> ## Documentation Index
> Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure an onboarding workflow via Entra ID

> Learn how to configure a workflow that creates a Microsoft Entra ID account for a new employee and assigns the apps you choose.

This page explains how to configure a workflow that creates a Microsoft Entra ID account when an employee joins. The workflow then assigns the apps you choose. Use the template "Onboarding via Entra ID (App Assignment)".

> [!NOTE]
>
> Microsoft Entra ID (Azure AD) is the only identity provider supported at present.

## Configuration flow

After completing the [prerequisites](https://support.i.moneyforward.com/en/it-management/workflows/90k8f1lee0-workflows.md), configure the workflow in three main steps.

1. [**Identity provider integration (Entra ID)**](https://support.i.moneyforward.com/en/integrations/4l37o2sowt-idp-entraid.md): Connect Entra ID and link your apps to services.
2. [**Configure automation mapping**](https://support.i.moneyforward.com/en/it-management/workflows/ms4wo45v27-admina-automation-wic.md): Set up the mapping with Microsoft Entra ID.
3. [**Create and publish the workflow**](#onboarding-steps): Create the workflow from the template. Then set the conditions, services, apps, and notifications.

## How the workflow runs

The template runs the following steps from top to bottom.

| Step | Description |
| - | - |
| Event Trigger | Starts when a new employee joins. |
| Conditions | Narrows down the target employees. |
| Data Mappings | Converts employee information into the fields of the Entra ID account. |
| Entra ID Provision | Creates the account in Entra ID. |
| App Assignment | Assigns the apps you choose to the new account. |
| Notification | Sends a notification by Slack or email. |

Under "Services to create accounts in", App Assignment follows Entra ID. App Assignment runs after the Entra ID account is created.

## Steps to configure onboarding via Entra ID

1. Go to **Automation** > **\[Create workflow]** > **\[Onboarding via Entra ID (App Assignment)]**.

   ![The Onboarding via Entra ID (App Assignment) automation template card](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/template-card.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=cb6e79aaeae4f31a40a593b677912831)

2. On the builder screen, click **"1. Event Trigger"** and set **"Execution Schedule"**. The template runs the workflow 1 day before the contract start date.

   ![Execution Schedule on the 1. Event Trigger screen, set to 1 day before the contract start date](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/event-trigger-schedule.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=b68310d8aa034c2badd45469ce4317d5)

3. Click **"2. Conditions"** and set the conditions for target employees. The template targets full-time employees. The available items are the same as in "2. Conditions" in [Configure an onboarding workflow](https://support.i.moneyforward.com/en/it-management/workflows/ygzni03g1c-admina-automation-wic-ggx.md).

   ![The 2. Conditions screen with the contract start date and employee type set](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/conditions.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=384f245027d69fb04471c762de5b16c7)

4. Click **"3. Data Mappings"** and check that each field of the Entra ID account matches the employee information.

   > [!NOTE]
   >
   > The app is assigned to the account set in the "Primary Email" field of Data Mappings. If this field is empty, the app assignment fails.

   ![The 3. Data Mappings screen with the target and field mappings](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/data-mapping.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=bd6fe8a5430a716269ef82cb927f3df8)

5. Under **"4. Services to create accounts in"**, set up Microsoft Entra ID.

   1. Click the Microsoft Entra ID step to open its **"Settings"** panel on the right. Select the workspace name from the **"Service settings - Workspace name"** dropdown.

      Under **"Account settings"**, check settings such as the email address and name. Change the items you need.

      ![The Settings panel of Microsoft Entra ID (Azure AD) with the workspace and account settings](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/entra-account-settings.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=9c5d78942ab2a9e755af7b4e06346d38)

   2. In the same group, click **"App Assignment"** and set the following items.

      | Item | Description |
      | - | - |
      | **Identity provider workspace** | Select the Entra ID workspace. |
      | **Data Mapping action** | Select the upstream "Data Mappings" step. It is usually selected automatically. |
      | **Managed apps** | Select the apps to assign. You can select 1 to 200 apps. Each app shows **SCIM active**, **SCIM inactive**, or **SCIM unknown**. |
      | **App role** | Select the role to assign when the app has roles. If you select none, **Default access** applies. |

      > [!NOTE]
      >
      > If "No managed apps are available. Add apps to this identity provider before configuring this action." appears, first link your apps to services in [Identity provider integration (Entra ID)](https://support.i.moneyforward.com/en/integrations/4l37o2sowt-idp-entraid.md).

      ![The App Assignment settings panel with the identity provider workspace, the Data Mapping action, and the managed apps](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/app-assignment.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=81d444f1e4fe94d84cfc62d0e6fe45e8)

6. Click **"5. Notification"**, click **\[+ Add Notification]**, and set the notification method: **Slack** or **Email**. The steps are the same as "5. Notification" in [Configure an onboarding workflow](https://support.i.moneyforward.com/en/it-management/workflows/ygzni03g1c-admina-automation-wic-ggx.md).

   ![The + Add Notification button under 5. Notification](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/notification.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=98daa2ada122e22f1a37a57a3d206555)

7. After all settings are complete, all checks in the builder turn green. Click **\[Publish]** or **\[Dry Run]**.

   For details on dry runs, see [Dry-run a workflow](https://support.i.moneyforward.com/en/it-management/workflows/cmeu7hzi90-workflow-cww.md). In a dry run, the App Assignment result reads "Assigned the app to the IdP account".

   ![The Dry Run and Publish buttons and a green check](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/publish-dry-run.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=ba09945796d08f994ba1d9649980508c)

8. The **"Confirm workflow automation settings"** screen appears. Enter the workflow name and click **\[Publish]**.

   Note: You cannot use a name that is already registered.

   ![The workflow name field on the Confirm workflow automation settings screen](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/confirm-workflow-name.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=583d59ff3615a7567de7aae4268a4245)

9. When **"Workflow has been published"** appears, click **\[OK]**.

   ![The Workflow has been published message](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-onboarding-workflow/publish-complete.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=f6c24558cc206363779c8525171f4212)

## Troubleshooting

For the messages shown while you set up this workflow, see [Check Entra ID assignment status and errors](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-assignment-status.md#automation-troubleshooting).

You cannot delete the Entra ID step of the template. To build a workflow without Entra ID, create it from scratch. For details, see [Create a workflow from scratch](https://support.i.moneyforward.com/en/it-management/workflows/tge7rgoibt-workflow.md).

## Check the results

When the workflow runs, it requests the assignment for each selected app.

* If one app fails, the assignments for the other apps continue.
* For the reasons and fixes for a failure, see [Check Entra ID assignment status and errors](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-assignment-status.md#failure-reasons).

You can check the results on the **Runs** and **Logs** tabs. For when the workflow runs, see [Onboarding and offboarding automation flow](https://support.i.moneyforward.com/en/it-management/workflows/n2msl3q9um-admina-automation.md).

## Related pages

* [Assign and unassign apps with Entra ID](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-app-assignment.md)
* [Check Entra ID assignment status and errors](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-assignment-status.md)
* [Configure an offboarding workflow via Entra ID](https://support.i.moneyforward.com/en/it-management/workflows/entraid-offboarding-workflow.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.