Question

Your company uses a SaaS HR application that supports SCIM 2.0. You configure automatic user provisioning from Microsoft Entra ID to the application using an enterprise application. The security team requires that only members of the 'Sales-Team' group are provisioned to the SaaS app, and that provisioning must occur automatically going forward. Users outside this group must never be created in the target application. What should you configure to meet the requirement with the least administrative effort?

Accepted Answer

Assign the 'Sales-Team' group to the enterprise application and set the provisioning Scope to 'Sync only assigned users and groups'.

Answer

Set the provisioning Scope to 'Sync all users and groups' and add a scoping filter that excludes all groups except 'Sales-Team'.

Answer

Create a Conditional Access policy that restricts sign-in to the 'Sales-Team' group before enabling provisioning.

Answer

Configure the SCIM attribute mappings so that only users with a matching department attribute are written to the target system.