docs: Add Entra ID SCIM provisioning app creation steps and troubleshooting entry

platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md

@@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to
 :::info[**Prerequisites**]{#prerequisites}
 You need the following:
 
-- An active [SSO connection](../../single-sign-on) for your organization with Entra ID as the IdP.
+- An active [SSO connection](../../single-sign-on) for your organization with Entra ID as the IdP. SCIM provisioning requires a separate enterprise application that you create in this guide.
 - Organization owner access to your Platform organization.
 - Administrator access to your Entra ID tenant with permission to manage application provisioning.
 :::
@@ -27,19 +27,33 @@ To get Platform SCIM connection details:
 The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued.
 :::
 
+## Create a provisioning application
+
+:::caution
+Entra ID does not support automatic provisioning on applications created through **App Registrations**. If your [SSO connection](../../single-sign-on) uses an application created that way, you cannot use it for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application continues to handle sign-in unchanged.
+:::
+
+To create the provisioning application:
+
+1. In the Azure portal, open **Entra ID**, then **Enterprise applications**.
+2. Select **New application**, then **Create your own application**.
+3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
+4. Select **Create**.
+
+Use this application only for SCIM provisioning. Do not configure sign-on for it.
+
 ## Enable provisioning in Entra ID
 
 To enable provisioning in Entra ID:
 
-1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**.
-2. Select the application that fronts your Platform SSO connection.
-3. Open **Provisioning** and select **Get started**.
-4. Set **Provisioning Mode** to **Automatic**.
-5. Under **Admin Credentials**, provide:
-   - **Tenant URL**: The Platform SCIM endpoint URL from the previous section.
-   - **Secret Token**: The Platform bearer token from the previous section.
-6. Select **Test Connection**. Entra ID should report success.
-7. Select **Save**.
+1. In **Enterprise applications**, select the provisioning application you created in the previous section.
+2. Open **Provisioning** and select **Get started**.
+3. Set **Provisioning Mode** to **Automatic**.
+4. Under **Admin Credentials**, provide:
+   - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details).
+   - **Secret Token**: The Platform bearer token from the same section.
+5. Select **Test Connection**. Entra ID should report success.
+6. Select **Save**.
 
 ## Scope and start provisioning
 
@@ -48,7 +62,7 @@ To scope and start provisioning:
 1. With **Provisioning** still open, expand **Settings**.
 2. Set **Scope** to **Sync only assigned users and groups**.
 3. Save, then set **Provisioning Status** to **On**.
-4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive.
+4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive.
 
 Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes.
 

platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md

@@ -44,6 +44,10 @@ If Seqera can't link an existing account to the SSO identity, the user should co
 
 ## IdP group provisioning (SCIM)
 
+#### The Get started button under Provisioning is disabled (Entra ID)
+
+The application was created through **App Registrations**, which doesn't support automatic provisioning. Create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../sso/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application).
+
 #### Groups appear in the IdP but not in Seqera
 
 Confirm the bearer token configured in your IdP matches the latest token that Seqera issued. If you generated a new token after configuring the IdP, the previous token is revoked.

platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md

@@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to
 :::info[**Prerequisites**]{#prerequisites}
 You will need the following to get started:
 
-- An Entra ID enterprise application configured as your Platform SSO connection. See [Entra ID authentication](../../oidc).
+- An Entra ID application registration configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). SCIM provisioning requires a separate enterprise application that you create in this guide.
 - Organization owner access to your Platform organization.
 - Administrator access to your Entra ID tenant with permission to manage application provisioning.
 :::
@@ -25,24 +25,36 @@ You will need the following to get started:
 The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued.
 :::
 
+## Create a provisioning application
+
+:::caution
+Entra ID does not support automatic provisioning on applications created through **App Registrations**. You cannot use the SSO application you created in [Entra ID authentication](../../oidc) for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application registration continues to handle sign-in unchanged.
+:::
+
+1. In the Azure portal, open **Entra ID**, then **Enterprise applications**.
+2. Select **New application**, then **Create your own application**.
+3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
+4. Select **Create**.
+
+Use this application only for SCIM provisioning. Do not configure sign-on for it.
+
 ## Enable provisioning in Entra ID
 
-1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**.
-2. Select the application that fronts your Platform SSO connection.
-3. Open **Provisioning** and select **Get started**.
-4. Set **Provisioning Mode** to **Automatic**.
-5. Under **Admin Credentials**, provide:
-   - **Tenant URL**: The Platform SCIM endpoint URL from the previous section.
-   - **Secret Token**: The Platform bearer token from the previous section.
-6. Select **Test Connection**. Entra ID should report success.
-7. Select **Save**.
+1. In **Enterprise applications**, select the provisioning application you created in the previous section.
+2. Open **Provisioning** and select **Get started**.
+3. Set **Provisioning Mode** to **Automatic**.
+4. Under **Admin Credentials**, provide:
+   - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details).
+   - **Secret Token**: The Platform bearer token from the same section.
+5. Select **Test Connection**. Entra ID should report success.
+6. Select **Save**.
 
 ## Scope and start provisioning
 
 1. With **Provisioning** still open, expand **Settings**.
 2. Set **Scope** to **Sync only assigned users and groups**.
 3. Save, then set **Provisioning Status** to **On**.
-4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive.
+4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive.
 
 Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes.
 

platform-enterprise_docs/troubleshooting_and_faqs/authentication.md

@@ -12,6 +12,10 @@ When configuring authentication for Seqera Platform, you might encounter the fol
 
 These issues apply to SCIM group provisioning with [Okta](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-okta) and [Entra ID](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id).
 
+#### The Get started button under Provisioning is disabled in Entra ID
+
+This issue occurs when the application was created through **App Registrations**, which doesn't support automatic provisioning. To resolve, create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application).
+
 #### Groups appear in the identity provider but not in Platform
 
 This issue occurs when the bearer token configured in your identity provider doesn't match the current Platform token. Generating a new token in Platform revokes the previous one. To resolve, confirm the token in your identity provider matches the current Platform token, and replace it if necessary.

platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md

@@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to
 :::info[**Prerequisites**]{#prerequisites}
 You will need the following to get started:
 
-- An Entra ID enterprise application configured as your Platform SSO connection. See [Entra ID authentication](../../oidc).
+- An Entra ID application registration configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). SCIM provisioning requires a separate enterprise application that you create in this guide.
 - Organization owner access to your Platform organization.
 - Administrator access to your Entra ID tenant with permission to manage application provisioning.
 :::
@@ -25,24 +25,36 @@ You will need the following to get started:
 The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued.
 :::
 
+## Create a provisioning application
+
+:::caution
+Entra ID does not support automatic provisioning on applications created through **App Registrations**. You cannot use the SSO application you created in [Entra ID authentication](../../oidc) for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application registration continues to handle sign-in unchanged.
+:::
+
+1. In the Azure portal, open **Entra ID**, then **Enterprise applications**.
+2. Select **New application**, then **Create your own application**.
+3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
+4. Select **Create**.
+
+Use this application only for SCIM provisioning. Do not configure sign-on for it.
+
 ## Enable provisioning in Entra ID
 
-1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**.
-2. Select the application that fronts your Platform SSO connection.
-3. Open **Provisioning** and select **Get started**.
-4. Set **Provisioning Mode** to **Automatic**.
-5. Under **Admin Credentials**, provide:
-   - **Tenant URL**: The Platform SCIM endpoint URL from the previous section.
-   - **Secret Token**: The Platform bearer token from the previous section.
-6. Select **Test Connection**. Entra ID should report success.
-7. Select **Save**.
+1. In **Enterprise applications**, select the provisioning application you created in the previous section.
+2. Open **Provisioning** and select **Get started**.
+3. Set **Provisioning Mode** to **Automatic**.
+4. Under **Admin Credentials**, provide:
+   - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details).
+   - **Secret Token**: The Platform bearer token from the same section.
+5. Select **Test Connection**. Entra ID should report success.
+6. Select **Save**.
 
 ## Scope and start provisioning
 
 1. With **Provisioning** still open, expand **Settings**.
 2. Set **Scope** to **Sync only assigned users and groups**.
 3. Save, then set **Provisioning Status** to **On**.
-4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive.
+4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive.
 
 Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes.
 

platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md

@@ -12,6 +12,10 @@ When configuring authentication for Seqera Platform, you might encounter the fol
 
 These issues apply to SCIM group provisioning with [Okta](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-okta) and [Entra ID](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id).
 
+#### The Get started button under Provisioning is disabled in Entra ID
+
+This issue occurs when the application was created through **App Registrations**, which doesn't support automatic provisioning. To resolve, create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application).
+
 #### Groups appear in the identity provider but not in Platform
 
 This issue occurs when the bearer token configured in your identity provider doesn't match the current Platform token. Generating a new token in Platform revokes the previous one. To resolve, confirm the token in your identity provider matches the current Platform token, and replace it if necessary.