Not every path described here is enabled for every organization; each linked article states its own requirement.

Before you configure anything, decide where user accounts come from. That one decision determines what your activation process has to cover, how offboarding works, and how much of this you ever touch again by hand.

There are four ways accounts get into Flip. Most organizations end up using more than one.

The four paths

Creating accounts by hand in the Admin Console is a fifth option, and the right one only for exceptions. See Create, edit, lock and delete users.

Prefer SCIM where you can. It is a standard, it carries changes and deactivations without extra work, and it is the path the rest of this documentation assumes.

Running several paths at once

Several sources can feed the same organization, and this is normal rather than a workaround. A typical split is the corporate directory for office employees and the HR system for the frontline.

Which source wins is configurable per attribute, so you do not have to make one system the owner of everything. Decide that per attribute before you connect the second source, not after they start disagreeing.

The one thing to avoid is two sources writing the same attribute with no agreed owner. That produces accounts that flip back and forth on every sync, and it is hard to diagnose from the outside.

Will my HR system work?

The question that matters is not the vendor name, it is the protocol.

• If your HR system speaks SCIM, it connects the same way an identity provider does.
• If it does not, the connection needs something in between. You or an integration partner build that against the Sync API; Flip provides the API and the documentation, not the middleware.

Ask your Customer Success Manager whether your specific system has been connected before. Several of the common HR platforms have, and knowing the pattern someone else used saves you the design work.

What you need on the Entra side

Basic SCIM provisioning does not require a paid Microsoft tier. Microsoft's free tier limits how many applications you can provision to, and Flip counts as one of them, so check what you have left before you plan. Custom attribute mappings are a paid-tier feature.

Those limits are Microsoft's and they change; confirm the current ones in Microsoft's licensing documentation rather than relying on this page.

What to send

The minimum is first name, last name, and username. Everything beyond that you send because you want to do something with it: drive automated group assignment, pass data through to another system, or give people a way to recover their own access.

Group assignment is the most common reason. Rules are attribute-driven and key on the attribute rather than the group name, so renaming a group does not break them, and they hold up at large scale. See Automated User Group Assignments (User Group Rules).

Attributes can also be hidden from employees while still being available to other systems, which is how organizational codes and role flags usually travel. See Create, configure and delete User Attributes (Profile Fields).

Offboarding runs on the same path

Whichever path creates accounts also ends them. Deactivate someone in your source system and the change propagates to Flip on the next sync; there is a retention window before the account is actually deleted, and it is configurable.

Temporary absence is a different case from leaving: an account can be deactivated without being scheduled for deletion.

For the exact states, timings, and what deletion removes, see User Account Lifecycle and User Deletion Concept.

Then decide how people activate

Provisioning creates the account. It does not get the employee signed in. Once you know where accounts come from, choose how the people in them activate: see Activate a user with an invite code or QR code.