Company Settings
Allows administrators to manage organization-level configurations. These include company information, identity provider integration (SCIM), and Single Sign-On (SSO).
1. Information Tab
Displays your organization’s core identity in Vince Platform.
Fields:
- Company Name – The display name of your organization (e.g. Companyname)
- Tenant ID – A unique system-generated ID for your tenant
Tip: Useful for support tickets and integration setup.
SCIM Setup
Overview
Vince Platform supports the SCIM 2.0 (System for Cross-domain Identity Management) protocol for automated provisioning from your Identity Provider (IdP) — such as Microsoft Entra ID (Azure AD) — directly into Vince Platform.
Two complementary capabilities are provided:
- User provisioning — user lifecycle events in your IdP are reflected automatically in Vince Platform.
- Group provisioning (Roles) — groups assigned in your IdP are created as Roles in Vince Platform, and group membership controls who holds each role.
User lifecycle
- Create — new users are created in Vince Platform when assigned in your IdP.
- Update — profile changes in your IdP sync to Vince Platform.
- Deactivate — removing access in your IdP deactivates the user in Vince Platform.
- Delete — deleting a user in your IdP permanently removes them from Vince Platform.
Group (Role) lifecycle
- Create — a group assigned in your IdP is created as a Role in Vince Platform (the group name becomes the role name).
- Membership — adding or removing a user in the group adds or removes that role on the user in Vince Platform.
- Rename — renaming the group in Entra does not rename the Vince Platform role.
- Remove — unassigning the group from the application removes the role. Hard-deleting the group in Entra does not.
What SCIM manages for roles: SCIM manages only the existence of the role and who is a member. A role's permissions are an admin/UI concern — configure them in Vince Platform under Administration > Access Management > Roles. SCIM never changes role permissions.
How SCIM groups map to Vince Platform roles
| Concept | User provisioning | Group provisioning (Roles) |
|---|---|---|
| SCIM resource | /Users |
/Groups |
| Vince Platform object | User account | Role |
| Created when… | a user is assigned in Entra | a group is assigned in Entra |
| Key identifier | userName (email) |
displayName (role name) |
| Membership | — | group members → role added to each user |
| What it controls | account lifecycle & profile | role existence & membership (not permissions) |
Prerequisites
Vince Platform Requirements
- Administrator access to Vince Platform
- SSO already configured with Microsoft Entra ID
- Access to Administration > Company Settings > SCIM
Microsoft Entra ID Requirements
- Microsoft Entra ID P1 or P2 license
- Application Administrator or Global Administrator role
- An existing Enterprise Application for Vince Platform
- Access to the Azure Portal: portal.azure.com
Before you begin: Complete SSO (Single Sign-On) setup with Microsoft Entra ID before starting SCIM. SCIM handles provisioning — SSO handles login. Both are required for a complete integration. The same prerequisites and credentials apply to User and Group provisioning.
Step 1: Generate a SCIM Token in Vince Platform
First, generate the SCIM credentials inside Vince Platform. You will need the SCIM Base URL and Bearer Token to configure Microsoft Entra ID. The same token and URL cover both User and Group provisioning.
- Log in to Vince Platform as an administrator.
- Navigate to Administration > Company Settings > SCIM.
- Select Identity Provider — choose Microsoft from the dropdown.
- Click Generate Token (or Regenerate Token).
- Copy the Token — the bearer token is displayed. Copy it immediately; it will not be shown again.
- Copy the SCIM Base URL — the Tenant URL is displayed on the same page. Copy this as well.
| Field | Value |
|---|---|
| Tenant URL (SCIM Base URL) | https://api.vince.live/v1/scim |
| Secret Token (Bearer Token) | Generated in Vince Platform — treat as a password. If lost, regenerate a new one. |
Step 2: Configure Microsoft Entra ID
Use the SCIM Base URL and Bearer Token from Step 1 to configure provisioning in Microsoft Entra ID.
Navigate to Enterprise Applications
Log in to portal.azure.com → go to Microsoft Entra ID → Enterprise apps → All applications.
Already have a Vince SSO app? Use the same Enterprise Application — do not create a new one. Skip ahead to Configure Provisioning.
Create the Application (if not already done)
In the App Gallery, click Create your own application.
- Enter the app name: Vince Platform
- Select: Integrate any other application you don't find in the gallery (Non-gallery)
- Click Create
Configure Provisioning
Inside the Vince Platform Enterprise Application, click Provisioning from the left menu.
| Step | Action |
|---|---|
| 1 | Set Provisioning Mode — change from Manual to Automatic |
| 2 | Enter Tenant URL — paste the SCIM Base URL: https://api.vince.live/v1/scim |
| 3 | Enter Secret Token — paste the Bearer Token generated in Vince Platform |
| 4 | Test Connection — click Test Connection and wait for the green success banner |
| 5 | Configure Mappings — see Attribute Mapping; enable both User and Group mappings |
| 6 | Set Scope — choose based on your need |
| 7 | Set Provisioning Status — change to On |
| 8 | Click Save |
Step 3: Assign Users & Groups
Only users and groups explicitly assigned to the Vince Platform Enterprise Application are provisioned (when scope is set to assigned. This gives you full control over who gets an account, and which groups become roles in Vince Platform.
Assign a user
| Step | Action |
|---|---|
| 1 | Go to Users and groups — click Users and groups in the left menu of the Vince Enterprise App |
| 2 | Click + Add user/group |
| 3 | Search and select — on the Users tab, search for the user, tick the checkbox, click Select |
| 4 | Assign a role — under Select a role, choose the appropriate Vince role, then click Assign |
Assign a group (provisions a role)
Assigning a group provisions it as a Role in Vince Platform and grants that role to the group's members.
| Step | Action |
|---|---|
| 1 | Go to Users and groups in the Vince Enterprise App, then click + Add user/group |
| 2 | Switch to the Groups tab in the Add Assignment panel |
| 3 | Search and select the group — tick the checkbox, then click Select |
| 4 | Click Assign — the group is now in provisioning scope |
Assigning a group widens provisioning scope: All direct members of an assigned group are pulled into provisioning scope and given the matching role. If a member is also a user created directly in the Vince Platform UI (matched by email), that account comes under SCIM control too — and may be deactivated later if it goes out of scope. Scope the application carefully so admin/UI-only users are not unexpectedly affected.
Nested groups not supported: Users must be direct members of an assigned group — not inside a sub-group. Use flat group structures only.
Step 4: Attribute Mapping
Attribute mappings control which data flows from Microsoft Entra ID into Vince Platform. Configure these under Provisioning > Attribute mapping in the Vince Enterprise App.
Enable Group provisioning: Set 'Provision Microsoft Entra ID Groups' to Enabled = Yes (alongside 'Provision Microsoft Entra ID Users'). Both mappings should be enabled to provision users and roles.
Supported SCIM User Attributes
| SCIM Attribute | Type | Status | Notes |
|---|---|---|---|
userName |
String | Required | Must be a valid email address. Used as unique identifier. |
active |
Boolean | Required | false deactivates the user in Vince Platform. |
displayName |
String | Required | Full name shown in Vince Platform. |
emails[work].value |
String | Required | Work email address. |
name.givenName |
String | Recommended | User's first name. |
name.familyName |
String | Recommended | User's last name. |
title |
String | Optional | Job title. |
department |
String | Optional | Department name, useful for reporting. |
userNamemust be a valid email: TheuserNamefield is the unique identifier for the user in Vince Platform. It must be a valid email address and is normalised to lowercase automatically.
Custom Attribute — M3 User ID (Vince Platform extension)
Vince Platform provides a custom SCIM user extension for mapping non-standard attributes from your IdP into Vince Platform. The first supported attribute is the M3 User ID.
| Property | Value |
|---|---|
| Extension schema (URN) | urn:ietf:params:scim:schemas:extension:vincelive:2.0:User |
| Attribute | m3UserId |
| Type | String |
| Status | Optional |
| Fully-qualified target | urn:ietf:params:scim:schemas:extension:vincelive:2.0:User:m3UserId |
| Corresponding M3 (Infor) SCIM attribute | urn:ietf:params:scim:schemas:extension:infor:2.0:User:ifsPersonId |
How to map it in Microsoft Entra ID
- Go to Provisioning → Attribute mapping → Provision Microsoft Entra ID Users.
- If the target attribute isn't listed, tick Show advanced options → Edit attribute list for customappsso, then add a new attribute with the full name
urn:ietf:params:scim:schemas:extension:vincelive:2.0:User:m3UserId(Type: String) and Save. - Add New Mapping:
- Mapping type:
Direct - Source attribute: your M3 User ID source in Entra (e.g. an Entra directory/extension attribute such as
employeeIdor a customextension_<appid>_m3UserId) - Target attribute:
urn:ietf:params:scim:schemas:extension:vincelive:2.0:User:m3UserId - Apply this mapping:
Always
- Mapping type:
- Save the mapping.
Behaviour
- Inbound — on user create/update, if the extension attribute is present, Vince Platform stores the M3 User ID on the user.
- Outbound — on user reads, if an M3 User ID is set, the response includes the extension schema and the
m3UserIdvalue. - The attribute is optional; users without it provision normally.
Infor M3 correspondence: On the Infor M3 side, the equivalent SCIM attribute is
urn:ietf:params:scim:schemas:extension:infor:2.0:User:ifsPersonId— the Vince Platformm3UserIdand InforifsPersonIdcarry the same identity value.
How it's stored: The M3 User ID is stored on the Vince Platform user record and is returned on user reads (
GET /Users) under theurn:ietf:params:scim:schemas:extension:vincelive:2.0:Userextension. It does not affect the user's permissions or roles.
Supported SCIM Group (Role) Attributes
| SCIM Attribute | Type | Status | Notes |
|---|---|---|---|
displayName |
String | Required | Becomes the Vince Platform role name. Cannot contain : / $ * ? { } [ ]. Immutable after creation |
externalId |
String | Recommended | The Entra group object ID. Stored on the role and used to match the role reliably on re-sync. |
members |
Complex | Managed | List of user references. Each member is granted the role. Managed automatically by Entra (added/removed via PATCH). |
Attributes to Remove from Default Entra Mapping
The default Entra user mapping includes fields Vince Platform does not use. Remove these to avoid sync errors:
addresses[work].*— street, city, state, postal, countryphoneNumbers.*— work, mobile, faxname.formatted— not neededmanager— not used for provisioningexternalId(mailNickname) — useuserPrincipalNameas identifier instead
Step 5: Configure Scope & Turn On
Before turning on provisioning, choose the right scope for your organisation. Scope applies to both assigned users and assigned groups.
Choose Your Provisioning Scope
| Scope Option | Use When |
|---|---|
| Sync only assigned users and groups | You want to control exactly who and which groups are provisioned. Only users and groups explicitly assigned to the app will sync. Recommended for most setups. |
| Sync all users and groups | You want all users and groups in your Entra ID directory provisioned automatically without manual assignment. |
Role permissions are not mapped: Group attribute mapping controls the role name and membership only. What a role is allowed to do is configured by an admin in Vince Platform (Access Management > Roles).
Enable Provisioning
- Go to Provisioning in the left menu.
- Scroll down to the Settings section.
- Set Scope based on your need (see table above).
- Change Provisioning Status from Off to On.
- Click Save.
Monitor Sync Health
After enabling provisioning, use these tools to monitor sync status:
- Provisioning Logs — shows each user and group create/update/fail with full detail
- Audit Logs — full history of all provisioning and config changes
- Insights — overview of sync success rates and pending actions
Verify Provisioning
Items provisioned via SCIM are tagged with createSource = SCIM. Use this to confirm both users and roles synced correctly.
Verify a user synced
- Log in to Vince Platform as an administrator.
- Navigate to Administration > Access Management > Users.
- Find and open the user that was provisioned.
- Scroll down to the Tags section.
- Confirm the tag: Tag Name = createSource, Value = SCIM.
Provisioning confirmed: If the user appears in Vince Platform with the
createSource = SCIMtag, provisioning is working correctly. If the tag is missing, check the Provisioning Logs in Entra ID for errors.
Verify a group (role) synced
- Navigate to Administration > Access Management > Roles.
- Find and open the role named after the assigned Entra group.
- Confirm the tag
createSource = SCIMon the role. - Check the role's members reflect the group's assigned users (allow a short indexing delay)
Supported SCIM Operations
User Operations
| Operation | Endpoint | Description | Status |
|---|---|---|---|
| Create User | POST /Users |
Creates user when assigned in IdP | ✓ Supported |
| Update User | PUT/PATCH /Users/{id} |
Syncs attribute changes from IdP | ✓ Supported |
| Deactivate User | PATCH /Users/{id} |
Sets active=false — user cannot log in |
✓ Supported |
| Delete User | DELETE /Users/{id} |
Permanently removes user from Vince Platform | ✓ Supported |
| List / Filter Users | GET /Users?filter= |
IdP checks if a user exists before creating | ✓ Supported |
Group (Role) Operations
| Operation | Endpoint | Description | Status |
|---|---|---|---|
| Create Group (Role) | POST /Groups |
Creates a role when a group is provisioned | ✓ Supported |
| List / Filter Groups | GET /Groups?filter= |
IdP checks if a role exists before creating | ✓ Supported |
| Get Group | GET /Groups/{id} |
Returns the role and its current members | ✓ Supported |
| Update Membership | PATCH /Groups/{id} |
Adds / removes members (role assignment) | ✓ Supported |
| Replace Group | PUT /Groups/{id} |
Full membership replace (reconciliation) | ✓ Supported |
| Delete Group (Role) | DELETE /Groups/{id} |
Removes the role; membership is cleaned up | ✓ Supported |
What happens when you assign a group: (1) Assign group to the Vince Platform app in Entra → (2) Entra calls SCIM (
GET /Groups) to check if the role exists → (3) Role created in Vince Platform, tagged SCIM (POST /Groups) → (4) Members get the role, membership synced per user (PATCH /Groups/{id}). Role permissions are configured separately by an admin in Vince Platform — SCIM never sets them.
Authentication
All requests to the Vince Platform SCIM API — for both /Users and /Groups — must include the bearer token in the Authorization header:
Authorization: Bearer <your-scim-token> Requests without a valid token will receive a 401 Unauthorized response. To rotate the token, generate a new one in Vince Platform (Administration > Company Settings > SCIM > Regenerate Token) and update it in your IdP provisioning settings.
Filtering
The list endpoints support SCIM filtering, used by IdPs to check whether a user or role already exists before creating it:
GET /Users?filter=userName eq "jane.doe@example.com" GET /Groups?filter=displayName eq "Finance" GET /Groups?filter=externalId eq "<entra-group-object-id>" Group Provisioning — Behaviour & Limitations
Group provisioning has been validated against live Microsoft Entra ID. Please review the following behaviours before rolling out to customers.
| Behaviour | What to expect / what to do |
|---|---|
| Roles, not permissions | SCIM creates and updates the role and its membership only. Configure what a role can do in Vince Platform (Access Management > Roles). |
| Group renames don't propagate | A role's name is fixed once created. Renaming the group in Entra will not rename the Vince Platform role. Choose the group name carefully before the first sync. |
| Invalid role names | Role names cannot contain : / $ * ? { } [ ]. A group whose name contains these characters is rejected (400); rename the group to remove them. |
| Membership is eventually consistent | After a membership change, it can take a short indexing window before GET /Groups/{id} reflects it. The change is applied — this affects read-back only. |
| Remove access by unassigning | To deprovision a role or membership, unassign the group from the app (or let it go out of scope). Hard-deleting the group in Entra removes it from Entra's sync source, so Entra never sends a delete and the Vince Platform role is left orphaned. |
| "Provision on demand" only adds | On-demand provisioning processes additions. Member removals and unassignments are handled by the scheduled cycle or Restart provisioning. |
| Assigning a group widens scope | All direct members are pulled into scope. If a member later goes out of scope, Entra may deactivate that user in Vince Platform — even if originally created in the Vince Platform UI (matched by email). Scope the app carefully. |
| Flat groups only | Nested / sub-group members are not provisioned. Use direct membership. |
Important Notes
| Topic | Detail |
|---|---|
| No invite emails | Users provisioned via SCIM do not receive invitation emails. They authenticate via your IdP (SSO). |
| Group = Role | A provisioned group maps to a Vince Platform role; the group's members are granted that role. |
| Role permissions | Managed by admins in Vince Platform (Access Management > Roles), not via SCIM. |
| Default role | Newly provisioned users with no group/role assignment receive the TenantUser role by default. |
| Email as identifier | The userName field must be a valid email and is the unique identifier within Vince Platform. |
| Case-insensitive emails | Email addresses are normalised to lowercase automatically. |
createSource tag |
Both users and roles created via SCIM are tagged createSource = SCIM. |
| Custom attributes | Vince Platform supports the vincelive:2.0:User SCIM extension for non-standard attributes (currently m3UserId). Map your IdP source attribute to the extension's fully-qualified target name. |
| Deactivation | Setting active=false via SCIM deactivates the user in Vince Platform; they can no longer log in. |
| Deletion | Deleting a user via SCIM permanently removes them from Vince Platform. This cannot be undone. |
Troubleshooting
| Issue | Fix |
|---|---|
| Test Connection fails | Verify the Tenant URL is exactly https://api.vince.live/v1/scim (no trailing slash). Regenerate the SCIM token in Vince and paste it again. |
| 401 Unauthorized error | Token is invalid or expired. Generate a new token in Vince Platform and update it in the IdP provisioning settings. |
| User not appearing in Vince | Check the user is assigned in Users and groups, and within scope. Check Provisioning Logs in Entra ID for the specific error. |
| Wrong role in Vince | Go to Users and groups > Edit assignment > change the role to the correct one. |
| Groups / roles not provisioning | Ensure 'Provision Microsoft Entra ID Groups' is set to Enabled = Yes in Attribute mapping, and the group is assigned in Users and groups. |
| Role not created in Vince | Confirm the group is assigned and within scope. Check Provisioning Logs for the group entry. |
| Members missing from a role | Allow for indexing lag (eventual consistency). For removals, run the scheduled cycle or Restart provisioning (Provision on demand only adds). Confirm members are direct (no nested groups). |
| Group renamed but role name unchanged | Expected — role names are immutable after creation. |
| Role still present after deleting the group | Expected — hard-deleting the group does not deprovision. Unassign the group from the app instead. |
| Invalid role name / 400 error | Role names cannot contain : / $ * ? { } [ ]. Rename the group to remove these characters. |
createSource tag missing |
The item may have been created manually before SCIM was configured. Check Provisioning Logs to confirm SCIM ran for it. |
| Sync not running | Confirm Provisioning Status is On. Check the Scope is set correctly for your setup. |
Support
If you encounter issues configuring SCIM provisioning, contact Vince Platform support with the following information:
- Your tenant ID
- The Identity Provider you are using (e.g. Microsoft Entra ID)
- Whether the issue is with user or group (role) provisioning
- Any error messages received during provisioning
- A Provisioning Log export from your IdP
Further reading
3. Single Sign-On (SSO) Tab
Features:
- Enforce SSO: Toggle on/off to require SSO for all users
- Identity Provider List: View and manage connected IdPs
- Actions: Add or delete an identity provider
Finding Your Redirect URL
When registering Vince Platform as an application with your Identity Provider (e.g. Microsoft Entra ID, Okta), you will need to provide a Redirect URL. This follows a fixed pattern based on your tenant ID:
https://<TENANT ID>.auth.eu-central-1.amazoncognito.com/oauth2/idpresponseExample:
https://TENANT-60125b0d2c5e406ea695ac86264b45d4.auth.eu-central-1.amazoncognito.com/oauth2/idpresponseSteps:
- In Vince Platform, click Administration in the top navigation.
- Under Company Settings, select Information.
- Click the copy icon next to Tenant ID to copy the full ID (including the
TENANT-prefix). - Insert your Tenant ID into the pattern above to construct your Redirect URL.
- Paste this URL into the corresponding field in your Identity Provider:
- Microsoft Entra ID: App registrations → your app → Authentication → Redirect URIs
- Okta: Applications → your app → General → Sign-in redirect URIs
Note: This page is found at
https://<your-tenant-name>.vince.live/company/information, where<your-tenant-name>is unique to your organization.
Configure and manage identity providers for user login.
Add Identity Provider
Steps:
- Navigate to Single Sign-On > Add Identity Provider
- Fill in the following fields:
- Identity Provider Name
- Issuer URL
- Client ID
- Client Secret
- Click Save
All fields are required. Get details from your IdP (e.g., Azure AD or Okta).
Best Practices
- Regularly review SSO and SCIM settings
- Document and securely store Tenant ID and secrets
- Enable SSO enforcement after validation
- Keep provider credentials up to date
Troubleshooting
- User sync issues? – Check SCIM configuration and IdP logs
- SSO login problems? – Verify issuer URL and client credentials
- Need your Tenant ID? – Find it in the Information tab