> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Manual User Sync

> Provision users from Microsoft Entra ID groups without SCIM, using group-to-role mapping in Role Provisioning.

# Manual User Sync

Manual User Sync provisions users from **Microsoft Entra ID** groups **without** a separate
SCIM Enterprise Application — it reuses your existing SSO app registration's Graph
permissions. Users are admitted and assigned roles from your group mappings when they sign
in, according to the **enforcement mode** you choose.

<Note>
  **Group-to-role mapping now lives in [Role Provisioning](/platform/role-provisioning).**
  That single section replaces the old *Role mapping*, *User provisioning*, *SCIM*, and
  *Trust identity provider* screens. This page covers the Entra-specific prerequisites and
  how manual (non-SCIM) provisioning behaves.
</Note>

## When to use it

| Use Manual (non-SCIM) provisioning when…       | Use [SCIM](/platform/scim) when…                     |
| ---------------------------------------------- | ---------------------------------------------------- |
| You don't want a separate Azure Enterprise App | You want a fully automated user lifecycle            |
| You handle offboarding yourself                | Auto-deprovisioning is required                      |
| Roles should apply at sign-up / login          | Your IdP should create and deactivate users directly |

<Warning>
  Manual provisioning and SCIM are **alternative approaches** for the same goal. SCIM is
  available **only with Microsoft Entra ID**, and only one identity provider can be active at
  a time. Don't run both against the same users.
</Warning>

## Prerequisites

1. [Microsoft Entra ID SSO is configured](/platform/sso) and working
2. At least one **verified email domain**
3. Your app registration has these **Application** Graph permissions, with admin consent:
   * `User.Read.All`
   * `GroupMember.Read.All`
   * `Group.Read.All`

<Note>
  Without `Group.Read.All` (and consent), no groups appear in the Role Provisioning picker.
</Note>

## Configure it in Role Provisioning

1. Log in as Owner or Admin → **Platform settings → Role Provisioning**
2. Turn on **User provisioning & role mapping**
3. Set a **Default Access** role for users who match no mapped group (or **No NeuralTrust
   access**)
4. Choose an **Enforcement** mode:

| Mode                     | Behavior                                                                                                       |
| ------------------------ | -------------------------------------------------------------------------------------------------------------- |
| **At sign-up only**      | Role assigned on first sign-in; never overwritten afterwards                                                   |
| **At sign-up and login** | Role re-applied every sign-in; a manual edit in [Users & groups](/platform/users) is overwritten on next login |

5. Under **Role Mapping**, add a row per Entra group and choose its platform role:

| Role                    | Access Level                                                         |
| ----------------------- | -------------------------------------------------------------------- |
| **Global Admin**        | Full admin across products and platform settings; billing visibility |
| **Admin**               | Manage members, most settings                                        |
| **Editor** / **Viewer** | Product permission levels — see [Users & groups](/platform/users)    |

<Warning>
  A user in **several** mapped groups gets the **highest-privilege** role among them — not
  the first match. Do **not** map IdP groups to **Owner**; transfer ownership in
  [Users & groups](/platform/users) instead.
</Warning>

## What manual provisioning does not do

* It does **not** auto-deprovision. Removing a user from an Entra group does not remove them
  from NeuralTrust — remove them in [Users & groups](/platform/users), or use
  [SCIM](/platform/scim) for automatic offboarding.

## Verify

1. Open **Platform settings → Users & groups**
2. Confirm the expected members appear with the correct roles
3. The **Groups** tab shows each synced group with its **source** and **member count**

All provisioning actions are recorded in [Audit Logs](/platform/audit-logs).

## Related documentation

* [Role Provisioning](/platform/role-provisioning) — Group-to-role mapping and enforcement
* [Microsoft Entra ID SSO](/platform/sso) — Connect Entra ID
* [SCIM Provisioning](/platform/scim) — Fully automated user lifecycle
* [Audit Logs](/platform/audit-logs) — Monitor sync and access events