Entra ID Provisioning

Connect Microsoft Entra ID's provisioning engine to QuickInspect and your workforce roster manages itself: HR onboards someone → they appear in QuickInspect; HR offboards them → their access is disabled the same day, with every safety record preserved. This guide is written for the IT administrator wiring it up.

Prerequisites

• QuickInspect Enterprise plan with API access enabled for your company
• Entra ID SSO configured (recommended — provisioned users activate on first SSO sign-in)
• An API key with the provisioning scope (Company Settings → API Access → Create key)

1. Create the secret token

In QuickInspect, as company owner: Company Settings → API Access → Create key, scope Read + Provisioning. Copy the qi_live_… key immediately — it is shown exactly once. This key is the "Secret Token" Entra asks for.

2. Connect Entra to QuickInspect

1. In the Entra admin center, open Enterprise applications and select your existing QuickInspect application (the one used for SSO), or create a new non-gallery application.
2. Go to Provisioning → Get started and set the mode to Automatic.
3. Under Admin credentials:
   • Tenant URL: https://api.quickinspect.me/scim/v2
   • Secret Token: the qi_live_… key from step 1
4. Click Test Connection. Entra should report success; if you get a 403, the key is missing the provisioning scope or API access isn't enabled for your company.

3. Attribute mappings

Open Provisioning → Mappings → Provision Microsoft Entra ID Users. QuickInspect uses a deliberately small attribute set — disable everything else (phone numbers, addresses, manager, …) to keep sync cycles clean:

Entra attribute	QuickInspect (SCIM) attribute	Notes
userPrincipalName	userName	Must be the email the person signs in with (matching key).
displayName	displayName	Shown across the app.
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active	Entra's default soft-delete expression — keep it.
department	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department	Matched by exact name against your QuickInspect department structure; unmatched values are ignored.
App role (optional)	roles	Only needed if QuickInspect has configured a role mapping for you — see below.

Roles: by default every provisioned user arrives as Standard. If certain HR groups should arrive as Key Users, QuickInspect configures a role mapping for your tenant (contact your QuickInspect representative) — HR sync can never grant elevated roles unless that mapping explicitly allows it.

4. Scope and start

1. Under Settings → Scope, choose Sync only assigned users and groups and assign the groups that should have QuickInspect access.
2. Set Provisioning Status to On and save.

Entra runs an initial cycle (creating everyone in scope) and then incremental cycles roughly every 40 minutes.

What each lifecycle event does

Entra event	Effect in QuickInspect
User assigned / created	Silent invite created (seat-checked). Active member on first SSO sign-in.
Attribute change	Display name / department updated.
User disabled or deleted, or removed from scope	Sign-in disabled immediately, seat freed. All HSE records remain — GDPR erasure stays a separate, deliberate in-app process.
Re-enabled	Sign-in restored (seat-checked like a new join).
Over seat capacity	The create fails visibly in the Entra provisioning log (seat-capacity-exhausted) and is retried after you add seats.

Troubleshooting

• Test Connection fails (401): the token isn't a valid key — re-create it and paste it without whitespace.
• Test Connection fails (403): key lacks the provisioning scope, or API access isn't enabled for the company.
• Users stuck as "invited": they haven't signed in yet. Check that SSO is configured and the person's userName equals their sign-in email.
• Department not set: the Entra department string must exactly match a QuickInspect department name.
• Every provisioning action is recorded in your company's audit trail with the API key as actor.