home

Zuora Platform

Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies
Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies

Welcome to Zuora Product Documentation

Explore our rich library of product information

Show Contents

thumbnailZuora Platform

Setup SSO with Microsoft Entra ID using SAML in OneID

Enable provisioning using SCIM API for Microsoft Entra ID

Learn how to configure System for Cross-domain Identity Management (SCIM) 2.0 provisioning in Microsoft Entra ID to automatically manage Zuora users and groups through Zuora OneID.

  • You are an administrator in both Microsoft Entra ID and Zuora OneID.

  • Your custom SAML application is active and working for single sign-on (SSO). To set up the application, see Set up SSO with Microsoft Entra ID using SAML in OneID.

  • If your provisioning scope is restricted to assigned objects only, the required users or groups are assigned to the enterprise application.

  • Your custom SAML application has the required attributes configured for SCIM provisioning.

  • You have created an OAuth 2.0 client in Zuora OneID to generate the client identifier and client secret that Microsoft Entra ID uses to authenticate requests to the OneID SCIM API. For more information, see Manage OAuth 2.0 clients.

System for Cross-domain Identity Management (SCIM) 2.0 is a standard that enables Microsoft Entra ID to automatically manage your users and groups in Zuora. When you add or remove a user in Microsoft Entra ID, the change is applied in Zuora through the Zuora OneID service.

Although Zuora OneID is not listed as an official Microsoft Entra ID marketplace application, you can integrate SCIM provisioning by using the same custom SAML application that you created for SSO. After the application is configured for SSO, you can enable SCIM provisioning within the same application.

  1. In the Microsoft Entra ID admin center, open your custom SAML application, and then in the left menu, click Provisioning.
  2. Click Get started, and then set Provisioning Mode to Automatic.
  3. Under Admin Credentials, enter the following Zuora SCIM values:
    Table 1. Admin credentials for SCIM provisioning
    FieldValue
    Authentication MethodOAuth2 Client Credentials Grant
    Tenant URLhttps://one.zuora.com/scim/v2/?aadOptscim062020
    Token Endpointhttps://one.zuora.com/oauth2/token
    Client Identifier and Client SecretThe values that you created in Zuora OneID.
    Note:

    The ?aadOptscim062020 parameter is required in the Tenant URL.

    By default, Microsoft Entra ID sends SCIM PATCH requests in a legacy format that is not SCIM 2.0 compliant. For example, it capitalizes operation values, sending "op": "Add" instead of "op": "add". The Zuora SCIM endpoint rejects these requests with a 400 Bad Request JSON parse error, and group membership updates fail. Appending ?aadOptscim062020 to the Tenant URL instructs Entra ID to send SCIM 2.0-compliant requests.

    Keep this parameter in the Tenant URL permanently. It is not a temporary workaround.

  4. Click Test Connection to confirm that Microsoft Entra ID can connect to Zuora.
  5. Save your settings, and then review Mappings to confirm that user information, such as email and name, is sent correctly.

    Keep the default user mappings unless the application vendor recommends a different schema. Confirm that Provision Microsoft Entra ID Groups is enabled if you intend to provision groups. Group membership can only be applied to users that already exist in Zuora, so the members of a provisioned group must also be in scope for the application.

  6. Set Provisioning Status to On to start automatic synchronization.
  7. Click Save.

Microsoft Entra ID begins provisioning the assigned users and groups to Zuora OneID. The initial synchronization can take several minutes to complete, depending on the number of objects in scope.

Validate that Microsoft Entra ID provisions users and group memberships to Zuora correctly:

  1. To validate individual user creates, select Provision on demand and select a test user.
  2. Set Scope to Sync only assigned users and groups, and then assign a single test group. Limiting the scope reduces the size of the synchronization cycle, so results appear faster.
  3. Select Restart provisioning to start a fresh synchronization cycle.
  4. Review the results in Provisioning logs.
Restriction:

The ?aadOptscim062020 parameter does not apply to Provision on demand. Microsoft documents this limitation. On-demand requests are sent in the legacy format, so on-demand group membership updates fail against Zuora with a JSON parse error even when your configuration is correct. Validate group membership through a full synchronization cycle instead.

For more information, see Known issues and resolutions with SCIM 2.0 protocol compliance of the Microsoft Entra user provisioning service in the Microsoft Entra documentation.

How-to
Platform
Standard

Last updated: August 31, 2026