![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 83%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJG%3C/text%3E%3C/svg%3E)
Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Hello @Jacek Guzek
Yes, you can use the same Microsoft Entra on-premises provisioning agent for multiple SCIM applications. You don't need to install five separate agents just because you have five instances of the application.
Microsoft's documentation states that once the agent is installed, no further on-premises configuration is required and the provisioning configuration should be repeated for each application.
In your scenario, I would configure:
- 5 separate Enterprise Applications in Entra ID.
- Assign the same provisioning agent to each application.
- Configure each Enterprise Application with the SCIM endpoint and credentials for its respective Kubernetes application instance.
- Configure the appropriate user/group scope and attribute mappings independently for each department.
The main requirement is that the server hosting the provisioning agent must have network connectivity to all five SCIM endpoints.
For production/high availability, Microsoft currently recommends two active provisioning agents per application when using the SCIM connector.
So, one agent can technically service all five applications; one dedicated agent per application isn't required.
If this answer helps, please mark it as Answered.