"].value |
department
| urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department |
employeeId | externalId |
jobTitle (optional) | title |
Notes
userNameandemailsare the most important fields. Make sure both resolve to a valid, unique email-style value for each user.externalId(mapped fromemployeeId) is used as a stable secondary identifier; mapping it is recommended but optional.You may remove mappings for attributes Wellness360 does not consume (e.g.
costCenter,division) to keep the configuration tidy.
Step 5: Set Scope and Turn It On
Under Settings, set Scope to "Sync only assigned users and groups" (recommended) — Wellness360 will receive only the users you assign
Set Provisioning Status to On
Click Save
Step 6: Assign Users
Go to the application → Users and groups → Add user/group
Assign the users (or a group for assignment purposes note: assigning a group controls who is provisioned, but the group itself is not created in Wellness360; only its member users are)
The first full provisioning cycle starts automatically, typically within ~40 minutes. Subsequent changes sync on Entra ID's incremental cycle.
How Provisioning Behaves
Action in Entra ID | Result in Wellness360 |
Assign a user to the app | A Wellness360 account is created (or matched to an existing one by userName) |
Update a user's profile | The corresponding Wellness360 fields are updated |
Unassign a user / disable the account / soft-delete | The Wellness360 account is deactivated (disabled, status set to inactive). The record is retained, not hard-deleted - so reassigning the user reactivates the same account and history. |
Re-assign / re-enable a user | The account is reactivated |
Validate the Integration
In the application, open Provisioning → Provision on demand
Select a test user and run it
Confirm the steps show Import → Matching → Determine action → Export with a green result
Ask your Wellness360 contact to confirm the user now appears
Run the deactivation test: remove the test user's assignment, run Provision on demand again (or wait a cycle), and confirm the account is deactivated
Use Provisioning logs to review the outcome of each operation
It's recommended to validate with a sample assigned user before rolling out broadly.
Troubleshooting
Symptom | Likely cause / fix |
Test Connection fails (401 / unauthorized) | The Secret Token is wrong, truncated, or has been regenerated. Re-paste the full token; if it persists, request a fresh token from Wellness360. |
Test Connection fails (404 / cannot reach endpoint) | The Tenant URL is incorrect or has a trailing space/slash. Use the exact URL Wellness360 provided, ending in /scim/v2. |
Users not provisioning | Confirm the user is assigned to the application and Scope = "Sync only assigned users and groups". Check the Provisioning logs. |
Duplicate users created | Ensure userName is the matching attribute (precedence 1) and that userPrincipalName values are stable and unique. |
Group sync errors in logs | Group provisioning must be disabled (Step 3). Wellness360 does not support group provisioning. |
A user won't deactivate | Deactivation happens when the user is unassigned or disabled in Entra ID. Confirm the active mapping is present and run Provision on demand to force a cycle. |
Security Notes
The Secret Token grants provisioning access to your Wellness360 company only and should be stored securely (e.g., your secrets vault)
All SCIM traffic runs over HTTPS (TLS)
To rotate the token, contact Wellness360. We issue a new token and immediately invalidate the old one; you then update the Secret Token field in Entra ID
After the Integration
Once setup is complete and SCIM provisioning is enabled successfully:
User accounts stay automatically in sync between Entra ID and Wellness360
Access can be managed centrally assigning or unassigning a user in Entra ID controls their Wellness360 access
Manual account creation, updates, and deactivation are no longer needed
This creates a more secure, lower-maintenance identity workflow for both administrators and end users.
Need help?
If the issue continues, please contact our Support team at [email protected]. We’ll be happy to assist you and ensure everything is working as expected.