Configure Systam Visit for automatic user provisioning with Microsoft Entra ID

Capabilities supported

• Create users in Systam.
• Update users in Systam (including primary workspace, name, emails, phone numbers, and active state).
• Remove (Hard Delete) users in Systam when they do not require access anymore.
• Keep user attributes synchronized between Microsoft Entra ID and Systam.
• Note: Group provisioning is not currently supported.

Prerequisites

• A Microsoft Entra tenant.
• A user account in Microsoft Entra ID with permission to configure provisioning (for example, Application Administrator, Cloud Application Administrator, Application Owner, or Global Administrator).
• A Systam organization account.
• A user account in Systam with Admin permissions.

Important Considerations

• Organization Owners: Users designated as "Organization Owners" in Systam are protected. Any attempt to update or delete these users via SCIM will result in a 403 Forbidden error in the provisioning logs. This is expected behavior.
• No Soft Delete: Systam does not support a suspended or "soft-deleted" state. When a user is removed from scope or disabled in Entra ID (sending active: false), Systam permanently deletes the user account. If the user returns to the scope later, they will be re-created as a new user.
• Matching Logic: If a user already exists in Systam with the same email address, provisioning links that account to the SCIM userName for this tenant; otherwise, a new user is created.
• Groups: Systam does not currently support groups provisioning.

Step 1: Plan your provisioning deployment

1. Learn about how the provisioning service works.
2. Determine who will be in scope for provisioning.
3. Determine what data to map between Microsoft Entra ID and Systam.

Step 2: Configure Systam to support provisioning with Microsoft Entra ID

1. Contact your Systam representative or Onboarding Team.
2. Provide them with the list of Workspace Identifiers you intend to map.
3. Obtain the SCIM Endpoint URL and the Bearer Token.

Step 3: Add Systam as a Non-Gallery Application

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Browse to Identity > Applications > Enterprise applications > New application.
3. Select Create your own application.
4. Enter a name for your application (e.g., "Systam").
5. Select Integrate any other application you don't find in the gallery (Non-gallery).
6. Click Create.

Step 4: Define who is in scope for provisioning

• Start small. Test with a small set of users and groups before rolling out to everyone.
• When the scope for provisioning is set to assigned users and groups, you can control this by assigning one or two users or groups to the app.

Step 5: Configure automatic user provisioning to Systam

Part A: Admin Credentials

1. In the Systam application in Entra ID, select the Provisioning tab.
2. Under "Manage", select Provisioning and set the Provisioning Mode to Automatic.
3. Under the Admin Credentials section, input the values provided by the Systam team:
   • Tenant URL: https://<api-endpoint>/scim/v2
   • Secret Token: Enter the Bearer Token provided by Systam.
4. Select Test Connection to ensure Microsoft Entra ID can connect to Systam. If the connection fails, ensure your Token is valid and try again.
5. Continue to part B.

Part B: Configure Custom Attributes (Crucial)

1. Within the same page, open Mappings.
2. Under Mappings, select Provision Microsoft Entra ID Users.
3. Scroll to the bottom of the page and check Show advanced options.
4. Click Edit attribute list for Systam.
5. At the bottom of the attribute list, enter the following new attribute:
   • Name: urn:ietf:params:scim:schemas:extension:systam:2.0:User:primaryWorkspace
   • Type: String
6. Click Save.

Part C: Attribute Mappings

Identity and status

• userName
• Unique identifier for the user in Systam.
• This is taken from the source attribute you configure in the userName mapping (typically the user’s sign-in name, such as UPN or email address).
• active
• Indicates whether the user account should exist in Systam.
• The value is determined by the expression you configure in the active mapping.

Contact details

• Email addresses
  • The value mapped as "work" email attribute (for example emails[type eq "work"].value) is used as the user’s primary email address in Systam.
  • A "work" email address is required. If a user does not have a "work" email, provisioning for that user will fail.
• Phone numbers
  • If you choose to map phone numbers, the value mapped as the "work" phone attribute (for example phoneNumbers[type eq "work"].value) is used as the user’s primary phone number in Systam.
  • A "work" phone number is required if any phone numbers are mapped.
    • If you do not want to manage phone numbers in Systam, leave phone numbers unmapped.
    • If you do map phone numbers, make sure every in-scope user has a "work" phone number, or provisioning for those users will fail.

• The "work" email address is always the main email used for the user in Systam.
• When phone numbers are mapped, the "work" phone number is the main number used for the user in Systam.

Part D: Custom Attribute mapping

• The value mapped to primaryWorkspace is used as the user’s main workspace in Systam.
• primaryWorkspace is required. If this attribute is not provided for a user, provisioning for that user will fail.
• The value must match one of the workspace identifiers configured in Systam. If the value does not match any existing workspace, provisioning for that user will fail.
• If the primaryWorkspace value changes in Microsoft Entra ID, the change is applied to the user in Systam on the next provisioning cycle.

1. Back in the Attribute Mapping blade, review the default mappings.
2. Add the Workspace Mapping:
   • Scroll to the bottom of the mapping list and click Add New Mapping.
   • Source attribute: Select the attribute in Entra ID, that will be used to determine the employees primary physical location (e.g., department, physicalDeliveryOfficeName, country,  city, or an extension attribute).
   • Target attribute: Select the custom attribute you added in Part B: urn:ietf:params:scim:schemas:extension:systam:2.0:User:primaryWorkspace.
   • Click OK.
3. Select Save to commit the changes.

Step 6: Test and start provisioning

1. Test with on-demand provisioning
   • Select Provision on demand, choose a test user that is in scope, and run the operation.
2. Enable automatic provisioning
   • Set Provisioning status to On and choose the desired scope for provisioning.
3. Monitor provisioning
   • Use the provisioning logs to determine which users have been provisioned successfully
   • Check the progress bar to see the status of the provisioning cycle.

Additional resources

• Managing user account provisioning for Enterprise Apps
• What is application access and single sign-on with Microsoft Entra ID?