Prerequisites
- A RansomLeak tenant with admin access
- The "Manage Integrations" permission
- Entra ID P1 and the Application Administrator role
Your tenant is reachable at https://<your-subdomain>.ransomleak.com. Replace
<your-subdomain> with your own subdomain throughout this guide. Automatic
provisioning requires a Microsoft Entra ID P1 license or higher.
Provisioning is configured on the same enterprise application as SSO. If you have not set up SSO yet, create the application first using the SAML SSO guide, then return here. Provisioning also works on its own without SSO.
Supported features
- Create users
- Update user attributes
- Deactivate users
- Group provisioning (groups map to roles)
- Team & manager sync
RansomLeak deactivates users with a SCIM active: false update rather than a hard
delete, so a learner's history is preserved when they are offboarded. Entra ID sends each
user's directory object ID as externalId, which RansomLeak stores as the stable
account anchor.
Get your SCIM credentials in RansomLeak
-
Sign in to
https://<your-subdomain>.ransomleak.comas a tenant admin. -
Go to Admin → Tenant Settings → SCIM provisioning.
-
Click Generate token. RansomLeak shows your base URL and bearer token:
Base URLhttps://<subdomain>.ransomleak.com/scim/v2 -
Copy the token now, it is shown only once. Generating a new token invalidates the previous one. Store it securely; you will paste it into Entra ID next.
Configure Entra ID
-
Open your RansomLeak enterprise application in the Microsoft Entra admin center and go to Provisioning → Get started. Set Provisioning Mode to Automatic.
-
Under Admin Credentials, enter:
Tenant URLhttps://<subdomain>.ransomleak.com/scim/v2Secret Token<token-from-RansomLeak> -
Click Test Connection. When it succeeds, select Save.
-
Open Settings, set Scope to Sync only assigned users and groups, then set Provisioning Status to On and save.
-
Assign users or groups under Users and groups. Entra ID provisions them into RansomLeak on its sync cycle.
Entra ID runs provisioning on a cycle. The first sync can take up to 40 minutes; later changes sync within roughly 40 minutes. Use Provision on demand to push a single user immediately while you test.
Attribute mapping
Entra ID ships a default SCIM mapping that already covers the core fields. Keep the defaults,
with one adjustment: map the user's email to userName so provisioning and SSO
resolve to the same account.
Core attributes
| Entra attribute | SCIM attribute | Populates in RansomLeak |
|---|---|---|
userName | Email / login | |
emails[type eq "work"].value | ||
| givenName | name.givenName | First name |
| surname | name.familyName | Last name |
| displayName | displayName | Display name |
| objectId | externalId | Stable external ID |
Set userName to mail. Entra's default maps
userPrincipalName to userName. If your UPN differs from the user's
email, change the userName mapping to mail so the SCIM account
matches the email-based Name ID used at sign-in.
Teams, managers, and job titles
RansomLeak reads the standard SCIM enterprise extension
(urn:ietf:params:scim:schemas:extension:enterprise:2.0:User) to populate job
titles, teams, and the reporting line. Add these mappings to power team-based and
manager-based reporting.
| Entra attribute | SCIM attribute | Populates in RansomLeak |
|---|---|---|
| jobTitle | title | Job title |
| department | …:enterprise:2.0:User:department | Team (created automatically if the name is new) |
| manager | …:enterprise:2.0:User:manager | Reporting line, used to build your org hierarchy |
RansomLeak creates a team from the department name when it does not exist yet, and links each user to their manager by external ID. If a manager is provisioned after their reports, RansomLeak backfills the reporting line automatically once the manager arrives.
Group provisioning
RansomLeak Groups correspond to tenant roles. Assign an Entra group to the application and keep group provisioning on; RansomLeak creates a matching role and assigns it to the group's members. Group create, update, and delete are all supported.
Troubleshooting
| Symptom | Fix |
|---|---|
| Test Connection fails |
Confirm the Tenant URL ends in /scim/v2 and the Secret Token is the exact
token from RansomLeak. Entra adds the Bearer prefix for you.
|
| 401 after it previously worked | The token was regenerated or revoked in RansomLeak. Generate a new one and update the Secret Token in Entra. |
| Provisioning entered quarantine | Entra quarantines after repeated failures. Fix the credential or mapping, then use Restart provisioning. |
| User created with the wrong login | Map userName to mail if your UPN differs from the user's email address. |
Need a hand?
Email support@ransomleak.com and we will help you connect Microsoft Entra ID to your tenant.