To connect Microsoft Entra ID, open Team in Feeder, then SSO / SAML, and click Generate token under User provisioning (SCIM). In Entra ID, set provisioning to Automatic, paste the Tenant URL and the token, and turn provisioning on. Entra ID then adds, updates and removes the people on your Feeder team for you. User provisioning is part of Feeder's Enterprise plan. For a price quote, email sales@feeder.co.
User provisioning works best together with single sign-on (SSO) with SAML. Entra ID controls who is on your team, and your team signs in with their company account.
What do I need before I start?
- A Feeder Enterprise team, and the Team Admin role in Feeder.
- The Application Administrator role (or higher) in Microsoft Entra ID.
- An enterprise application for Feeder in Entra ID. If you already set up SSO, use that app. If not, create a non-gallery app named Feeder.
How do I get the tenant URL and token from Feeder?
- In Feeder, click Team in the sidebar and open the SSO / SAML tab.
- Under User provisioning (SCIM), click Generate token.
- Copy the Tenant URL (https://feeder.co/scim/v2) and the Secret token.
Copy the token right away. Feeder shows it only once. If you lose it, click Generate new token and paste the new one into Entra ID. The old token stops working at once.
How do I set up provisioning in Entra ID?
- In the Microsoft Entra admin center, go to Entra ID, then Enterprise apps, and open your Feeder app.
- Open Provisioning and set the provisioning mode to Automatic.
- Under Admin credentials, fill in:
- Tenant URL: the tenant URL from Feeder,
https://feeder.co/scim/v2. - Secret token: the token from Feeder.
- Tenant URL: the tenant URL from Feeder,
- Click Test connection, then Save.
- Under Mappings, open Provision Microsoft Entra ID Groups and set Enabled to No. Feeder doesn't support groups yet.
- Open Provision Microsoft Entra ID Users and check the attribute mappings in the table below. You can delete the other mappings, because Feeder doesn't use them.
- Under Settings, set Scope to Sync only assigned users and groups.
- Go to Users and groups and assign the people (or the Entra ID groups) who should be on your Feeder team.
- Back in Provisioning, set Provisioning Status to On and click Save.
After the first sync, Entra ID syncs about every 40 minutes. To add one person right away, use Provision on demand. Microsoft's own steps are in Configure automatic user provisioning.
Which attributes does Feeder use?
| Microsoft Entra ID attribute | Feeder attribute | What Feeder does with it |
|---|---|---|
| userPrincipalName | userName | Matches people in Entra ID to people on your team. Keep it as the matching attribute. |
| emails[type eq "work"].value | Becomes the email the person signs in to Feeder with. | |
| Switch([IsSoftDeleted], , "False", "True", "True", "False") | active | Turns the person's seat on or off. |
| objectId | externalId | Links the Feeder account to the Entra ID user. |
| givenName | name.givenName | First name. |
| surname | name.familyName | Last name. |
| displayName | displayName | Full name. |
If a person has no mail attribute, Feeder uses their userPrincipalName as their email.
What happens in Feeder when Entra ID syncs?
- You assign someone to the app: Feeder creates their account and adds them to your team. If they already have a Feeder account with your company's email domain, Feeder adds that account to your team and cancels their personal subscription, since your team now pays for them. They sign in with SSO.
- You unassign or disable someone: Feeder turns off their seat. They can't use your team's feeds anymore, and the seat is free for someone else. If you assign them again, their seat turns back on.
- You delete someone in Entra ID: Feeder removes them from your team.
Feeder never deletes a person's own Feeder account. It only changes whether they're on your team.
Common questions
Why does Entra ID say "This would put your account over capacity"?
Your team has no free seats. Add seats to your team, or email support@feeder.co. Entra ID tries again on its next sync.
Why does Entra ID say "A Feeder account with this email already exists"?
That person already uses Feeder outside your team, with an email outside your company's domain or on another team. Feeder doesn't move their account without asking them, so it sent them an invite instead. When they accept it, Entra ID links them on the next sync.
Why does Entra ID say "Your Feeder organization only accepts emails that end with..."?
Your team only accepts emails from your company's domain. Check the person's mail attribute in Entra ID.
Why does Test connection fail?
Check that you pasted the whole token, and that it's the newest one. If you clicked Generate new token or Turn off user provisioning in Feeder, the old token no longer works. Generate a new token and paste it again.
Can I use Okta or another identity provider?
Feeder supports the SCIM 2.0 standard for users, so other identity providers that support SCIM can connect with the same tenant URL and token. This guide covers Microsoft Entra ID.
How do I stop user provisioning?
Turn Provisioning Status off in Entra ID. To stop it for good, click Turn off user provisioning in Feeder too. People already on your team stay on it.
Still stuck? Email support@feeder.co with the error from your Entra ID provisioning logs, and we'll help you finish the setup.