Applies to: OnCAFE

Summary

Microsoft Entra provisioning normally runs on a scheduled sync cycle. However, administrators can use Provision on demand to manually provision a selected user or group before the next automatic provisioning cycle.

Provision on demand can help verify that the SCIM connection, attribute mappings, group membership, and OnCAFE group mappings are working as expected before broader deployment. Microsoft Entra provisioning into OnCAFE uses SCIM to create or update cardholder identities and group-related data.

This is useful when validating the Microsoft Entra integration, testing group membership, or confirming that mapped users are created and assigned correctly in OnCAFE.

This article explains how to manually provision a Microsoft Entra group and review the provisioning results.

Prerequisites

Before manually provisioning an Entra group, confirm the following:

• The Microsoft Entra integration has been enabled in OnCAFE. 
   
• The Microsoft Entra provisioning connection test is successful. 
   
• The Enterprise Application has been created in Microsoft Entra. 
   
• The desired Entra group has been assigned to the Enterprise Application. 
   
• Attribute mappings have been reviewed. 
   
• Any required OnCAFE import mappings have been configured. 
   
• Any required OnCAFE group mappings have been configured. 
   
• The users in the Entra group are within the provisioning scope.

IMPORTANT: If group mapping is not configured in OnCAFE, users may still 
be provisioned, but they may not be assigned to the expected OnCAFE 
cardholder groups.

Manually Provisioning an Entra Group

To manually provision an Entra group:

1. Log in to the Microsoft Entra admin center. 
    
2. From the left-side navigation menu, select Enterprise apps. 
   
   
    
3. Select All applications. 
    
4. Open the Enterprise Application created for the OnCAFE integration. 
   
   
    
5. From the application menu, select Provisioning. 
   
   
   
    
6. Expand the Admin Credentials section, then click Test Connection.
   
   
    
7. From the application menu, select Provision on demand. 
   
   This does not replace the normal Microsoft Entra provisioning schedule.
    
8. Next to Selected group, enter and select the Entra group to be provisioned.
   
   Users must be assigned to the Enterprise Application and included in scope before they can be provisioned.
    
9. Next to Selected users, select the radio button for the users to include in the provisioning test.
   
   Available options:
   
   View members only – displays only members of the selected group
   
   View all users – displays all available users related to the provisioning scope
    
10. If using View members only, select the users to be included. 
    
    
     
11. Click Provision.

Reviewing Provision Results

After the provisioning process runs, Microsoft Entra displays the provisioning results.

Review each section to confirm whether the group and users were processed successfully.

If a user is skipped, review the provisioning scope, application assignment, user properties, and group membership.

Confirm the provisioning action completed successfully.

Review any users marked as Skipped or Failed.

Post-Provisioning Validation

After manually provisioning the Entra group:

1. Log in to OnCAFE. 
    
2. Navigate to Identity > Identities. 
    
3. Confirm the expected users were created or updated. 
    
4. Confirm mapped identity fields are populated correctly. 
    
5. If import mapping is being used, confirm credential-related fields are populated.
    
6. Confirm users are assigned to the expected OnCAFE cardholder groups. 
    
7. If users appear in OnCAFE but are not assigned to the expected groups, review the OnCAFE group mapping configuration. 
    
8. Test access using a valid credential and assigned access permissions (if applicable).