Overview
Microsoft Entra ID (Azure AD) SCIM for Freshdesk keeps Freshdesk agent access aligned with your company directory. Assign users to an Entra enterprise application and the app provisions them as Freshdesk agents through a secure SCIM connection.
The app is designed for IT and helpdesk admins who want a repeatable joiner, mover, and leaver process without manually creating or disabling agents in Freshdesk.
Available on the Freshworks Marketplace. Install from your Freshdesk account, verify your Freshdesk credentials, then copy the generated SCIM Tenant URL and Secret Token into Microsoft Entra.
Screenshot placeholder: Freshworks Marketplace app listing or app overview.
Use cases
New agent onboarding
Assign a user to the Entra enterprise application and they are created as a Freshdesk agent with the configured default role and ticket access.
Directory-led access updates
Update supported user attributes in Entra and let provisioning keep Freshdesk agent details and access settings in sync.
Offboarding and reinstatement
Disable or remove a user from the Entra application to deactivate the Freshdesk agent. Re-enable provisioning for that user to restore the agent when they return.
Consistent agent defaults
Use safe default access settings for all provisioned agents, then optionally map Entra attributes when you want Entra to control Freshdesk roles, groups, ticket scope, or occasional-agent status.
What it provisions
The app provisions Freshdesk agents from assigned Microsoft Entra users.
| Entra action | Freshdesk result |
|---|---|
| Create or assign user | Creates a Freshdesk agent when no matching agent exists. |
| Update user | Updates supported agent fields and access settings. |
| Disable or unassign user | Deactivates the Freshdesk agent. |
| Re-enable user | Reactivates the matching Freshdesk agent when possible. |
Contacts are not provisioned by this app. Every assigned Entra user is treated as a Freshdesk agent.
How it works
Freshworks app
The Freshworks app handles installation, Freshdesk admin verification, default agent access settings, SCIM token display, token rotation, and dashboard controls for the integration.
Middleware service
The middleware provides a tenant-specific SCIM endpoint for Microsoft Entra. It validates the SCIM secret token, separates tenant data, applies retries where supported, and calls Freshdesk APIs to create, update, deactivate, or restore agents.
Microsoft Entra provisioning
Entra sends SCIM events to the Tenant URL. The middleware translates those SCIM requests into the supported Freshdesk agent operations.
Screenshot placeholder: Architecture or data-flow diagram.
Getting started
You will need admin access in both Freshdesk and Microsoft Entra.
Prerequisites
- A Freshdesk account with administrator access
- A Freshdesk API key for an administrator account
- Your Microsoft Entra tenant ID
- Permission to create and configure an Entra enterprise application
Step 1 — Install the app in Freshdesk
Install Microsoft Entra ID (Azure AD) SCIM for Freshdesk from the Freshworks Marketplace. Enter your Freshdesk domain, Freshdesk API key, and Entra tenant ID.
Screenshot placeholder: Freshworks installation page with required fields.
Step 2 — Verify and connect
Click Verify and connect. The app validates your Freshdesk access and prepares a tenant-specific SCIM connection.
Step 3 — Copy Entra provisioning credentials
Copy the generated Tenant URL and Secret Token. You will paste these into the Provisioning section of your Entra enterprise application.
Screenshot placeholder: Tenant URL and Secret Token after verification.
Step 4 — Finish Freshworks installation
Click Install or Save in Freshworks after copying the Entra credentials.
Entra setup
Step 1 — Create an enterprise application
In Microsoft Entra admin center, create or open the enterprise application you want to use for Freshdesk agent provisioning.
Step 2 — Open Provisioning
Go to Provisioning, choose automatic provisioning, and paste the Tenant URL and Secret Token from the Freshworks installation page.
Screenshot placeholder: Entra Provisioning credentials screen.
Step 3 — Test connection
Click Test Connection. If the credentials are valid, Entra confirms the SCIM endpoint is reachable.
Step 4 — Assign users
Assign the users who should become Freshdesk agents. Only assigned users are provisioned.
Step 5 — Start provisioning
Turn provisioning on after you review the attribute mappings. Entra will begin sending provisioning events according to its provisioning cycle.
Field mapping
The standard Entra mappings are enough for most teams. Optional Freshdesk access mappings can be added when you want Entra to control roles, groups, ticket scope, or occasional-agent status.
Default mappings
| Entra attribute | Freshdesk SCIM attribute |
|---|---|
| userPrincipalName | userName |
| emails[type eq "work"].value | |
| displayName | displayName |
| objectId | externalId |
| accountEnabled | active |
Optional access mappings
| Freshdesk SCIM target attribute | Value format |
|---|---|
urn:ietf:params:scim:schemas:extension:freshdesk:2.0:User:roleIds | One or more Freshdesk role IDs, comma-separated. |
urn:ietf:params:scim:schemas:extension:freshdesk:2.0:User:groupIds | Zero or more Freshdesk group IDs, comma-separated. |
urn:ietf:params:scim:schemas:extension:freshdesk:2.0:User:ticketScope | 1 for all tickets, 2 for group tickets, 3 for assigned tickets. |
urn:ietf:params:scim:schemas:extension:freshdesk:2.0:User:occasional | true or false. |
If you do not map access attributes, the app uses the default Freshdesk role and ticket access shown in the app settings page.
Screenshot placeholder: Entra attribute mapping screen.
Managing sync
Dashboard
Freshdesk admins can open the app dashboard to view connection status, copy setup details, review recent activity, refresh metadata, pause or resume provisioning, rotate the SCIM token, and request reconciliation where available.
Screenshot placeholder: Freshdesk app dashboard.
Token rotation
Use Rotate token only when you want to replace the Entra Secret Token. After rotation, copy the new token into Entra before continuing provisioning.
Uninstall
Uninstalling the Freshworks app disconnects the middleware installation when cleanup credentials are available. If cleanup cannot be authenticated during uninstall, contact support and we can help verify the tenant state.
FAQ
Does this app provision contacts?
No. The app provisions Freshdesk agents only.
Do customers need separate Entra apps for contacts and agents?
No. This app only supports agent provisioning, so one Entra enterprise application is enough.
Can Entra control Freshdesk role IDs and group IDs?
Yes. Use the optional SCIM extension attributes listed in the field mapping section. If you leave them unmapped, the app uses the configured Freshdesk defaults.
When is the Secret Token shown?
The Secret Token is shown after Verify and connect. Copy it before leaving the page. Existing tokens remain active unless you explicitly rotate them.
Troubleshooting
Entra Test Connection fails
- Confirm the Tenant URL was copied exactly from the Freshworks app.
- Confirm the Secret Token is the active token shown during setup or rotation.
- Check that the Freshworks app is installed and connected.
Provisioning fails for a user
- Confirm the user is assigned to the Entra enterprise application.
- Confirm required attributes such as username, display name, and work email are present.
- If you mapped role IDs or group IDs, confirm those IDs exist in Freshdesk.
Agent access is not what you expected
Review the default access settings in the app dashboard and any optional Entra access mappings. Mapped values from Entra can override the defaults.
Known limitations
- The app provisions Freshdesk agents only. It does not provision contacts.
- Freshdesk API behavior controls which agent fields can be changed after creation.
- Entra provisioning runs on Microsoft Entra's provisioning schedule.
- Freshdesk role and group IDs are numeric IDs from your Freshdesk account.
- Screenshots in this guide are placeholders until final marketplace images are added.
Support
Need help setting up or troubleshooting the integration? Contact us at hello@relyapps.com.
When contacting support, include your Freshdesk domain, a short description of the issue, and any error message shown in Freshworks or Microsoft Entra. Do not send API keys or SCIM secret tokens.