PC Matic + Microsoft Entra ID Provisioning
PC Matic + Microsoft Entra ID Provisioning
Overview
This guide explains how to configure SCIM provisioning between Microsoft Entra ID and PC Matic.
SCIM provisioning allows Microsoft Entra ID to automatically manage users and groups within PC Matic.
Prerequisites
Before configuring provisioning:
- SAML SSO should already be operational.
- User Lifecycle Source must be configured as SCIM Managed within PC Matic.
- A SCIM provisioning token must be generated within PC Matic.
Step 1: Obtain SCIM Information from PC Matic
Navigate to:
Settings > Identity Provider > SCIM Provisioning
Copy the following values:
- SCIM Base URL
- Provisioning Token
If a token has not been generated:
- Change User Lifecycle Source to SCIM Managed.
- Save the configuration.
- Generate a provisioning token.
Step 2: Enable Provisioning in Entra ID
- Open the PC Matic Enterprise Application.
- Navigate to Provisioning.
- Select Get Started.
Configure the following settings:
| Microsoft Entra Setting | PC Matic Value |
|---|---|
| Provisioning Mode | Automatic |
| Tenant URL | SCIM Base URL |
| Secret Token | Provisioning Token |
Click Test Connection.
A successful test confirms communication between Entra ID and PC Matic.
Save the configuration.
Step 3: Configure Provisioning Scope
Select one of the following:
Sync Assigned Users and Groups
Recommended for most organizations.
Only users and groups assigned to the Enterprise Application will be synchronized.
Sync All Users and Groups
Not generally recommended unless all directory users require access.
Save the configuration.
Step 4: Review Attribute Mappings
Microsoft Entra ID automatically creates standard SCIM mappings.
Review the mappings and ensure:
| Entra Attribute | SCIM Attribute |
|---|---|
| userPrincipalName | userName |
| emails[type eq "work"].value | |
| givenName | name.givenName |
| surname | name.familyName |
Modify mappings only if your organization has specific requirements.
Step 5: Enable Provisioning
- Set Provisioning Status to On.
- Save the configuration.
Microsoft Entra ID will begin its initial synchronization cycle.
Initial synchronization may take several minutes depending on directory size.
Step 6: Verify Synchronization
Within PC Matic:
- Open the Migration Command Center.
- Review SCIM Health.
- Verify users appear correctly.
- Verify groups synchronize successfully.
Monitor the Dry-Run Preview and migration indicators for any unresolved users.
Group Synchronization
When groups are assigned to the Enterprise Application:
- Groups are synchronized through SCIM.
- Membership changes synchronize automatically.
- Group renames synchronize automatically.
- Group removals are processed through lifecycle management.
After synchronization, configure Group-to-Role mappings within PC Matic.
Validation
Verify:
- SCIM Health reports successful requests.
- Users are provisioned correctly.
- Group synchronization succeeds.
- Role mappings are configured.
- Users receive expected access.
Common Issues
Test Connection Fails
Verify:
- Tenant URL matches the SCIM Base URL.
- Secret Token is valid.
- Lifecycle Source is set to SCIM Managed.
Users Not Provisioning
Verify:
- Provisioning Status is On.
- Users are assigned to the Enterprise Application.
- Provisioning Scope includes assigned users.
Groups Not Appearing
Verify:
- Groups are assigned to the Enterprise Application.
- Provisioning has completed at least one synchronization cycle.
- No provisioning errors are reported in Entra ID.
User Shows "Role Required"
Verify:
- Group-to-Role mappings have been configured.
- Direct role assignments exist if required.
- A Default Provisioning Role has been configured if desired.