Let your identity provider manage Frontelio accounts.

SCIM (System for Cross-domain Identity Management) is the standard your IdP already speaks to provision SaaS apps. Frontelio exposes a SCIM 2.0 endpoint your IdP calls directly — this page is for the person configuring that connection, not for building against the REST API (see the API Reference for that).

Base URL

Give your IdP this as the SCIM base URL / tenant URL:

https://api.frontelio.com/api/v1/scim/v2

Minting a SCIM token

A SCIM token is the same thing as a public-API key — just minted with the scim:read and scim:write scopes instead of the REST-resource ones. Go to Settings → Developer in the app:

1. In the API keys card, click Create key. If you see a "Turn on the public developer API" prompt instead, flip that toggle first — it only needs to be on once, and doesn't change anything about how SCIM itself works.
2. Give it a name that identifies the IdP, e.g. "Okta SCIM" or "Entra SCIM".
3. Select the scim:read and scim:write scopes.
4. Copy the key immediately — like every API key, the full value is shown once. If you lose it, revoke it and mint a new one.

Paste that value into your IdP's SCIM bearer tokenfield — the same field you'd use for any other SCIM-provisioned app.

Okta setup

1. In the Okta Admin Console, go to Applications → Browse App Catalog and add a SCIM 2.0 Test App (Header Auth) (or your Frontelio app integration, if you already have one).
2. Under the app's Provisioning tab, click Configure API Integration and check Enable API integration.
3. Set the Base URL to https://api.frontelio.com/api/v1/scim/v2 and the API Token to the SCIM key you minted above.
4. Click Test API Credentials — Okta calls the SCIM endpoint to confirm the token authenticates before saving.
5. Under Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users.
6. Assign the Okta groups you want synced to this app. Each group's display nameis what you'll map to a Frontelio role in the next section.

Microsoft Entra (Azure AD) setup

1. In the Entra admin center, go to Enterprise applications and create a new application (or open your existing Frontelio one), then open its Provisioning blade.
2. Set Provisioning Mode to Automatic.
3. Under Admin Credentials, set the Tenant URL to https://api.frontelio.com/api/v1/scim/v2 and the Secret Token to the SCIM key you minted above.
4. Click Test Connection — Entra confirms it can authenticate against the SCIM endpoint before you save.
5. Under Settings, set Scopeto "Sync only assigned users and groups", then assign the groups you want provisioned. Turn Provisioning Status to On to start the sync.

The group-mapping model

Your IdP pushes every group a provisioned user belongs to — that's normal SCIM behavior and Frontelio's SCIM server accepts all of it. What Frontelio actually doeswith a group is controlled entirely by your tenant's group mappings, configured in Settings → Developer underneath the SCIM section.

• A mapping is a pair: an IdP group display name (must match exactly what your IdP sends) → a Frontelio role.
• When a provisioned user belongs to a mapped group, they get that role in Frontelio.
• When a provisioned user belongs to an unmapped group — one with no matching row in your mapping table — nothing breaks. The group is silently ignored for role purposes; the user still gets provisioned, just without a role from that particular group. This is deliberate: it means you can assign your Frontelio app to broad Okta/Entra groups (e.g. "All Employees") without every group needing a Frontelio-side meaning.
• Mappings only affect futuresyncs. Adding or removing a mapping doesn't retroactively change the role of someone already provisioned — the next attribute sync (Okta polls periodically; Entra syncs on its own schedule, typically every ~40 minutes) picks it up.

To add a mapping: open Settings → Developer, find the group name exactly as it appears in your IdP (Okta: Directory → Groups; Entra: Groupsin the admin center), and add it with the Frontelio role it should grant. Delete a mapping the same way — it stops applying to future syncs, but doesn't change anyone already provisioned.

Confirming it worked

Both IdPs have a built-in connection test (Okta's Test API Credentials, Entra's Test Connection) — run that first. Once provisioning is turned on, assign yourself (or a test account) to a mapped group and trigger a sync (Okta: Push Now or wait for the scheduled import; Entra: Provision on demand in the Provisioning blade) — then confirm the account appears under Users in Frontelio with the expected role.

See also