Articles on: Schools & enterprise plans

Set up SCIM provisioning with Microsoft Entra ID for SimplyPrint

Set up SCIM provisioning with Microsoft Entra ID for SimplyPrint


This guide walks you through connecting Microsoft Entra ID (formerly Azure AD) to SimplyPrint over SCIM, so members are created, updated, and removed in SimplyPrint automatically whenever you change them in Entra. You'll point Entra's provisioning at SimplyPrint's SCIM base URL, authenticate with a token, then turn provisioning on.


This is the Entra-specific setup guide. For what SCIM does, the requirements, how tokens and the grace period work, and the activity log, read the SCIM provisioning overview first. That article is also where you copy your SCIM base URL and create a token.


Before you start

SCIM needs single sign-on set up and active first. SCIM provisions the accounts; SSO is how those people actually sign in. Set up SAML or OIDC for your account, then come back here.


A few things to have ready:


  • SAML or OIDC single sign-on is connected and active for your account. See Set up single sign-on (SSO) for SimplyPrint.
  • A School or Enterprise plan (the plans that include SSO and SCIM).
  • An account admin with permission to manage user-registration settings in SimplyPrint.
  • The ability to manage Provisioning on your SimplyPrint enterprise application in the Microsoft Entra admin center.
  • Your SCIM base URL and a token, both from the SimplyPrint SCIM window. Open Settings, then Organization, then User registration, find the User provisioning section, and click Set up SCIM provisioning. Pick the Microsoft Entra ID tab for an in-app summary of these steps, then use the Connection details section to copy the base URL and create a token.


Keep the SimplyPrint SCIM window open in one tab and the Microsoft Entra admin center in another. You'll copy the base URL and token from SimplyPrint into Entra.


Create a token in SimplyPrint

You authenticate Entra to SimplyPrint with a bearer token.

  1. In the SimplyPrint SCIM window, go to the Connection details section.
  2. Enter a name you'll recognize later, for example "Entra ID", and click Create token.
  3. Copy the token straight away. It's shown only once and can't be retrieved again.


Copy the token value immediately. If you navigate away before copying it, you'll need to create a new one. You can keep up to five active tokens, so revoke an old one if you hit the limit.


Open provisioning in Microsoft Entra

Now switch to Entra and point its provisioning at SimplyPrint.

  1. Sign in to the Microsoft Entra admin center.
  2. Go to Entra ID, then Enterprise applications, and open your SimplyPrint application. This is the same enterprise application you use for single sign-on.
  3. Under Manage, select Provisioning.
  4. Set Provisioning Mode to Automatic.


If you don't yet have a SimplyPrint enterprise application, add it from your gallery or as a custom (non-gallery) application first, then set up single sign-on on it before configuring provisioning.


Enter the SimplyPrint connection details

Under Admin Credentials in Entra:

  1. In Tenant URL, paste your SimplyPrint SCIM base URL (it ends in /scim/v2). Use the exact value from the Connection details section rather than typing it.
  2. In Secret Token, paste the SimplyPrint token you created.
  3. Click Test Connection.


A successful test confirms Entra can reach SimplyPrint and that the token is valid. If it fails, re-check the base URL and make sure the token was pasted with no extra spaces.


  1. Click Save.


Entra sends a default set of user attributes that SimplyPrint understands out of the box, so most accounts don't need to change the mappings. Districts are the exception.


If you manage several schools under one account and route users to the right school by an identifier, map a directory attribute into the SCIM department attribute:

  1. In Entra's Provisioning screen, expand Mappings, then open Provision Microsoft Entra ID Users.
  2. Add (or edit) a mapping so the directory attribute that identifies a user's school flows into the SCIM urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department attribute.
  3. Save the mapping.


SimplyPrint uses the value it receives in department to route each user to the correct school.


Choose who to provision and turn it on

  1. Back on the Provisioning overview, set Scope to Sync only assigned users and groups (recommended) so only people you assign are provisioned.
  2. Open the application's Users and groups and assign the users and groups you want in SimplyPrint.
  3. Set Provisioning Status to On.
  4. Save.


Entra provisions on its own schedule, roughly every 40 minutes, so the first full sync isn't instant. To check a single person right away, use Provision on demand and enter their name.


Verify it worked

Watch the results in two places:


  • In Entra: the Provisioning page shows the current cycle status and counts. Provision on demand shows exactly what happened for one user, including any error.
  • In SimplyPrint: scroll to the Activity section of the SCIM window. Every operation Entra performs - create, update, deactivate, remove, and group sync - is logged with a timestamp, the operation, who it affected, the source, and whether it succeeded. A failed operation shows a red icon you can hover for the error.


When groups are synced, they map to SimplyPrint user groups through your SSO group mappings, and on school accounts pushed groups become classes. For how group names turn into user groups, permissions, and teacher status, see SAML single sign-on: user groups, group mapping, and teacher mapping. The same mappings apply to SCIM-provisioned users.


Troubleshooting

  • Test Connection fails in Entra: confirm the Tenant URL is the exact base URL from the Connection details section (ending in /scim/v2) and that the Secret Token was pasted without extra spaces. If in doubt, create a fresh token in SimplyPrint and paste the new one.
  • A user isn't appearing in SimplyPrint: check they're assigned to the SimplyPrint application in Users and groups, that single sign-on is still active, and remember Entra syncs on a ~40-minute cycle. Use Provision on demand to test that user now, then check the Activity section in SimplyPrint for a failed create operation.
  • Groups aren't becoming user groups or classes: make sure you're assigning groups (not just users) and that your SSO group mappings match the group names Entra sends.
  • Someone was removed who shouldn't have been: removal follows the grace period you set in SimplyPrint, and removal takes a member out of this account only - it doesn't delete their SimplyPrint account. Deactivating a user in Entra (rather than unassigning or deleting) blocks sign-in but keeps their membership. See the grace period section in the SCIM provisioning overview.
  • Provisioning stopped after a token change: if you revoked or rotated the token in SimplyPrint, paste the new one into Entra's Secret Token field. The old token no longer has access.



Updated on: 13/06/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!