--- title: Provisioning Microsoft Entra ID with PingOne description: Provision Microsoft Entra ID with PingOne. component: pingone page_id: pingone:integrations:p1_provisioning_connection_entra_id canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_provisioning_connection_entra_id.html llms_txt: https://docs.pingidentity.com/pingone/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: May 13, 2026 section_ids: provisioning-capabilities: Provisioning capabilities before-you-begin: Before you begin steps: Steps result: Result: validation: Validation entra-id-directory-attributes: Entra ID directory attributes entra-id-provisioning-known-limitations: Entra ID provisioning known limitations --- # Provisioning Microsoft Entra ID with PingOne Microsoft Entra ID is Microsoft's cloud identity and access management service. By using the Entra ID connection in PingOne, you can provision users, groups, and memberships between Entra ID and PingOne. ## Provisioning capabilities The following table summarizes the inbound and outbound provisioning capabilities for each resource type: | Resource | Capability | Description | Inbound | Outbound | | ---------- | -------------- | ------------------------------------------------------------ | ------- | -------- | | User | Create | Generates a new user record in the destination. | Yes | Yes | | | Read | Retrieves or polls user attributes for synchronization. | Yes | Yes | | | Update | Modifies existing attributes, such as `job title`. | Yes | Yes | | | Delete | Deletes a user or temporarily suspends an account. | Yes | Yes | | Group | Create | Provisions a new group in the target application. | No | Yes | | | Rename | Updates the display name or identifier of an existing group. | No | Yes | | | Delete | Removes a group from the target application. | No | Yes | | Membership | Add and remove | Adds or removes users from groups. | No | Yes | ## Before you begin Make sure that you have: * An Entra ID administrative account. * The following from your Entra ID account: * Client ID * Client secret * Tenant ID * Users assigned to a specific population or group in PingOne designated for Entra ID provisioning. Learn more in [Adding a user in PingOne](../directory/p1_adduser.html) and [Managing groups](../directory/p1_managing_groups.html). ## Steps 1. Create an Entra ID connection: 1. In the PingOne admin console, go to **Integrations > Provisioning**. 2. Click **[icon: plus, set=fa]**and then click **New Connection**. 3. Click **Select** for **Identity Store**. 4. Click **Select** for the **Entra ID** connection, and click **Next**. 5. Enter a **Name** and **Description** for this provisioning connection. 6. Click **Next**. 7. []()In the **Configure Authentication** section, select **OAUTH** as the authentication method and enter the following from your Entra ID account: | Configuration | Example | | ----------------- | -------------------------------------- | | **Tenant ID** | `a401cea5-ecca-40a4-8562-190130df3815` | | **Client ID** | `7b2962dd-5cba-438b-9f3a-8ba838bb1489` | | **Client Secret** | `Ra9Dcbvws8@etcZbIkIAiXmK3q=Y5y:?` | 8. Click **Test Connection** to verify that PingOne can establish a connection to the Entra ID resource. ### Result: If there are any issues with the connection, a **Test Connection Failed** modal opens. Click **Next** to resume the setup with an invalid connection. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | You can't use the connection for provisioning until you've established a valid connection to Entra ID. If the connection fails, click **Cancel** in the **Test Connection Failed** modal, verify that you've entered the configuration details in [step 1g](#p1_configure_authentication_step) correctly, and try again. | 9. Click **Next**. 10. In the **User Actions** section, select the following as needed: | Field | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Enable users creation** | Creates a user in the target identity store when the user is created in the source identity store. | | **Enable users updation** | Updates user attributes in the target identity store when the user is updated in the source identity store.If **Enable users updation** is selected, you can choose to select **Enable users disable**, which disables a user in the target identity store when the user is disabled in the source identity store. | | **Enable users deprovision** | Deprovisions a user in the target identity store when the user is deprovisioned in the source identity store. If **Enable users deprovision** is selected, the following options appear:- **Remove Action**: Removes or disables a user in the target identity store when the user is deleted in the source identity store. Select **Delete** or **Disable**. Remove Action is only available if you select Enable users disable. - **Deprovision on rule deletion**: Deprovisions users if the associated provisioning rule is deleted. | 11. Click **Save**. 12. To enable the connection, click the toggle at the top of the details panel to the right (blue). | | | | - | ------------------------------------------------------------------------- | | | You can disable the connection by clicking the toggle to the left (gray). | 2. Create an [inbound](p1_create_provisioning_rule_inbound.html) or [outbound](p1_create_provisioning_rule_outbound.html) rule and select the existing Entra ID connection as the target or source. You can optionally add [attribute mappings](#entra-id-directory-attributes). For an outbound rule, you can use the following example attribute mappings as a starting point. | PingOne Directory | Entra ID | | ------------------------------------- | ------------------------------- | | `Given Name and [.codeph]`Family Name | `displayName` | | `"true"` | `forceChangePasswordNextSignIn` | | `User ID` | `onPremisesImmutableId` | | `Email Address` | `userPrincipalName` | | `"Test@123"` | `password` | | `#string.split(username, '@')[0]` | `mailNickname` | | `Enabled` | `accountEnabled` | | `Given Name` | `givenName` | | `Family Name` | `surname` | ## Validation * View the [sync status](p1_view_sync_status.html) to confirm users and groups are successfully provisioned to Microsoft Entra ID and to check for errors. * Review [sync status examples](p1_outbound_group_provisioning_sync_summary_examples.html) to help interpret your results. ## Entra ID directory attributes The following table lists common Entra ID attributes that can be mapped for user provisioning: | Attribute | Description | | ------------------- | ----------------------------------------- | | `userPrincipalName` | The username for the user. | | `givenName` | The user's first name. | | `surname` | The user's last name. | | `accountEnabled` | Indicates whether the account is enabled. | | `mobilePhone` | The user's mobile phone number. | ## Entra ID provisioning known limitations The following limitations apply to Entra ID provisioning: * Currently, inbound group provisioning or group membership synchronization from Entra ID to PingOne isn't supported. * You must grant the required tenant permissions in the Entra admin center before the connection can be established. * This connection is only supported for user inbound or outbound and group or membership outbound flows. Other synchronization paths aren't supported in this connection. * This connection currently doesn't support provisioning Microsoft license assignments, such as SKU IDs and service plans, for users.