Integration Description
The Microsoft Entra ID integration gives Zapro AI SAML 2.0 or OpenID Connect single sign-on along with SCIM provisioning, so the Entra provisioning service creates, updates and disables Zapro AI users and group assignment sets each person's procurement role.
What the Microsoft Entra ID integration does
- Disabling the account ends the spend rights
- Group assignment is the role
- Microsoft 365 users sign in once
How your records stay in sync
Skip the double entry. Zapro AI keeps these records matched with Microsoft Entra ID, so no duplicates are created and your data stays centralized.
How the connection is set up
- Create the enterprise application
- Configure provisioning
- Set the attribute mappings
- Scope by assignment and assign groups
- Start provisioning on a pilot group
- Test joiner, mover and leaver
How teams use it
- StartupAssignment to one security group creates the Zapro AI user with the right limit, and disabling the account removes the access.
- SMBGroup membership becomes the review, and conditional access rules already in Entra apply to anyone approving spend.
- EnterpriseCompany name and department attributes set the entity and cost coding, while group assignment keeps requester and approver rights separate.
How Zapro AI works with Microsoft Entra ID
Procurement
Applies the approval limit tied to each provisioned role when a purchase request is raised.
Vendor Management
Limits who can view or edit vendor records and compliance documents based on the assigned Entra group.
Contract Management
Scopes contract access and version history to provisioned roles and records every view in the audit trail.
Spend Analytics
Shows each signed-in user only the spend for the entities and departments their role covers.
Implementing Zapro improved our vendor coordination significantly, leading to a substantial reduction in costs and faster vendor onboarding.
Questions teams ask
What is SCIM provisioning and how does Entra ID use it?
SCIM is a standard REST interface and user schema for creating, updating and deactivating accounts in another application. The Microsoft Entra provisioning service maps directory attributes such as userPrincipalName, displayName and accountEnabled onto SCIM attributes and sends them to the Zapro AI SCIM endpoint on a recurring cycle, with assigned groups setting the Zapro AI role.
Do we need a paid Entra ID licence?
For automatic provisioning and group-based assignment, yes: those are P1 and P2 features. Single sign-on works without them, but users and roles then have to be created in Zapro AI manually.
How quickly does a leaver lose access?
On the next provisioning cycle, which runs periodically rather than instantly. Where immediate removal matters, revoke the sign-in session in Entra as well; the user then cannot authenticate even before the cycle runs.
What data crosses the connection, and how is it protected?
Only the attributes you map: typically user principal name, display name, mail, employee ID, department and group membership. No procurement data goes back to the directory. The SCIM secret token and all data at rest are encrypted with AES-256, and every provisioning event is written to the Zapro AI audit trail.
Can we use Entra ID alongside an HR system as the real source?
Yes, and it is the usual pattern. The HR system writes employee ID, department and manager into Entra, Entra provisions Zapro AI, and Zapro AI inherits the coding without a second feed to maintain.
