home

Zuora Platform

Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies
Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies

Welcome to Zuora Product Documentation

Explore our rich library of product information

Show Contents

thumbnailZuora Platform

Setup SSO with Microsoft Entra ID using SAML in OneID

Enable provisioning using SCIM API for Microsoft Entra ID

Learn how to configure System for Cross-domain Identity Management (SCIM) 2.0 provisioning in Microsoft Entra ID to automatically manage Zuora users and groups through Zuora OneID.

  • You are an administrator in both Microsoft Entra ID and Zuora OneID.

  • Your custom SAML application is active and working for single sign-on (SSO). To set up the application, see Set up SSO with Microsoft Entra ID using SAML in OneID.

  • If your provisioning scope is restricted to assigned objects only, the required users or groups are assigned to the enterprise application.

  • Your custom SAML application has the required attributes configured for SCIM provisioning.

  • You have created an OAuth 2.0 client in Zuora OneID to generate the client identifier and client secret that Microsoft Entra ID uses to authenticate requests to the OneID SCIM API. For more information, see Manage OAuth 2.0 clients.

System for Cross-domain Identity Management (SCIM) 2.0 is a standard that enables Microsoft Entra ID to automatically manage your users and groups in Zuora. When you add or remove a user in Microsoft Entra ID, the change is applied in Zuora through the Zuora OneID service.

Although Zuora OneID is not listed as an official Microsoft Entra ID marketplace application, you can integrate SCIM provisioning by using the same custom SAML application that you created for SSO. After the application is configured for SSO, you can enable SCIM provisioning within the same application.

  1. In the Microsoft Entra ID admin center, open your custom SAML application, and then in the left menu, click Provisioning.
  2. Click Get started, and then set Provisioning Mode to Automatic.
  3. Under Admin Credentials, enter the following Zuora SCIM values:
    Table 1. Admin credentials for SCIM provisioning
    FieldValue
    Authentication MethodOAuth2 Client Credentials Grant
    Tenant URLhttps://one.zuora.com/scim/v2
    Token Endpointhttps://one.zuora.com/oauth2/token
    Client Identifier and Client SecretThe values that you created in Zuora OneID.
  4. Click Test Connection to confirm that Microsoft Entra ID can connect to Zuora.
  5. Save your settings, and then review Mappings to confirm that user information, such as email and name, is sent correctly.

    Keep the default user mappings unless the application vendor recommends a different schema. Standard mappings include userPrincipalName to userName, displayName to displayName, givenName, surname, mail, and address fields.

  6. Choose whether to synchronize all users or only specific users and groups assigned to the application.
  7. Set Provisioning Status to On to start automatic synchronization.

Microsoft Entra ID begins provisioning the assigned users and groups to Zuora OneID. The initial synchronization can take several minutes to complete, depending on the number of objects in scope.

Last updated: August 21, 2026