Is it possible to provision identities to multiple on-prem apps with one SCIM agent?

Jacek Guzek 0 Reputation points
2026-09-15T07:17:35.1133333+00:00

Let's assume the scenario, where organization has 5 instances of the same app
installed in the kubernetes cluster, each for different department.
The Identities are provisioned from Entra ID Apps dedicated to each on-prem aplication instance thru SCIM protocol.
Customer want to use on-prem SCIM provisioning agent.

Is it possible to provision all those on-prem apps with single on-prem SCIM agent ?
Or there need to be five separate on-prem SCIM agents installed for each app respectively?

Documentation is not clear in this regard.
https://learn.microsoft.com/en-us/entra/identity/app-provisioning/on-premises-scim-provisioning?source=docs

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Konstantinos Lianos 830 Reputation points Student Ambassador
    2026-09-15T09:05:01.1833333+00:00

    Hello @Jacek Guzek

    Yes, you can use the same Microsoft Entra on-premises provisioning agent for multiple SCIM applications. You don't need to install five separate agents just because you have five instances of the application.

    Microsoft's documentation states that once the agent is installed, no further on-premises configuration is required and the provisioning configuration should be repeated for each application.

    In your scenario, I would configure:

    • 5 separate Enterprise Applications in Entra ID.
    • Assign the same provisioning agent to each application.
    • Configure each Enterprise Application with the SCIM endpoint and credentials for its respective Kubernetes application instance.
    • Configure the appropriate user/group scope and attribute mappings independently for each department.

    The main requirement is that the server hosting the provisioning agent must have network connectivity to all five SCIM endpoints.

    For production/high availability, Microsoft currently recommends two active provisioning agents per application when using the SCIM connector.

    So, one agent can technically service all five applications; one dedicated agent per application isn't required.

    If this answer helps, please mark it as Answered.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.