> ## Documentation Index > Fetch the complete documentation index at: https://developers.lighton.ai/llms.txt > Use this file to discover all available pages before exploring further. # SCIM group provisioning from Microsoft Entra ID > Keep Console groups and their members in sync with your Microsoft Entra ID groups. Entra ID can keep Console groups and their members in sync with your Entra groups. Console creates one group per Entra group you assign. You then decide in Console which workspaces each group can reach. Group provisioning runs in the same enterprise application as user provisioning, and Entra turns it on by default. There is no second connection to set up. **The steps at a glance:** 1. [Before you start](#1-before-you-start): check that user provisioning works and that your tenant has Entra ID P1 or P2. 2. [Check the group mapping](#2-check-the-group-mapping) (Entra admin): confirm Entra's three default rows. Usually nothing to change. 3. [Assign the groups](#3-assign-the-groups) (Entra admin): assign them to the application and test one. 4. [Give the synced groups access to workspaces](#4-give-the-synced-groups-access-to-workspaces) (Console admin): add each group to the workspaces it should reach. ## 1. Before you start * **User provisioning works.** Follow [SCIM user provisioning from Microsoft Entra ID](https://developers.lighton.ai/users-auto-provisioning-configuration.md) first. A group member can be added only once their Console account exists. * **SSO users are matched, not duplicated.** If people already sign in with SSO, check the section *Users who already sign in with SSO* of the user guide. Otherwise Entra adds a duplicate account to the group, and the person, still signing in to their old account, gets none of the group's access. * **Entra ID P1 or P2.** Assigning groups to an application requires one of these licences. * **The API key owner is a Company Admin.** Group provisioning uses the same account as user provisioning; nothing more to do if you followed the user guide. ## 2. Check the group mapping 1. In the enterprise application, open **Provisioning > Attribute mapping**. 2. Click **Provision Microsoft Entra ID Groups** and check that **Enabled** is **Yes** (Entra's default). 3. Make sure the mapping holds exactly these rows, which are Entra's defaults: | Console attribute (target) | Entra attribute (source) | Notes | | - | - | - | | `displayName` | `displayName` | Matching precedence 1. Becomes the Console group name. | | `externalId` | `objectId` | Required for SharePoint document permissions (see below). | | `members` | `members` | | Delete any other row: Console rejects an update that contains an attribute it does not store. 4. Click **Save**. > [!WARNING] > > Keep `externalId` mapped to `objectId`. When a SharePoint datasource enforces document permissions, Console grants an Entra group's access to the Console group carrying that group's object id. Without it, every document shared with the group is held back until an admin binds the group by hand. ## 3. Assign the groups 1. Open **Users and groups** and click **+ Add user/group**. 2. Select the groups to sync and click **Assign**. 3. Test with one group: **Provisioning > Provision on demand**, pick the group, select a few members, click **Provision**. Check that the group and its members appear in Console, under the company's groups in the admin panel. Assigning a group also brings its members into scope, so Entra creates their accounts too. Only direct members are synced: Entra does not provision the members of nested groups. The next provisioning cycle, about every 40 minutes, picks up the change. **Provision on demand** pushes one group immediately. ## 4. Give the synced groups access to workspaces Entra syncs who is in each group. It does not decide what the group can reach in Console. In the Console admin panel, add each synced group to the workspaces it should access, with the role it should have there. From then on, adding someone to the group in Entra gives them that access, and removing them takes it away. The admin panel steps are in *How to Manage Groups?* (Administration > Identity & Access Management > Group Management). ## What happens in Console | In Entra ID | In Console | | - | - | | Group assigned to the application | A group with the same name is created in the API key owner's company. If a group with that name already exists, Entra takes it over instead. | | Member added to the group | The user is added to the Console group, as a member. | | Member removed from the group | The user is removed from the Console group and loses the access it granted. | | Group renamed | The Console group is renamed. | | Group unassigned from the application, or deleted | The Console group is **deleted permanently**, with its memberships and workspace access. It cannot be restored. | Console's built-in groups (the company-wide group and each user's private group) are never read or changed by Entra. > [!WARNING] > > Manage the membership of synced groups in Entra. A member added or removed in the Console admin panel drifts from Entra and can be undone by a later sync. ## Limits and troubleshooting Errors appear in **Provisioning > Provisioning logs**. Filter on **Status: Failure** and open the entry. | Error | Cause | Fix | | - | - | - | | `409 Conflict` when creating a group | A group with that name was deleted in the Console admin panel and is still in its recovery period (7 days by default). | Restore it in the admin panel, so that Entra takes it over, or delete it permanently. | | `Group displayName must not exceed 254 characters.` | The Entra group name is longer than 254 characters. | Shorten the group name in Entra. | | `Can not add a non-existent user to group` | A member has no Console account yet, often because their own provisioning failed. | Fix that user's error first (see the user guide), then **Provision on demand** for the group. | | `501 Not Implemented` on an update | The group mapping sends an attribute Console does not store. | Keep only the three rows of step 2. | | `401` or `403` | Connection or permission problem, shared with user provisioning. | See *Troubleshooting* in the user guide. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.