Microsoft Entra ID - Wave Connect

SCIM provisioning is available on the Enterprise plan. The directory integration (Microsoft Graph) is available on the Teams and Enterprise plans. Both are organization-level and configured by an admin.

There are two ways to connect Microsoft Entra ID (formerly Azure Active Directory) to Wave Connect. Both create and update Wave Connect users from your directory. They differ in who gets synced, how offboarding works, and what keeps the connection alive.

Which should I use?

	Directory Sync (SCIM), recommended	Directory integration (Microsoft Graph)
Plan	Enterprise	Teams and Enterprise
Who is synced	Only the users and groups assigned to the Wave Connect enterprise app	Every user in the tenant, guests included
Teams	Entra groups become Wave Connect teams	None
Offboarding	Unassigning or disabling the user deactivates them. Entra deletes the user after its 30-day grace period	Deleting or disabling the user deactivates them. Nothing is ever deleted
What it depends on	A SCIM token	The admin account that connected it
When changes arrive	Entra provisioning cycle, about every 40 minutes	Change notifications within minutes while User sync is on

SCIM provisioning is the approach Microsoft recommends for keeping an app in sync with Entra ID. Choose the Graph integration only on the Teams plan or for a one-off import.

Set up SCIM provisioning

Create a SCIM token in Wave Connect

Go to Settings → Security and find the Directory Sync card. Click Configure to open the Configure SCIM modal. Copy the SCIM Endpoint (https://app.wavecnct.com/api/scim), then click Create Token. Give the token a name and click Create. Copy the token now. It is only shown once.

Create the enterprise application

In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application. Enter a name such as “Wave Connect”, choose Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.

Enter the SCIM credentials

Open the new application and go to Provisioning → Get started. Set Provisioning Mode to Automatic. Under Admin Credentials, paste the SCIM endpoint in Tenant URL and the token in Secret Token. Click Test Connection, then Save.

Review the attribute mappings

Under Mappings, open Provision Microsoft Entra ID Users and compare it with the table below. Entra’s defaults cover most rows. You only need to edit the primary email, locale and externalId rows. Leave Provision Microsoft Entra ID Groups enabled if you want Entra groups to become Wave Connect teams.

Assign users and groups

Go to Users and groups and assign the people and groups that should have a Wave Connect account. Only assigned users are provisioned.

Start provisioning

Back on Provisioning, set Provisioning Status to On and click Save, or click Start provisioning. Entra runs an initial cycle, then an incremental cycle about every 40 minutes. To check a single user without waiting, use Provision on demand.

Attribute mapping

Wave Connect reads these SCIM attributes. The Wave Connect field column shows where each value lands.

Entra ID attribute	SCIM attribute	Wave Connect field
`userPrincipalName`	`userName`	Stored as the username. Also used as the account email when no primary email is sent on creation
`givenName`	`name.givenName`	First name (required)
`surname`	`name.familyName`	Last name (required)
`mail`	`emails[type eq "work"].value` with `emails[type eq "work"].primary` set to True	Account email and login email (required). Wave Connect reads the primary email as the account email
`jobTitle`	`title`	Job title
`mobile`	`phoneNumbers[type eq "mobile"].value`	Account phone and mobile phone
`telephoneNumber`	`phoneNumbers[type eq "work"].value`	Work phone
`city`	`addresses[type eq "work"].locality`	City
`preferredLanguage`	`locale`	Language. Edit the default mapping: Wave Connect ignores `preferredLanguage` and reads `locale`
`Switch([IsSoftDeleted], , "False", "True", "True", "False")`	`active`	Active or deactivated (Entra default)
`objectId`	`externalId`	External ID. Use `objectId` rather than the default `mailNickname` so it matches the Graph integration

Entra’s default mappings already cover userName, name.givenName, name.familyName, title, the phone numbers, addresses[type eq "work"].locality and active. Only three rows need editing: make sure the work email mapping sets primary to True, change the preferredLanguage target from preferredLanguage to locale, and change the externalId source from mailNickname to objectId.

Other notes on the mapping:

Phone numbers are validated and stored in international format. Placeholders and extension-only values are dropped instead of failing the sync.
roles[].value set to USER, ADMIN or OWNER (uppercase) sets the organization role. Entra does not send roles by default, so new users are created as users.
The enterprise extension department is not stored on the profile. Department-based team assignment can be enabled by Wave Connect support.
A locale value must be one of the languages Wave Connect supports, otherwise the user gets English.

Groups become teams

When group provisioning is enabled, each Entra group assigned to the application becomes a Wave Connect team. The group displayName becomes the team name and the group objectId is stored as the team’s external ID. If a team with the same name already exists in Wave Connect, the group is merged into it. A Wave Connect user belongs to one team. If a user is in several assigned groups, the last group Entra provisions wins. An organization can have up to 75 teams. Deleting a group in Entra deletes the team in Wave Connect. Its users are kept and its contacts are moved to the organization. Each team can have a different template, so users in different groups automatically get the right card layout, branding, and locked fields. See Templates.

Offboarding

When a user is unassigned from the application, disabled, or soft-deleted in Entra, the provisioning service sends active = false. Wave Connect deactivates the user:

They can no longer log in and their sessions are revoked.
They appear with a SUSPENDED badge in Users.
Their NFC card, profile and contacts are kept.
They still count as a seat.

Entra keeps a soft-deleted user for 30 days and then sends a delete request. Wave Connect then permanently removes the user, deletes their profile and contacts, and unlinks their NFC card so it can be assigned to someone else. If you do not want the 30-day grace period, open Settings → Security → Directory Sync → Configure and enable Delete user immediately instead of suspending. Deactivation then permanently deletes the user right away. To bring a deactivated user back, assign them to the application again in Entra. The next provisioning cycle sends active = true and reactivates the account.

You can enable single sign-on on the same enterprise application. See Single Sign-On (SAML).

Directory integration (Microsoft Graph)

The directory integration connects Wave Connect to your tenant through the Microsoft Graph API using an admin’s account. It is simpler to set up than SCIM, but it syncs the whole tenant and depends on the account that connected it.

How to connect

There are two entry points. They create the same integration but with a different default for User sync, the switch that applies directory changes automatically.

From integrations
From users

Go to Integrations → Microsoft Entra ID and click Install App.
Leave Automatically import new users from Microsoft Entra ID on, or turn it off if you only want a manual import. Click Continue.
Sign in with a Microsoft account that can grant admin consent on the tenant, and accept the consent prompt.

With that switch on, every user in the tenant is created in Wave Connect as change notifications arrive, and future changes are applied automatically. It appears as User sync in the integration’s Settings.

With User sync on, this integration adds a Wave Connect user, and a seat, for every user in the tenant, including guests. There is no way to limit it to a group.

Permissions

Wave Connect requests the delegated scopes openid, offline_access, profile, User.Read.All and Directory.Read.All on the connecting admin’s account. Wave Connect only reads the directory. It never writes to Entra. The integration runs with that admin’s refresh token. If the token is revoked (for example the admin leaves, their password is reset with session revocation, or a conditional access policy blocks the refresh), Wave Connect deletes the integration and an admin has to reconnect it.

What gets synced

Entra ID field	Wave Connect field
`givenName`, `surname` (or `displayName` split on the first space)	First name, last name
`userPrincipalName`, or `mail` for guests (UPN contains `#EXT#`)	Account email and login email
`mail`, else `userPrincipalName`	Work email
`mobilePhone`	Account phone and mobile phone
`businessPhones[0]`	Work phone
`jobTitle`	Job title
`city`, else `officeLocation` on creation	City
`preferredLanguage`	Language, re-applied on every update
Organization name	Company
Profile photo	Avatar, manual import only

Sync direction: Entra ID → Wave Connect (inbound only). Profile photos are only fetched during a manual import or preview and stored as a copy in Wave Connect. Users created by User sync do not get a photo.

User sync and deactivation

After connecting, Wave Connect subscribes to Microsoft Graph change notifications for users (created, updated, deleted). Subscriptions last three days and are renewed automatically from Graph lifecycle notifications. Notifications are ignored while User sync is off. When a user is deleted in Entra, or their account is disabled (accountEnabled = false), Wave Connect deactivates them: login is blocked, they appear with a SUSPENDED badge in Users, and their card, profile and contacts are kept. They still count as a seat. Re-enabling the account in Entra does not reactivate them in Wave Connect. Contact support@wavecnct.com to reactivate a user, or delete them from Users.

Limitations

The whole tenant is synced. Guests are included. There is no assignment scoping.
Entra groups and departments are not synced. Teams must be managed in Wave Connect.
No photo for users created by User sync.
The connection depends on one admin account and is removed when that account’s token is revoked.
Users are never deleted by the integration, only deactivated.

Disconnecting

Go to Integrations → Microsoft Entra ID → Settings and click Disconnect. This deletes the stored connection in Wave Connect. Nothing is revoked at Microsoft, and the Graph subscription simply expires within three days. Existing Wave Connect users are kept and are no longer updated. To remove Wave Connect’s access on the Microsoft side, revoke the enterprise application’s consent in the Entra admin center.

Using both

SCIM and the Graph integration can be active at the same time. In that case, users provisioned through SCIM get their profile photo from the Graph connection, matched by email. Keep User sync off on the Graph integration when you use SCIM. With it on, the Graph integration creates every user in the tenant, which bypasses the assignment scoping you set up in the enterprise application.

Troubleshooting

Test connection fails in Entra

Check that Tenant URL is exactly https://app.wavecnct.com/api/scim with no trailing slash, and that Secret Token is the full token from the Configure SCIM modal. A token can only be copied when it is created, so create a new one if you lost it. Tokens are deleted when the organization leaves the Enterprise plan.

A user is assigned but not in Wave Connect yet

Entra provisions in cycles of about 40 minutes. Use Provision on demand on the user to push them immediately, and check the Provisioning logs for the result. A failed request usually means a required attribute is missing: name.givenName, name.familyName, or a primary email on an update.

A user was re-enabled in Entra but is still deactivated

With SCIM, the user must be assigned to the application. If they were unassigned, assign them again and Entra sends active = true. With the Graph integration, re-enabling never reactivates the user. Contact support@wavecnct.com to reactivate them.

The user already had a personal Wave Connect account

When SCIM creates a user whose email already belongs to a personal (non-organization) Wave Connect account, and the email domain is one of your verified domains, that account is moved into your organization and updated instead of creating a new one. Their existing card and contacts are kept. Verify the domain before provisioning so these accounts are migrated rather than duplicated.