> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.dify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

> Set up automatic member sync with Azure AD using SCIM. Version ≥ v2.7.0

This guide shows you how to connect Azure Entra ID to Dify Enterprise Edition's SCIM service for automatic member synchronization.

## Set Up Your Azure Application

### 1. Create a New Application

In the Azure admin portal, go to Applications and click **New application**.

![](https://assets-docs.dify.ai/2024/11/4f52715ff661e6c9430af09b4b2a4736.png)

Select **Create your own application**, give it a name (e.g., "dify"), choose **Integrate any other application you don't find in the gallery (Non-gallery)**, then click **Create**.

![](https://assets-docs.dify.ai/2024/11/b823ecfaa94d18ba0ac794cc0290dc7f.png)

### 2. Assign Users and Groups

From the application's left menu, select **Users and groups**, then click **Add user/group**.

![](https://assets-docs.dify.ai/2024/11/ed3c6f5de21c75e2261bf05d055ffb9e.png)

### 3. Set Up Provisioning

1. In the left menu, go to **Provision → Get started → Connect your application**.

![](https://assets-docs.dify.ai/2025/05/f890065efeb5390dcb43e7e7d1c1f5b8.png)

2. Under Admin credentials, enter:

* **Tenant URL**: Your SCIM endpoint URL
* **Secret token**: Your SCIM authentication token

> Get these values from [Sync Members](/en/3.3.x/administer/members/synchronization/sync-team-members).

![](https://assets-docs.dify.ai/2025/05/03f1e586bc428538d80b6f5316a293df.png)

3. Click **Test Connection** to verify your setup.

4. If the test passes, click **Save**.

### 4. Configure Attribute Mappings

1. On the provisioning page, click **Mappings**. You'll see two default mappings:

* `Provision Microsoft Entra ID Users` - for syncing users
* `Provision Microsoft Entra ID Groups` - for syncing groups

2. Click each mapping and keep only these attributes:

* **Provision Microsoft Entra ID Users**

| customappsso Attribute | Microsoft Entra ID Attribute                                 |
| ---------------------- | ------------------------------------------------------------ |
| userName               | userPrincipalName                                            |
| active                 | Switch(\[IsSoftDeleted], , "False", "True", "True", "False") |
| displayName            | displayName                                                  |

* **Provision Microsoft Entra ID Groups**

| customappsso Attribute | Microsoft Entra ID Attribute |
| ---------------------- | ---------------------------- |
| displayName            | displayName                  |
| members                | members                      |

### 5. Start Provisioning

1. Return to the main **Provisioning** page

2. Under **Settings**, choose your sync scope:

* "Sync only assigned users and groups" (best for selective sync)
* "Sync all users and groups" (for organization-wide sync)

![](https://assets-docs.dify.ai/2025/05/489e8b8f4091d53ab699ec33199d57a4.png)

3. Click **Save**
4. Click **Start provisioning**

<Note>
  First-time sync can take 20 minutes to several hours, depending on your directory size.
</Note>

### 6. Sync User Groups

To include groups in the sync:

1. Create a group in Azure Entra ID
2. In your Dify application, click **Users and groups**
3. Add the groups you want to sync

![](https://assets-docs.dify.ai/2025/05/af19820dfd75bd6bc00c602009574a77.png)

## Enable SCIM in Dify

Once Azure is configured:

1. Go to the Dify admin dashboard
2. Navigate to **Members** → click the menu button → **Automatic synchronization** → **Enable**

![](https://assets-docs.dify.ai/2025/05/08d3b05fc5dfaa1eb0a6b8bd523ea5f9.png)

> Sync isn't instant. Azure controls the sync schedule. Check your provisioning logs in Azure for sync history.