Add and remove people automatically

If your IT team manages staff in Microsoft Entra ID (Microsoft 365) or Okta, they can let it add people to SupplierVault when they join and remove them the moment they leave. You no longer need to remember to invite starters or remove leavers by hand. IT teams often call this automatic provisioning or SCIM.

• New people get access with the role you choose, unless your IT team sends a role.
• Leavers lose access straight away. Everything they did stays in the audit trail and change history.
• Every change appears in your audit trail, marked "Automatic provisioning (SCIM)".

Which plan includes it

The Enterprise plan, and the free month. On other plans the section says "Adding and removing people automatically from Microsoft Entra ID or Okta (SCIM) is included in the Enterprise plan." If your plan changes or ends, your identity provider can still switch people off, so leavers still lose access, but it can't add anyone.

Where to find it

Account button (top right) › Organisation › Add and remove people automatically. Only admins can see it.

Step 1: turn it on in SupplierVault

1. In New people join as, choose the role new people get when your IT team doesn't send one: View only (the default), Editor, Auditor or one of your custom roles. It can never be Admin.
2. In Only these email domains, list every email domain your staff use, separated by commas (for example yourcompany.co.uk, yourcompany.com). Subdomains are included. Select Save.
3. Select Turn on and make a token.
4. Copy the Tenant URL and the Secret token with the Copy buttons. The token is shown only once, so paste it straight into your identity provider or give it to your IT team securely.

About the email domains

• Enter your company's email domains before you turn it on (for example yourcompany.co.uk). SupplierVault won't make a token until it knows which domains are yours, so a leaked token can't be used to add outsiders.
• If you've set Google Workspace domains for company sign-in, those count too. You can't empty the list while syncing is on.
• You can list up to 20 domains. Someone with an email address outside the list is refused, and your identity provider shows why.

Step 2: set it up in Microsoft Entra ID

Your IT team does this in the Microsoft Entra admin centre.

1. Enterprise applications › New application › Create your own application. Name it "SupplierVault", choose Integrate any other application you don't find in the gallery (Non-gallery), then Create.
2. Provisioning › Get started (in newer portals, + New configuration). Set Provisioning Mode to Automatic.
3. Under Admin Credentials, paste the Tenant URL and the Secret Token. Select Test Connection (it should succeed), then Save.
4. Under Mappings, set Provision Microsoft Entra ID Groups to Enabled: No and save. SupplierVault adds people, not groups.
5. In Provision Microsoft Entra ID Users, keep the mappings in the table below. You can delete the others (job title, department, manager, address, phone and so on). SupplierVault ignores them, so leaving them in does no harm.
6. Under Settings, set Scope to Sync only assigned users and groups. Under Users and groups, assign the people or groups who should have SupplierVault.
7. Use Provision on demand to try one person first. Then set Provisioning Status to On and Save. Microsoft then runs about every 40 minutes.

Step 3 (optional): send each person's role

Without a role mapping, new people get the role in New people join as, people already in SupplierVault keep their role, and admins change roles in SupplierVault as usual. To control roles from Entra instead:

• Option A (recommended), a custom attribute. In Provision Microsoft Entra ID Users, tick Show advanced options › Edit attribute list for customappsso. Add urn:ietf:params:scim:schemas:extension:suppliervault:2.0:User:role as a String, save, then Add New Mapping to it. The source can be a Constant (for example editor), a Direct directory attribute that holds the role, or an Expression using app roles: create app roles called admin, editor, viewer and auditor under App registrations › SupplierVault › App roles, assign people or groups to them, and map SingleAppRoleAssignment([appRoleAssignments]).
• Option B, Microsoft's standard roles attribute. Map SingleAppRoleAssignment([appRoleAssignments]) to roles[primary eq "True"].value.

Values aren't case-sensitive. Any other value is refused, and the error lists the roles you can use. When a role is sent, it replaces the role set in SupplierVault.

Set it up in Okta

1. Applications › Create App Integration › SAML 2.0 (or SWA). Finish the wizard, then on General › App Settings set Provisioning to SCIM.
2. Provisioning › Integration › Edit. Set SCIM connector base URL to the Tenant URL, Unique identifier field for users to userName, and Supported provisioning actions to Push New Users and Push Profile Updates (don't tick Push Groups or Import). Set Authentication Mode to HTTP Header and paste the token into Authorization. Select Test Connector Configuration, then Save.
3. Provisioning › To App › Edit: turn on Create Users, Update User Attributes and Deactivate Users.
4. Optional role: Directory › Profile Editor › the SupplierVault app profile › Add Attribute. Set the external name to role and the external namespace to urn:ietf:params:scim:schemas:extension:suppliervault:2.0:User. Map it under Provisioning › To App › Attribute Mappings. The values are the same as for Entra.
5. Assignments: assign the people or groups who should have SupplierVault.

Okta only adds and removes people. It isn't a way to sign in: people sign in with Microsoft, Google or a SupplierVault password, using the email address Okta sent.

Google Workspace

Google Workspace can't do this for apps like SupplierVault. It only provisions apps in its own catalogue, and a custom app can't be pointed at SupplierVault. Instead:

• Staff can still sign in with Google, and you can switch on Company sign-in only and lock it to your Workspace domain, so someone switched off in Google loses access within 12 hours. See Sign in with Microsoft or Google.
• An admin invites people in Account › Team. See Invite your team.
• If your company also uses Entra ID or Okta, provision from there.

What happens

Company sign-in only, the lock to your own tenant or domain, and two-step sign-in still apply to everyone added this way.

Who is never removed or demoted

• The last admin of your organisation.
• The person who created the SupplierVault organisation.

For these two, your identity provider shows an error with the reason. An admin handles them in SupplierVault in Account › Team, for example by making someone else an admin first.

If an admin removes someone by hand

If an admin removes a person in Account › Team, provisioning doesn't add them back on its own. To give them access again, switch them off and on again in your identity provider, or invite them in SupplierVault.

Checking who has been added

The section shows On or Off, when it was set up, when it was last used and how many people have been added or switched off. Select Show people added this way to list them, each with their email, role and one of these:

New token, or turning it off

• Make a new token (click again to confirm) replaces the token. The old one stops working at once, so paste the new one into your identity provider straight away.
• Turn off (click again to confirm) stops the token working. People already added keep their access, so remove them in the Team tab if needed.
• Making, replacing and turning off the token, and changes to the settings, are recorded in the audit trail.

Troubleshooting

Errors show in your identity provider's provisioning logs.

Good to know

• Only people are added. Groups aren't, and roles come from a person's role attribute.
• Up to 5,000 people can be added this way to each organisation.
• SupplierVault keeps only a scrambled (hashed) copy of the token, so nobody can read it back later.
• This doesn't change how people sign in. To make everyone sign in with Microsoft or Google, see Sign in with Microsoft or Google.
• Stakeholders aren't added automatically. A stakeholder entry is created for a member when they first open the organisation, unless they're View only. See Invite your team.

Related

• Invite your team and set roles
• Sign in with Microsoft or Google
• Account, team and security
• Custom roles
• Plans and billing