Directory sync (SCIM)

Directory sync lets your identity directory decide who belongs to your Mereon organization. You set it up once, and from then on joining, changing details, and leaving the company are reflected in Mereon automatically instead of by hand.

The last one is the reason most teams do this. When somebody leaves, their Mereon access ends on their next request, their seat is freed, and the emails stop, without anyone remembering to do it. Their training record stays intact, so if they come back you reactivate them rather than starting them over.

Two people are usually involved, and they are often not the same person. A Mereon owner or admin generates the credentials. Your identity administrator configures the provisioning job. If you are not the identity administrator, send them this page.

Availability

Directory sync is part of the Enterprise plan. The Directory sync page is visible on every plan so you can see what it does, but generating a token requires Enterprise.

How it works

Mereon runs a SCIM 2.0 server. Your identity provider calls it on its own schedule to create people, update their details, and deactivate and reactivate them. Sync is one-directional: your directory writes, Mereon stores, and Mereon never writes anything back.

Nothing your directory sends ever deletes a person. A SCIM delete deactivates instead, which is what keeps a returning worker’s training history usable.

SCIM authenticates with its own bearer token and is independent of how your people sign in, so you do not need single sign-on to use it.

What Mereon keeps in step

Your directory	In Mereon
User	A person in your organization
userName / email	Their email, and the key used to match them
Given and family name	Their name
Phone	Their phone
Preferred language	Their language, falling back to your organization’s default
Time zone	Their time zone
Active / inactive	Active, or deactivated with history retained
externalId	The stable link back to your directory record

Roles are not synced. Everyone arrives as a Viewer, and Admin, Owner and Billing Admin stay manual grants inside Mereon. Sync never changes somebody’s role in either direction.

Groups, job titles and manager are not synced in this release. Group sync to teams is planned; job title mapping to company roles is planned and will be opt-in, because it depends on how consistently your directory fills that field.

Before you start

Open Settings → Directory sync in Mereon and keep it available. You will need two values from it:

• Your endpoint URL, shown on the page with a copy button.
• An access token, which you generate on that page.

Generate the token when you are ready to paste it. It is shown once, at the moment you create it, and cannot be retrieved afterwards. If you lose it, generate a new one — that replaces the old one, and sync stops until the new one is in your provider.

Choose the expiry deliberately. A token that lapses unattended stops offboarding, and nobody notices until somebody who left can still sign in. Mereon warns you before it expires and tells you once it has, and both events appear in the activity log.

Set up Microsoft Entra ID

You need a role in Entra that can create an enterprise application and configure provisioning — Application Administrator, Cloud Application Administrator, or Global Administrator. Automatic user provisioning requires a Microsoft Entra ID P1 or P2 licence.

Do not skip step 5

Entra’s default configuration links each person to Mereon using an attribute that changes when somebody is renamed. Step 5 replaces it with one that does not. Skipping it works until the first time an employee changes their name, which is exactly when you least want a duplicate record.

1. Create the application.

   In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications, then New application → Create your own application.

   Name it something your colleagues will recognise, such as Mereon. Choose Integrate any other application you don’t find in the gallery (Non-gallery), and select Create.

2. Open provisioning.

   In the new application, go to Manage → Provisioning, select Get started, and set Provisioning Mode to Automatic.

3. Enter your Mereon credentials.

   Under Admin Credentials:

   • Tenant URL — your endpoint URL from Mereon, which ends in /scim/v2.
   • Secret Token — the token you generated in Mereon.

   Select Test Connection. Entra makes a single request to Mereon looking for a user that does not exist, and expects an empty result. A green result means your URL and token are both correct.

   Select Save.

   If Test Connection fails, ignore the wording

   Entra reports a rejected token with the message “Your application is not reachable. Check the address or tenant identifier provided.” That wording sends people looking for a firewall or DNS problem, and the cause is usually the credential. Entra returns the same message whether it could not connect at all or connected and was refused.

   Check the token first: it must be pasted whole, with no leading or trailing whitespace, and a token that has been rotated or revoked in Mereon stops working immediately. Then check that the URL ends in /scim/v2.

   The activity log in Mereon tells the two cases apart. A rejected token appears there as a refused authentication, which means the request did reach Mereon and the credential was wrong. Nothing in the log at all means the request never arrived, and then it really is the address or the network.

4. Limit who is in scope.

   Under Settings, set Scope to Sync only assigned users and groups.

   This is the safer default. The alternative syncs every account in your directory, including service accounts and guests, and each one consumes a Mereon seat.

5. Correct the externalId mapping.

   Open Mappings → Provision Microsoft Entra ID Users, find the row whose customappsso Attribute is externalId, and select it. Change the Source attribute from mailNickname to objectId. Save the mapping, and then save the provisioning configuration.

   externalId is how Mereon recognises a person across changes. objectId is the one identifier in Entra that never changes for the life of the account. mailNickname, the default, is the mail alias, and it is routinely rewritten when somebody changes their name — the same event that changes their username and email. If both change at once and externalId changed with them, Mereon has nothing stable left to recognise, and a later full resync can add the person a second time instead of updating the one already there.

6. Assign the people to sync.

   Go to Users and groups → Add user/group and assign the users, or the groups whose members you want, to the application.

   Assigning a group here syncs its members as people. It does not create a team in Mereon; group sync is a separate feature that is not in this release.

7. Start provisioning.

   Return to Provisioning and select Start provisioning.

   The first cycle can take some time, because Entra reads your whole directory before it sends anything. After that, Entra syncs roughly every 40 minutes and sends only what changed. That interval is Entra’s and cannot be shortened, so a change you make in Entra is not expected to appear in Mereon immediately.

Check that it worked

Test one person end to end before you rely on it.

1. In Entra, open Provisioning → Provision on demand, choose somebody you assigned, and run it. This bypasses the 40-minute wait and shows you each step Entra took, including the exact values it sent.

2. In Mereon, open Settings → Directory sync and read the activity log. You should see that person provisioned, named by their email address.

3. In Entra, disable that person’s account. Run Provision on demand again. In Mereon they should now appear under the Deactivated filter on the members page, with their training history intact.

4. Re-enable them in Entra and provision on demand once more. They should return to active, on the teams and in the roles they held before.

When something does not arrive

The activity log in Settings → Directory sync is the place to look, and its most useful entries are the ones where nothing happened. It records what your directory asked for and what Mereon did about it, in plain words, for 90 days.

The cases it explains most often:

• Somebody has no email address. Mereon identifies people by email, so a directory record without one is skipped and logged rather than guessed at.
• A seat cap was reached. On a capped plan, people beyond the cap are refused rather than dropped silently, and your admins are emailed.
• The last owner would have been deactivated. Mereon refuses, because an organization with no owner cannot be administered. Promote another owner first.
• The token expired. Sync stops. This is the case that most often reaches support as “I added somebody hours ago and they still cannot log in.”
• Sync paused itself. If a single sync tries to deactivate an unusual number of people at once, Mereon stops rather than continuing. That is almost always a scoping filter pointing at the wrong group, and re-importing costs far less than restoring access for a workforce. Nobody past that point is deactivated, and you resume from the Directory sync page once you have seen what it was about to do.

Entra keeps its own record too, under Provisioning → Provisioning logs, which is where you see whether Entra decided somebody was out of scope and never sent them at all.

Editing people while sync is connected

The details your directory owns appear read-only on a person’s page in Mereon, marked Managed by your directory, so nobody types a new name, saves it, and has it overwritten on the next cycle. Their role stays editable, because sync never changes it.

Inviting somebody by hand still works. A person you invite yourself is simply not directory-managed, and sync leaves them alone.

Disconnecting

Disconnecting stops sync. Nobody is deactivated, nobody loses access, and everybody stays exactly as they are. The details your directory was managing become editable in Mereon again.

Because Mereon keeps each person’s link back to your directory, reconnecting later picks the same people up again rather than duplicating them.

Other providers

Mereon implements SCIM 2.0 as specified, so any provider that speaks it can connect. Entra is the one we have tested end to end, and it is the walkthrough above.

If you are configuring a different provider, the two values are the same — the endpoint URL and a bearer token — and the two settings worth checking are the same as steps 4 and 5: limit the scope to assigned users, and make sure whatever the provider sends as externalId is an immutable identifier rather than a username or an alias.