Enterprise Integrations

Enterprise Integrations

Organizations with stricter identity and directory requirements can connect Sencai to their identity provider in three independent, self-service ways: SCIM 2.0 provisioning, Google Workspace Directory Sync, and Microsoft 365 / Entra ID admin consent. All three live under Settings → Integrations and are configured per organization by an Owner or Admin.

These are separate features that can be used independently or together:

• SCIM automates user lifecycle management (create/update/deactivate) from any SCIM-compatible identity provider (Okta, Azure AD / Entra ID, or a custom Google Workspace SCIM app).
• Google Workspace Directory Sync reads users and groups directly from a Google Workspace domain via Domain-Wide Delegation — a broader, Google-specific alternative to plain SCIM.
• Microsoft 365 / Entra ID reads license assignments from Microsoft Graph after an Azure admin grants consent — this is a license/seat sync, not a user-provisioning sync.

Note

Only an organization Owner or Admin can configure any of these integrations. Members and Viewers have read-only access where applicable.

SCIM 2.0 provisioning

Available at Settings → Integrations → SCIM Provisioning. SCIM lets your identity provider automatically create, update, and deactivate Sencai users as you manage them in your own directory, instead of inviting each person manually.

Generate a token

1. Go to Settings → Integrations → SCIM Provisioning
2. Click Generate New Token and optionally give it a label (e.g. “Okta production”)
3. The token value is shown exactly once, in a dialog that requires you to confirm you’ve saved it before it can be closed — it is never displayed again anywhere in the UI
4. Copy the SCIM Base URL shown on the same page (https://<your-domain>/api/scim/v2) and the token into your identity provider’s SCIM configuration

Tokens are valid for 90 days by default; you may request an earlier expiry when generating one, but never a later one. Revoke a token any time from the token list — revocation is immediate and the identity provider loses access right away.

Configure your identity provider

The SCIM page includes step-by-step setup instructions for each supported provider:

• Okta — add a SCIM-capable app from the App Catalog, set the SCIM connector base URL and Bearer token under Provisioning, then run Test Connector Configuration.
• Azure AD / Microsoft Entra ID — create an Enterprise Application, set Provisioning mode to Automatic, enter the Tenant URL and Secret Token, then run Test Connection.
• Google Workspace — Google Workspace has no native SCIM UI for custom apps; use Admin Console → Apps → Web and mobile apps → Add custom SAML/SCIM app, or use the dedicated Google Workspace Directory Sync below instead, which covers full directory sync rather than SCIM.

Google Workspace Directory Sync

Available at Settings → Integrations → Google Workspace Sync. This is a separate, Google-specific integration that reads users and groups directly from your Google Workspace domain using a service account with Domain-Wide Delegation — a broader read than plain SCIM. Setup is a 5-step wizard:

1. Instructions — create a Service Account in Google Cloud Console (IAM & Admin → Service Accounts → Create Service Account), download its JSON key, then in Google Admin Console go to Security → API Controls → Domain-wide Delegation → Add new and authorize the service account’s Client ID with these OAuth scopes:

   https://www.googleapis.com/auth/admin.directory.user.readonly
   https://www.googleapis.com/auth/admin.directory.group.readonly
   https://www.googleapis.com/auth/admin.directory.customer.readonly
   https://www.googleapis.com/auth/apps.licensing

2. Service Account — enter your Workspace domain (and optional Customer ID), then upload or paste the Service Account JSON key. The key is encrypted before storage and is never shown again after this step — every later view of this page only shows a masked “configured” indicator.

3. Admin email — enter the email of a real domain administrator account (never the service account’s own email). Domain-Wide Delegation impersonates this admin to read the directory.

4. Test Sync — runs a real sync and reports the number of users and groups found, or the connector’s error if something is misconfigured.

5. Done — shows sync status, last sync time, and the counts from the most recent sync. You can re-run the sync or update the key from here at any time.

Caution

The requested OAuth scopes are read-only but grant access to every user in the domain. Never share the downloaded Service Account JSON key outside this setup step.

Microsoft 365 / Entra ID

Available at Settings → Integrations → MS365 Integration. This integration reads Microsoft 365 license assignments (not user provisioning) via Microsoft Graph, after an Azure administrator grants consent.

1. Save your Azure Tenant ID — found in the Azure Portal under Entra ID → Overview → Tenant ID (a GUID). Enter it under Azure Tenant ID and click Save Tenant ID.

2. Grant Admin Consent — click Grant Admin Consent to open a Microsoft sign-in window. This requests read-only Graph API application permissions:

   • Organization.Read.All — license SKUs
   • User.Read.All — user list and license assignments

   These permissions are read-only — the sync never writes anything back to Azure AD, and consent must be granted by an administrator of your Azure AD tenant.

3. Verify consent — after granting consent in the Azure window, Sencai automatically verifies it when you return to this page; you can also click I’ve granted consent — verify manually at any time.

Once consent is granted, the page shows a Sync overview table with license type, SKU, and consumed/enabled/available seat counts, plus the last sync timestamp.

Note

If the Grant Admin Consent button is disabled, this Sencai instance itself hasn’t been configured with an Entra application (ENTRA_CLIENT_ID) yet — this is a platform-level prerequisite your organization can’t set on its own. Contact support if you expect this to be available.

Related settings

• SSO enforcement becomes available once your organization has a Google Workspace domain or an active MS365/Entra ID integration configured here — see the Organizations guide for how to enforce SSO-only login once one of these is set up.