User provisioning and sync

How often does the user sync run for new joiners and leavers?

Once provisioning is set up, the user sync updates every 20–40 minutes with Azure.

Can we use both Workday and Azure?

It would be one or the other — Workvivo needs a single source of truth. Please note Workvivo cannot provision using Workday. We recommend using whichever source has the most accurate data. Multiple provisioning options are supported, including file-based provisioning (via SFTP) and provisioning via SCIM API integration to Active Directory.

Can Microsoft Entra ID groups be used to provision and target audiences?

No.

Can Entra ID or OKTA groups be provisioned to Workvivo?

No.

How are users linked if their emails weren’t migrated from Workplace?

Once the migration is complete, Workvivo runs an export of users with a new column called “New Email”. Your team goes through each user and adds their new email address to that row. Workvivo then runs a script to swap the values for each user. Once switched, provisioning can proceed with Azure, matching on the new email address.

How do I stop test users in Entra from provisioning through to Workvivo?

SCIM provisioning is managed via the security groups assigned to the Enterprise application. If test users are included, they will be provisioned as standard. To avoid provisioning these accounts you can either:

• Ensure the users are not in the security group assigned under Users and groups for the Enterprise Application in Entra. Anyone removed from the group is deactivated in Workvivo; or
• Add a scoping filter to the SCIM provisioning so only users matching certain criteria are provisioned. Be aware anyone outside the rule is not provisioned, or is deactivated for not meeting the scope criteria.

Note: To add a scoping filter: in the Provision Azure Active Directory Users mapping screen, scroll to Source Object Scope, click All records, then Add scoping filter, and set the rule based on the attributes you need.