# Provision and deprovision Talon.One users in Microsoft Entra ID

> Microsoft Entra ID: Provision and deprovision Talon.One users via SCIM.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

This tutorial describes how to set up provisioning and deprovisioning of Talon.One users with [single sign-on (SSO)](/docs/product/account/account-settings/set-up-sso.md) using Microsoft Entra ID.

User provisioning and deprovisioning with single sign-on allows administrators to manage
user access across multiple service providers using a single identity provider, thereby
simplifying the user management process and enhancing security.

In this tutorial, the service provider is Talon.One, and the supported identity provider
is [Microsoft Entra ID][microsoftentraid] (formerly known as Azure AD). For more
information about Microsoft Entra ID, see the Microsoft Entra [integration documentation][entraidsso].

## Prerequisites

- You have admin rights in Microsoft Entra ID.
- You have [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role)
  in Talon.One.
- You have [set up single sign-on with Microsoft Entra ID](/docs/dev/tutorials/sso-with-microsoft-entra-id.md)
  in Talon.One.

## Create a Management API key in Talon.One

To enable Microsoft Entra ID to communicate with Talon.One, in Talon.One, you need to
create a [Management API key](/docs/product/account/dev-tools/manage-mapi-keys.md):

1. On the leftmost menu, click <Account className="icon"/> **Account** > <Tools className="icon" /> **Tools** > **Management API keys**.
1. Click **Create Key**.
1. In **Key name**, type a name to identify the key.
1. In **Key expiration date**, select a date.
1. In **Allowed endpoints**, type `/v1/provisioning/scim/` and click **Select all**. This
   selects all five endpoints the key should give access to.
1. Click **Create Key**.
1. Copy and save the generated API key in a secure location.

   :::note
   You cannot display the API key after this step. If you lose the value, create a
   new API key.
   :::

## Set up provisioning in Microsoft Entra ID

The next step is to set up provisioning for the Talon.One application. To do this:

1. In the Microsoft Entra admin center, in the Talon.One application, click **Provisioning**.
1. Click **Get started**.
1. For **Provisioning mode**, from the dropdown menu, select **Automatic**.
1. In **Tenant URL**, type `https://yourdeployment.talon.one/v1/provisioning/scim`,
   replacing `yourdeployment` with your Talon.One base URL.
1. In **Secret Token**, type `apikey:{key}`, replacing `{key}` with the API key you
   [created in Talon.One](#create-a-management-api-key-in-talonone).
1. (Optional) To test your connection, click **Test Connection**.
1. Click **Save**.

After provisioning is set up, on the **Provisioning** page, click **Overview** > **Start provisioning**.

Provisioning and deprovisioning of Talon.One roles and users is immediately enabled in Microsoft
Entra ID. You can [change the provisioning status][provisioningstatus] at any time.

## Manage Talon.One users in Microsoft Entra ID

After you've set up provisioning for the Talon.One application, you can invite and disable
Talon.One users directly from Microsoft Entra ID.

:::important
- If you change the settings for a group or member in Microsoft Entra, log out of your Talon.One account and log back in to see the changes.
- Changes made to roles and users in your Talon.One account do not apply in Microsoft Entra.
- Each time you log in to Talon.One, the current groups and member settings in Microsoft Entra override any changes made to roles and users in Talon.One.
:::

### Invite Talon.One users

To invite a Talon.One user from Microsoft Entra ID:

1. In the Microsoft Entra admin center, in the Talon.One application, go to **Users and groups**.
1. Click **Add user/group**.
1. Click **None selected** and select the user to invite to Talon.One.
1. Click **Select** > **Assign**.

An invitation is sent to the user's email address with steps to sign in to Talon.One with
their Microsoft Entra user account. Provisioning is performed in cycles, so this may take
up to several hours.

:::tip
To immediately invite a user or group of users to Talon.One, use [on-demand provisioning][ondemand].
:::

### Disable Talon.One users

To [disable a Talon.One user](/docs/product/account/account-settings/manage-users.md#disable-a-user)
from Microsoft Entra ID, follow the steps to [unassign users from an application][unassign].

:::note
You can only disable but not delete Talon.One users directly from Microsoft Entra ID.
:::

## Related pages

- [Set up single sign-on](/docs/product/account/account-settings/set-up-sso.md)
- [Set up single sign-on with Microsoft Entra ID](/docs/dev/tutorials/sso-with-microsoft-entra-id.md)

[microsoftentraid]: https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-verified-id
[entraidsso]: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso
[provisioningstatus]: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/configure-automatic-user-provisioning-portal?source=recommendations#provisioning-status
[ondemand]: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-on-demand?pivots=app-provisioning
[unassign]: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal#unassign-users-and-groups-from-an-application