Automatic provisioning lets Microsoft Entra ID create, update, deactivate and delete your group's Kitchen back-office accounts. A person removed in Entra loses access to the back-office. This article is for the IT team that administers your Microsoft Entra ID directory, and for your group's Kitchen administrator.
Kitchen's interface is in French: labels are quoted as they appear on screen, with an English translation where it helps.
Protocol: SCIM 2.0 (RFC 7643 and RFC 7644), called by the Microsoft Entra provisioning service.
Authentication: OAuth 2.0 client credentials. Kitchen issues a client identifier and a secret specific to your group, and access tokens valid for one hour.
Resources: Users only. Groups are not supported.
Operations: create, read, search by userName, externalId or id, update (PUT and PATCH), deactivate, reactivate and delete.
Effect in Kitchen: a created person gets an active account with the Contributeur role. Their roles are then managed in Kitchen. A deactivated or deleted person loses access to the group's back-office, and all their Kitchen sessions are ended.
Not supported: group provisioning, and assigning Kitchen roles from Entra groups.
Roles allowed to set up provisioning:
Administrateur (Kitchen administrator)
Contributors do not see the Connexion Microsoft tab.
Your directory must already be connected to Kitchen: first follow the article "Set up Microsoft sign-in (SSO)". On the Microsoft side, the setup requires at least the Application Administrator role in Microsoft Entra ID.
Licensing. Provisioning requires the Microsoft sign-in paid option of the Kitchen subscription. On the Microsoft side, automatic provisioning is used according to Microsoft's licensing terms.
Step 1: In the back-office, go to Paramètres (Settings) → Connexion Microsoft. Scroll to the Provisionnement automatique (SCIM) card, with the À configurer (to configure) badge.
Step 2: Click Générer les identifiants (generate the credentials). The card shows four values: Tenant URL, Token Endpoint, Client Identifier and Client Secret. Copy them with Copier (copy).
Step 1: In the Microsoft Entra admin center, open Enterprise applications → New application → Create your own application. Name it, for example "Kitchen Provisioning", choose Integrate any other application you don't find in the gallery (Non-gallery), then click Create.
Step 2: In this new application, open Provisioning and set Provisioning Mode to Automatic. Under Admin Credentials, choose the OAuth2 client credentials grant method, then paste the four values copied from Kitchen: Tenant URL, Token Endpoint, Client Identifier and Client Secret.
Step 3: Click Test Connection, then Save. In Kitchen, the badge moves from En attente d’Entra (waiting for Entra) to Actif (active) at Entra's first call.
Step 4: Under Mappings, open Provision Microsoft Entra ID Users. For the target attribute externalId, replace the source attribute mailNickname with objectId, then save. Back under Mappings, disable Provision Microsoft Entra ID Groups: Kitchen does not support groups.
Step 5: Under Users and groups, assign the users or groups to provision. Also assign them to the "Kitchen" application used for sign-in, or they will not be able to sign in.
Step 6: Back under Provisioning, set Provisioning Status to On, then click Save. Entra then synchronizes your users about every 40 minutes.
Step 1: In the provisioning application, use Provision on demand on an assigned pilot user.
Step 2: In Kitchen, check in Paramètres → Utilisateurs (Users) that the person appears with the Contributeur role, and that the card shows a date under Dernier appel de provisionnement (last provisioning call).
Step 3: Ask the pilot to sign in with Se connecter avec Microsoft (sign in with Microsoft): the sign-in attaches to the provisioned account.
Step 4: Remove the pilot's assignment in the provisioning application, run Provision on demand again and check that their access is revoked in Paramètres → Utilisateurs.
Tenant URL and Token Endpoint are shown in the card. They are https://api.kitchen-app.io/functions/v1/scim and https://api.kitchen-app.io/functions/v1/scim-token respectively.
Access token. The token endpoint accepts grant_type=client_credentials, with the identifier and secret in an Authorization: Basic header (client_secret_basic) or in the request body (client_secret_post). It returns a Bearer token valid for one hour.
Supported user attributes:
userName (required, unique): by default, the userPrincipalName.
externalId (required, immutable): the Entra object ID (objectId), a GUID. The default mailNickname value is refused.
active: false deactivates the account in the group, true reactivates it.
displayName, name.givenName, name.familyName: display name, first and last name of the profile.
emails: the primary address, else the work one. Failing that, userName when it is an email address. An address is required.
Other attributes sent by Entra are ignored. Kitchen finds an existing account by its externalId only, never by its email address.
Rules to know:
A deactivation or deletion revokes the person's access to the group and ends all their Kitchen sessions, including those of their other groups.
A reactivation (active=true) restores access, even if a Kitchen administrator had revoked it by hand: Entra is the authority for provisioned accounts.
Kitchen refuses to deactivate or delete the group's last active administrator. First appoint another administrator in Paramètres → Utilisateurs.
An email address already used by another Kitchen account is refused.
If a person's email address changes in Entra after provisioning, their Microsoft sign-in is refused.
If your secret expires or is lost, generate a new one:
Step 1: In the Provisionnement automatique (SCIM) card, click Générer un nouveau secret (generate a new secret), then Générer. Copy the new secret.
Step 2: In Entra's provisioning application, paste it into Client Secret, click Test Connection, then Save.
The old secret keeps working until Entra obtains a token with the new one: provisioning is not interrupted. Kitchen accepts at most two active secrets at a time.
Click Désactiver le provisionnement (disable provisioning), then Désactiver. Entra can no longer create or update your users in Kitchen. Existing accounts are kept. Also stop provisioning in Entra (Provisioning Status set to Off).
"Le provisionnement demande l’option Connexion Microsoft et un annuaire connecté." Provisioning needs the Microsoft sign-in option and a connected directory: connect your directory first, or contact Kitchen to enable the option.
"Trop de secrets actifs. Désactivez le provisionnement, puis recommencez." Too many active secrets: disable provisioning, then start again.
"Seul un administrateur du groupe peut configurer le provisionnement." Only a Kitchen administrator of the group can set up provisioning.
"Une erreur est survenue. Réessayez." Unexpected error: try again.
invalid_client (401, token endpoint): wrong Client Identifier or Client Secret, or a replaced secret. Copy the values again, or generate a new secret.
unauthorized_client (400, token endpoint): provisioning is not available for the group (option disabled or directory disconnected).
unsupported_grant_type or invalid_request (400): the chosen method is not OAuth2 client credentials grant.
401 "Missing, invalid or expired access token": expired or revoked token. Entra requests a new one automatically; if the error persists, test the connection.
400 invalidValue "externalId must be the Entra object id (a GUID): map objectId to externalId": replace mailNickname with objectId in the externalId mapping.
400 invalidValue "An email address (emails or userName) is required": fill in the person's email address in Entra.
409 uniqueness "An account already uses this email address" or "userName or externalId is already provisioned": the address or identifier is already used by another account. Contact support.
400 mutability "The group must keep at least one active admin: promote another admin first": appoint another administrator in Kitchen before removing this one.
400 mutability "externalId cannot change": a provisioned person's object ID cannot change.
501 "Groups are not supported": disable the Provision Microsoft Entra ID Groups mapping.
Email [email protected], or click Aide et support (help and support) in the back-office to chat with the Kitchen team. Attach the relevant Entra provisioning log entries, without the secret.
