Configure SCIM provisioning with Microsoft Entra ID

Microsoft Entra ID can automatically provision users and groups to Terminalfour using SCIM 2.0.

Once configured, Entra ID can create, update and deactivate Terminalfour users, as well as provision groups and manage group membership.

Before you start

You will need:

1. A Terminalfour installation running version 8.4.5 or higher.
2. Your Terminalfour SCIM URL:
   https://your-instance-url.terminalfour.net/terminalfour/rs/scim/v2
3. An authentication token generated from a Terminalfour account with appropriate permissions to manage users.
4. A Microsoft Entra ID account with appropriate permissions to configure Enterprise Applications and provisioning.
5. The users and groups that you want to provision to Terminalfour.

Important
Keep your authentication token secure. It provides access to the Terminalfour SCIM provisioning endpoint and should be treated like a password.

1. Create an Enterprise Application

Sign in to the Microsoft Entra admin center.

Navigate to:

Identity → Applications → Enterprise applications

Select New application.

Select Create your own application.

Enter a name for the application, for example:

Terminalfour

Select:

Integrate any other application you don't find in the gallery (Non-gallery)

Then select Create.

2. Open the provisioning settings

Open the Terminalfour enterprise application you have created.

Select Provisioning from the application's menu.

Select Get started.

Set Provisioning mode to:

Automatic

3. Configure the Terminalfour connection

Under Admin Credentials, enter your Terminalfour SCIM details.

For Tenant URL, enter your Terminalfour SCIM URL. This will be your Terminalfour instance URL followed by /rs/scim/v2

e.g. https://example.terminalfour.net/terminalfour/rs/scim/v2
 
For Secret Token, enter the authentication token generated in Terminalfour.

Select Test Connection.

Entra ID should confirm that the connection was successfully established.

If the connection fails, check that:

• The SCIM URL is correct.
• The authentication token is correct.
• The token has not expired or been revoked.
• The Terminalfour installation is accessible from Microsoft Entra ID.

4. Configure users and/or groups

Entra ID can provision both users and groups to Terminalfour.

The users and groups that you assign to the Terminalfour enterprise application determine what is provisioned.

We recommend using an Entra ID group to manage access to Terminalfour rather than assigning users individually.

For example:

Terminalfour Users
├── Alice
├── Bob
├── Charlie
└── David
 
Changes to membership of the group can then be reflected in Terminalfour automatically.

5. Configure user attribute mappings

Open the Mappings section of the provisioning configuration.

Entra ID uses attribute mappings to determine what information is sent to Terminalfour.

The following SCIM attributes are required by Terminalfour:

Username

Map the Entra ID user identifier to the SCIM userName attribute.

The resulting username becomes the user's Terminalfour login username.

Terminalfour usernames have a maximum length of approximately 20 characters, so make sure the value being mapped does not exceed this limit.

First and last name

Map name.givenName to the user's first name,

and name.familyName to the user's last name.

These values are displayed in the Terminalfour UI.

Email address

Map the user's primary email address to emails[0].value.
 
Terminalfour uses the primary email address when one is identified. If no email address is marked as primary, the first email address in the array is used.

Active status

Map the user's active/enabled status to active.

This controls whether the Terminalfour account is enabled.

A value of true is required to create an enabled user. If the value is omitted, the user is created as disabled.

External ID

You can optionally map an Entra ID user's unique identifier to externalId.

Terminalfour stores this value as the external identity-provider identifier and uses it when performing filter lookups.

This helps Terminalfour reliably identify the corresponding identity-provider account.

6. Configure Terminalfour user attributes

In addition to the standard SCIM user attributes, Terminalfour supports several extension attributes that determine the user's initial configuration.

These attributes should be mapped to appropriate values in Entra ID.

User type

The userType value determines the user's Terminalfour role.

For example:

• 50 = Visitor
• 2  = Contributor
• 1  = Moderator
• 40 = PowerUser
• 0  = Administrator

Use the appropriate value for the users being provisioned.

Take particular care with this setting. It determines the level of access granted to a provisioned user.

Default content language

Set defaultContentLanguage to the appropriate language code, for example: en

UI locale

Set uiLocale to the locale that should be used by the Terminalfour user interface.

Valid options are: en or es-419

Preferred HTML editor

Set preferredHtmlEditor to the ID of the Terminalfour HTML editor that should be assigned to the user.

Default preview channel

Set defaultPreviewChannel to the ID of the Terminalfour channel that should be used as the user's default preview channel.

Extranet access

Set extranetAccess to the appropriate value:

• I = Inherited
• N = No access
• A = Administrator
• E = End user

7. Configure provisioning scope

Under Settings, configure the provisioning scope.

If you want only users and groups explicitly assigned to the Terminalfour application to be provisioned, select:

Sync only assigned users and groups

This is recommended when setting up the integration because it gives you explicit control over which users and groups are sent to Terminalfour.

8. Assign users and groups

Open Users and groups for the Terminalfour enterprise application.

Select Add user/group.

Select the groups and/or users that should be provisioned.

Where possible, we recommend assigning groups rather than individual users. This allows Terminalfour access to be managed through your existing Entra ID group structure.

9. Start provisioning

Return to the Provisioning page.

Review your configuration and select:

Start provisioning

Entra ID will begin synchronising the assigned users and groups with Terminalfour.

The initial synchronisation may take some time.

You can monitor the process from the Provisioning page.

10. Verify the provisioning

Sign in to Terminalfour and open the Users section.

Confirm that the provisioned users have been created with the expected:

• Username
• First name
• Last name
• Email address
• User type
• Language
• UI locale
• HTML editor
• Preview channel
• Extranet access

Open Groups and verify that provisioned groups and their memberships have also been created correctly.

11. Test the user lifecycle

Before enabling provisioning for your entire organisation, test the complete lifecycle using a test user and group.

Create

Add the test user to the assigned Entra ID group.

Confirm that the user is created in Terminalfour.

Update

Change an attribute such as the user's name.

Confirm that the change is reflected in Terminalfour.

Group membership

Add or remove the test user from a provisioned group.

Confirm that the corresponding Terminalfour group membership changes.

Deactivate

Deprovision the test user.

Confirm that the Terminalfour account is disabled.

Once you have verified the behaviour, you can expand the assignment to your production users and groups.