Configure Systam Visit for automatic user provisioning with Microsoft Entra ID

Created by Anu Luoma, Modified on Mon, 1 Dec at 10:07 AM by Anu Luoma

This article describes the steps you need to perform in both Systam and Microsoft Entra ID to configure automatic user provisioning. When configured, Microsoft Entra ID automatically provisions and de-provisions users to Systam using the Microsoft Entra provisioning service.

For important details on what this service does, how it works, and frequently asked questions, see Automate user provisioning and deprovisioning to SaaS applications with Microsoft Entra ID.

Capabilities supported

Create users in Systam
Update users in Systam (including primary workspace, name, emails, phone numbers, and active state)
Remove (Hard Delete) users in Systam when they do not require access anymore
Keep user attributes synchronized between Microsoft Entra ID and Systam
Note: Group provisioning is not currently supported.

Prerequisites

The scenario outlined in this article assumes that you already have the following prerequisites:

A Microsoft Entra tenant.
A user account in Microsoft Entra ID with permission to configure provisioning (for example, Application Administrator, Cloud Application Administrator, Application Owner, or Global Administrator).
A Systam organization account.
A user account in Systam with Admin permissions.

Step 1: Plan your provisioning deployment

Learn about how the provisioning service works.
Determine who will be in scope for provisioning.
Determine what data to map between Microsoft Entra ID and Systam.

Step 2: Configure Systam to support provisioning with Microsoft Entra ID

Before configuring the provisioning in Microsoft Entra ID, you will need the Tenant URL and Secret Token from Systam.

Contact your Systam representative or Onboarding Team.
Provide them with the list of Workspace Identifiers you intend to map.
Obtain the SCIM Endpoint URL and the Bearer Token.

Note: Ensure you have these credentials ready before proceeding to Step 3.

Step 3: Add Systam as a Non-Gallery Application

Since Systam is a custom integration, you must add it as a non-gallery application.

Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
Browse to Identity > Applications > Enterprise applications > New application.
Select Create your own application.
Enter a name for your application (e.g., "Systam").
Select Integrate any other application you don't find in the gallery (Non-gallery).
Click Create.

Step 4: Define who is in scope for provisioning

The Microsoft Entra provisioning service allows you to scope who is provisioned based on assignment to the application, or based on attributes of the user or group. If you choose to scope who is provisioned to your app based on assignment, you can use the following steps to assign users and groups to the application.

Start small. Test with a small set of users and groups before rolling out to everyone.
When scope for provisioning is set to assigned users and groups, you can control this by assigning one or two users or groups to the app.

Step 5: Configure automatic user provisioning to Systam

This section guides you through the steps to configure the Microsoft Entra provisioning service to create, update, and disable users in Systam.

Part A: Admin Credentials

In the Systam application in Entra ID, select the Provisioning tab.
Set the Provisioning Mode to Automatic.
Under the Admin Credentials section, input the values provided by the Systam team:
- Tenant URL: https://<api-endpoint>/scim/v2
- Secret Token: Enter the Bearer Token provided by Systam.
Select Test Connection to ensure Microsoft Entra ID can connect to Systam. If the connection fails, ensure your Token is valid and try again.
Select Save.

Part B: Configure Custom Attributes (Crucial)

Systam requires a custom attribute primaryWorkspace to be sent during user creation. You must add this to the schema before mapping it.

Under Mappings, select Provision Microsoft Entra ID Users.
Scroll to the bottom of the page and check Show advanced options.
Click Edit attribute list for Systam.
At the bottom of the attribute list, enter the following new attribute:
- Name: urn:ietf:params:scim:schemas:extension:systam:2.0:User:primaryWorkspace
- Type: String
Click Save.

Part C: Attribute Mappings

Back in the Attribute Mapping blade, review the default mappings.
Ensure the following standard mappings are present:

Microsoft Entra ID Attribute	Systam Attribute
userPrincipalName	userName
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active
givenName	name.givenName
surname	name.familyName
mail	emails[type eq "work"].value
telephoneNumber	phoneNumbers[type eq "work"].value

Add the Workspace Mapping:
- Click Add New Mapping.
- Source attribute: Select the attribute in Entra ID that contains the Workspace ID (e.g., department, physicalDeliveryOfficeName, or an extension attribute).
- Target attribute: Select the custom attribute you added in Part B: urn:ietf:params:scim:schemas:extension:systam:2.0:User:primaryWorkspace.
- Click OK.
Select Save to commit the changes.

Step 6: Monitor your deployment

Once you configure provisioning, use the following resources to monitor your deployment:

Use the provisioning logs to determine which users have been provisioned successfully or unsuccessfully.
Check the progress bar to see the status of the provisioning cycle.

Important Considerations

Organization Owners: Users designated as "Organization Owners" in Systam are protected. Any attempt to update or delete these users via SCIM will result in a 403 Forbidden error in the provisioning logs. This is expected behavior.
No Soft Delete: Systam does not support a suspended or "soft-deleted" state. When a user is removed from scope or disabled in Entra ID (sending active: false), Systam permanently deletes the user account. If the user returns to scope later, they will be re-created as a new user.
Matching Logic: If a user already exists in Systam with the same email address, provisioning links that account to the SCIM userName for this tenant; otherwise, a new user is created.
Attributes: The custom Systam extension requires primaryWorkspace. Phone numbers are optional. Systam respects the primary flag (sent by default by Entra) to identify the main contact; specific type values (like "work" or "mobile") are ignored.