--- title: "F.3 - How to configure person provisioning" url: "https://help.timly.com/de/article/f3-how-to-configure-person-provisioning" language: "de" last_updated: "2026-05-18T11:03:00.079Z" --- # F.3 - How to configure person provisioning **In this step you will create a 2nd enterprise application in Microsoft EntraID:** - 1st Enterprise Application: [**SSO**](https://help.timly.com/de/article/f1-how-to-configure-sso) and [**User provisioning**](https://help.timly.com/de/article/f2-how-to-configure-user-provisioning) - 2nd Enterprise Application: Person provisioning (this documentation)   **If you want only person provisioning, you still need two applications:** 👉🏼 The first for SSO. 👉🏼 The second for person provisioning. **💡 The following fields are connected:** - First name (EntraID: given\_name) - Last name (EntraID: family\_name) - Email (EntraID: email) - PersonGroup (EntraID: department → only if special mapping is applied, see step 4) - Status (EntraID: - Function (EntraID: title) - Personal No. (EntraID: employee\_id) - Start Date (EntraID: timly\_start\_date --> only if special mapping is applied, see step 4) - End Date (EntraID: timly\_last\_date --> only if special mapping is applied, see step 4) - Manager (EntraID: timly\_manager →  only if special mapping is applied, see step 4) - personnel\_number (EntraID: timly\_pers\_no →  only if special mapping is applied, see step 4) - Dynamic attributes (should start with timly\_\*) ### **🛜 Timly-App** ![](https://cdn-assets.productfruits.com/f4252244-f08e-4a8c-92dd-f90b1a971bc9) - Log in to Timly - Click on **"Settings,"** then **"Global configuration,"** and finally **"SSO configuration"** - To set up user provisioning, click on **"Edit"** below **"Person provisioning"**   #### **Step 1** ![](https://cdn-assets.productfruits.com/4fa44ae1-7a4d-49b2-986b-32ec9fc35be6)   - Activate the person provisioning. ### **🛜 Microsoft Entra ID**   #### **Step 2** ![](https://cdn-assets.productfruits.com/910d1454-0b4c-49bd-b4e9-bef46d09b355)   - Navigate to the **"Enterprise applications"** section (🇩🇪: "Unternehmensanwedung"; 🇫🇷: "Application d’entreprise").  #### **Step 3** ![](https://cdn-assets.productfruits.com/ab3b185d-eece-4d9a-85de-9f39808a6d33)  ![](https://cdn-assets.productfruits.com/8a34e009-94d6-40a3-9a47-fb2d2a291022) **Create a new Enterprise Application (Ent.App).** - Click on **“New Application”**. 💡 *You shouldn’t use the same Enterprise Application record as where you configured SSO* - Click on **“Create your own application”**. - Type in the name of the application.  💡 *Recommended:* **“Timly Person Provisioning".** *Any other name works too. It’s just for you as a MS EntraID User to distinguish the app from other applications.* - Radio button: Select the 3rd option. - Click on **"Create"**. In this step you will create a 2nd enterprise application in Microsoft EntraID: - 1st Enterprise Application: SSO and User provisioning  - 2nd Enterprise Application: Person provisioning  **→ Do not create a second SSO Entry in EntraID.** #### **Step 4** ![](https://cdn-assets.productfruits.com/2bf6ed10-8539-4407-8399-ec24bd2b637c) **Navigate to Provisioning.** - Click either button. #### **Step 5** ![](https://cdn-assets.productfruits.com/4c7ef64e-35cb-4039-84f7-7e4b3d7c0381)  **Configure Provisioning.** 1. Set Provisioning method from manual to automatic. 2. Add credentials from the Timly application into the according fields. 3. Test the connection if all of it works *💡 If it fails: Make sure you have activated Person Provisioning in Timly.* ![](https://cdn-assets.productfruits.com/8f38c2c8-f742-4d0a-9740-f0e46ee375a6)   4. Mappings → See STEPS 5 & 6 5. Add an admin email: You will emails upon provisioning errors. That way you will be sure that all works. 6. Activate provisioning. 7. **IMPORTANT!!** Do not forget to save. #### **Step 6** ![](https://cdn-assets.productfruits.com/f62f7823-7934-41c0-864c-e2419b6b6759) ![](https://cdn-assets.productfruits.com/7e08306e-d6f0-41d9-8720-ee07e873e601) ![](https://cdn-assets.productfruits.com/d905daff-ae2e-4084-9ea0-d9afa4c0460f) ![](https://cdn-assets.productfruits.com/14ccff5d-0ba7-4dfa-b965-e2c7e1a95762) **Set proper field mapping for AD User Provisioning.** *(see previous step point no. 5):* - Click on **"Provision Microsoft Entra ID Groups Groups"**. - Change the mapping precedence from "displayName" to "externalID".   #### **Step 7** ![](https://cdn-assets.productfruits.com/5fe2327e-ea07-459f-a9aa-8a268859465f) ![](https://cdn-assets.productfruits.com/23d47e56-d365-4197-b656-61283b8f9266)   👆🏼 Initial setup   **Set proper field mapping for EntraID User Provisioning.** *(see previous step No. 6):* - Click on **"Provision Microsoft Entra ID Users"**. - Change **"MailNickname"** to **"objectId"**. - Change department record **"TargetAttribute"** to **"userType"**. - Add **"timly\_start\_date"**, **"timly\_last\_date"**, **"timly\_manager"**, **"timly\_pers\_no"** to be included in the synchronization process (optional) - Add any other attribute **"start with timly\_\*"**  in the mapping list from **"Edit attribute list for customappsso"** and then map it with with the attributes using **"add new mapping"**. ![](https://cdn-assets.productfruits.com/c9c268c9-06f4-4a24-b7cd-3703c4bed678) 👆🏼 Mapping change: from **"mailNickname"** to **"objectId"** ![](https://cdn-assets.productfruits.com/c64d445f-5002-498d-87a1-f9ea6d7a7722) 👆🏼 Mapping change: Set "**Target attribute"** to **"userType"** #### **Optional** **Configure additional fields for synchronizing between EntraID and Timly Person Profiles.** Follow this step if you want to also configure the **"employeeHireDate"** (**"EntraID Field"**), **"employeeLeaveDateTime"** (**"EntraID Field"**) or the **"Manager"** (**"EntraID Field"**) or any other field from EntraID to Timly. 1. Click on **“Show advances options”** 2. Click on **“Edit attribute list for customappsso”** 3. Typically the following attributes are added a. **"timly\_start\_date"** b. **"timly\_last\_date"** c. **"timly\_manager"** (must be set as **"String"** and not **"Reference"**) 4. You can add additional attributes using the same style: **timly\_#attribute\_name\_as\_called\_in\_timly** 5. Add the mapping ![](https://cdn-assets.productfruits.com/102a103e-53e2-4493-a0cb-813bec236a9e) 👆 Create the new attributes ![](https://cdn-assets.productfruits.com/2313d239-804d-4183-ba54-6042c0d72a0a) 👆 **"start\_date"**, **"last\_date"** and **"manager"** need to be of data type **"String".** E.g. if "manager" is set to reference, the wrong values will be submitted.  Add the new attributes to the attributes list, that are synchronized. ![](https://cdn-assets.productfruits.com/b5454b61-e0cb-4622-a351-8b74afa3f355) ![](https://cdn-assets.productfruits.com/0b0ad23f-c993-4326-8d08-2ef5171cae37)   #### **Step 8** ![](https://cdn-assets.productfruits.com/575699a8-80c0-497a-83d3-abe0579a1c3b) **IMPORTANT!** You can only provision users, which you have selected under “Users and groups”. ![](https://cdn-assets.productfruits.com/644f2382-2496-4a1c-ab4d-36637cc6c512) **Start Provisioning.** - Click on **"Start Provisioning"**. - Click on **"Provision on demand"** to provision some users *(optional - just to test if it works)*. ### **🛜 Timly-App** ![](https://cdn-assets.productfruits.com/e1cb1b3e-b387-48e4-8a6b-75b9a6b036b1) **Set the proper Person mapping to Timly Locations.** In Timly, all Persons have to be mapped to an organizational unit / location, which is not necessarily given directly from the AD. To ensure a proper mapping, in your AD you can set individual groups for each organization unit. Set the mappings: 1. Set the appropriate mappings from your EntraID AD Groups to your locations. 2. If a user  in the AD is assigned directly (and not within a group), or you haven’t set a mapping for a specific group, then the mapping for **“Default Org.unit”** is applied. 3. Should already some users have been provisioned and incorrect mapping settings were saved, you can trigger a remapping for changed mapping settings. **IMPORTANT!** Unfortunately, Microsoft doesn’t give you the option of manually provisioning AD Groups. Therefore, you have to wait up to 45 minutes until they have synchronized. ### **📚 Weitere Ressourcen** - Helpcenter: [**F.1 - How to configure SSO**](https://help.timly.com/en/article/f1-how-to-configure-sso) - Helpcenter: [**F.2 - How to configure user provisioning**](https://help.timly.com/en/article/f2-how-to-configure-user-provisioning) - Helpcenter: [**F.4 - How to update the provision token**](https://help.timly.com/de/article/f4-update-your-provision-token) - Help Center: F.5 - [**How to renew the SSO certificate**](https://help.timly.com/en/article/f5-how-to-renew-the-sso-certificate) **📩** Interessiert daran, mehr über unsere **SSO-Funktion** zu erfahren? Vereinbaren Sie eine kostenlose und [**unverbindliche Demo**](https://timly.com/kostenfreie-online-vorstellung/) mit einem unserer Experten. Bei Fragen können Sie sich gerne an [**kontakt@timly.com**](mailto:kontakt@timly.com) wenden.