Adding O365 Users to Clio Operate

September 29th, 2026

Was this article helpful?

After you set up authentication against Microsoft Entra ID, each user still needs a Clio Operate user record. You can create those records manually or provision them automatically from Microsoft Entra through SCIM.

Add users manually for a small number of users or to test your authentication setup. Use SCIM provisioning when you want Microsoft Entra to remain the source of truth. Joiners, leavers and group changes then flow through without manual work.

Before you start

Authentication is configured, so that an identity provider is available for users to attach to. See Using O365 for Authentication.
You have administrator access to Clio Operate, so that you can open the admin console and the Modeller.
For SCIM provisioning, you have administrator access to Microsoft Entra, so that you can create an enterprise application and configure provisioning.

How Clio Operate secures the connection to Office 365

The Office 365 integrations use the industry-standard OAuth 2.0 protocol, so Clio Operate never stores the passwords of your Office 365 accounts. An administrator or end-user signs in to Microsoft, and Microsoft issues security tokens to Clio Operate. Think of these tokens as temporary passes that you can revoke at any time.

Clio Operate stores these tokens in its database, encrypted with 256-bit AES.

Each account is linked to an interactive Microsoft sign-in, so your existing identity controls still apply. Accounts can have MFA enabled, and Microsoft evaluates each sign-in against your Conditional Access policies. No account needs an app password for these integrations, and no account needs excluding from your security baselines.

SCIM provisioning is the exception. Microsoft Entra calls Clio Operate directly, so no interactive sign-in takes place. Instead, Microsoft Entra authenticates with a bearer token that you generate in Clio Operate.

Treat that token as a credential. The token lets the holder create, update, deactivate and delete users. It also lets the holder create, rename and remove teams, and change their members. For this reason, give the SCIM client only the Admin - Users - SCIM Provisioning permission.

Add a user by hand

Open the admin console and navigate to Users > All.
From the ribbon, select New User. The Add User blade displays.
Complete the user's details, then select User Account at the bottom of the blade. The Security & Access panel displays.
Select a User Type. Clio Operate adds the user to the default teams for that user type. If the user type has no default persona, select one in Select Persona. Confirm stays unavailable until the user has a persona.
Under User Credentials, ensure that Active is set to Yes and Locked is set to No.
Set Identity Provider to the provider that you configured for Microsoft Entra.
Set Identity Claim to the value of the claim that the identity provider matches on at sign-in. You set that claim in the provider's Identity claim field, under Advanced settings in Integrations > Manage Identity Server. For more about this setting, see Match Microsoft accounts to Clio Operate users in Using O365 for Authentication.
- If Identity claim is set to upn, or lists upn first, enter the user's UPN. The UPN is usually the user's email address.
- From Clio Operate 7.12, if Identity claim is blank, sign-in tries sub first. The sub claim is an identifier that Microsoft generates, so it does not match a UPN or an email address.
Select Confirm, then select Save.

If the user type does not give the user the access that they need, add the user to further teams. A user with no permissions can sign in but sees little in Clio Operate.

Provision users automatically with SCIM

Clio Operate supports the SCIM API and can accept provisioning requests from Microsoft Entra ID. Setting up provisioning has four stages:

Register a client application in Clio Operate.
Enable the SCIM feature.
Create an enterprise application in Microsoft Entra.
Configure and enable provisioning.

Register a SCIM client application in Clio Operate

Open the admin console and navigate to Integrations > Manage Identity Server.
Select Add App. Under Application to application clients, select Add client credentials application.
Enter a Client name.
Enter a Client Id, for example [Client]SCIM.
Enter a Client Secret of at least 10 characters. To generate one, select the Randomise icon next to the field.
Under Tokens, set Access token lifetime (seconds). The default is 900 seconds (15 minutes). Read Choose the access token lifetime below before you choose a value.
Under Client permissions, search for and add Admin - Users - SCIM Provisioning. You must add this permission. Without it, Clio Operate rejects every provisioning request from Microsoft Entra.
Select Save.
The token does not display on screen, and you cannot retrieve it later. Have a secure place ready to paste it. Under Tokens, select Create a new access token. Clio Operate copies the token to your clipboard and displays "New access token copied to the clipboard".

You need the token when you configure provisioning in Microsoft Entra.

Choose the access token lifetime

The token expires at the end of its lifetime. Microsoft Entra stores the token and does not renew it, so provisioning stops when the token expires.

If you keep the default of 900 seconds, provisioning stops 15 minutes after you set it up. Choose one of these options instead:

Set a lifetime that covers the expected life of the integration. For example, one year is 31,536,000 seconds.
Set a shorter lifetime and rotate the token before it expires. To rotate the token, create a new access token in Clio Operate and paste it into Microsoft Entra. The old token stays valid until it expires, so provisioning continues during the rotation.

Choose the lifetime that aligns with your credential policy. Clio Operate does not impose a maximum.

Enable the SCIM feature

Open the Modeller and navigate to Global features > All global features.
Set Include Advanced to Yes. SCIM is an advanced feature, so the list hides it until you change this setting.
Find SCIM in the Integrations category and select Enabled.
Select the configure (cog) icon for SCIM. The SCIM Configuration panel displays.
Select Add Provider. The Configure SCIM Provider panel displays.
Ensure that Enabled is on. Clio Operate rejects provisioning requests for a provider that is not enabled.
Set Identity Provider to the provider that sends users to Clio Operate.
Complete the settings under SCIM Users Configuration and SCIM groups Configuration. The table below describes each setting.
Select Save & Close.

Setting	Required	What it does
Default User Type	Yes	The user type given to each provisioned user. Most deployments use a single low-privilege type here and grant access through teams instead. To override the user type for an individual user, map a `userType` attribute from Microsoft Entra. The value must be the system name of a user type.
Default Job Role	No	The job role given to each provisioned user. Every user provisioned through this provider gets the same job role, and no SCIM attribute overrides it. Available from Clio Operate 7.12.
Manager connection	Yes	The connection type that links a user to their manager. Clio Operate uses it to reproduce your reporting lines from Microsoft Entra. A connection is created only when the manager is already a user in Clio Operate.
Manager connection direction	Yes	Which side of the manager connection is the user and which side is the manager. Select the option that reads correctly for your connection type.
New Teams Organisation	Yes	The organisation that provisioned teams belong to. Every team must belong to an organisation, and this organisation is usually your own organisation record.
New Teams Ods Type	Yes	The team type given to provisioned teams. Clio Operate uses team types for either access control or task allocation, so choose based on the purpose of these groups.

Choose the manager connection carefully before provisioning starts. If you later change Manager connection or Manager connection direction, Clio Operate deletes connections of the previous type. The deletion covers every such connection that involves a user provisioned through this provider, including connections that someone added by hand. Microsoft Entra recreates the manager connections only as it sends later updates for each user.

Groups in your identity provider become teams in Clio Operate. You can grant permissions to those teams, so that provisioned users receive a basic set of permissions through group membership. Alternatively, assign user types during provisioning or manually. A user type adds users to teams that already have the appropriate permissions.

Create an enterprise application in Microsoft Entra

These steps need Microsoft Entra administrator access.

Open the Microsoft Entra admin center and navigate to Enterprise applications.
Add a new enterprise application.
Select the option to create your own application.
Enter a name, for example [Client] - Clio Operate - SCIM [environment]. Select the option to integrate any other application that you do not find in the gallery.
Select Provisioning, then select Automatic.
Set Tenant URL to https://[your-Clio-Operate-instance]/api/scim/[identity-provider], and replace both placeholders. For [identity-provider], use the system name of the identity provider, not its display name. The SCIM Configuration panel displays the system name as a label next to the provider name. The system name must match exactly.
Set Secret Token to the bearer token that you created in Clio Operate.
Test the connection to confirm that Microsoft Entra can reach your Clio Operate instance.

Configure the attribute mapping

Microsoft Entra decides which of its attributes to send in each provisioning request. Clio Operate then maps what it receives onto its own records.

You change the mapping in Microsoft Entra, not in Clio Operate. In the Microsoft Entra admin center, navigate to Entra ID > Enterprise apps, select your application, then select Provisioning. Under Manage, select Attribute Mapping.

For what each mapping type and property does, see Microsoft's Customize user provisioning attribute-mappings for SaaS applications.

Email addresses

Leave the Microsoft Entra default email mapping as it is. Microsoft Entra sends the email address as emails[type eq "work"]. Clio Operate stores every email address it receives as an email contact detail, whatever its type.

If someone has changed that mapping to emails[type eq "email"], set it back. With the non-standard mapping in place, Microsoft Entra omits the email address from the request to create a new user. New users then arrive without an email address.

Mark exactly one email address as primary.

From Clio Operate 7.11.4, including all 7.12 versions, an update from Microsoft Entra that does not include the primary flag leaves the existing flag unchanged.

In versions before 7.11.4, routine updates from Microsoft Entra could clear the primary flag on an email address or phone number. The next time someone saved that person in Clio Operate, the record restored a primary flag. Clio Operate treated the restored flag as a change to the person. On a user who takes part in many matters, the change could trigger a large reindex and slow down the system.

Upgrading to 7.11.4 or later does not repair records that were already affected. If you provisioned users on an earlier version, and saves become slow after someone edits a provisioned user, contact Clio Operate support.

User attributes

Clio Operate reads the SCIM attributes in the following table. It ignores any other attribute, even if you map it in Microsoft Entra.

SCIM attribute	Where Clio Operate stores it	Notes
`id`	`ods.people.id` The ID of the Clio Operate user record	Clio Operate generates this value when it creates the user. Microsoft Entra uses it in later requests.
`externalId`	`ods.people.externalReference` External reference on the person record	Holds the identifier that Microsoft Entra sends for the user.
`userName`	`ods.users.identityClaim` Identity Claim	Must match the value that the identity provider matches on at sign-in. By default, Microsoft Entra sends the user's UPN, so the identity provider must match on `upn`. See Add a user by hand.
`name.givenName`	`ods.people.firstname` First name	If Microsoft Entra sends a name without a first name, Clio Operate stores `(none)`.
`name.middleName`	`ods.people.middleNameOrInitial` Middle name or initial
`name.familyName`	`ods.people.surname` Surname	If Microsoft Entra sends a name without a surname, Clio Operate stores `(none)`.
`displayName`	`core.formAspectAttributes`, attribute `ScimDisplayname` Stored for SCIM use only	Not displayed on the person record. If a new user arrives without a name, Clio Operate uses the first word as the first name and the last word as the surname.
`title`	`ods.employmentDetails.jobTitle` Job title on the user's employment details	Set only when the user is linked to an organisation through `organization`.
`preferredLanguage`	`core.formAspectAttributes`, attribute `ScimPreferredlanguage` Stored for SCIM use only	Not displayed on the person record.
`active`	`ods.people.isActive` Active flag on the user	If Microsoft Entra removes the value, Clio Operate makes the user inactive. If a new user arrives without this attribute, Clio Operate creates the user as inactive.
`emails`	`ods.contactDetails` Email contact details	Clio Operate stores every email address with the email contact type, whatever its SCIM type. See Email addresses above.
`phoneNumbers`	`ods.contactDetails` Phone contact details	The SCIM type, for example `mobile`, must match the system name of a contact type in Clio Operate.
`addresses`	`ods.locations` and `ods.locationTypes` Locations	The address type becomes the location type. The type must match the system name of a location type in Clio Operate, for example `work`. Otherwise, Clio Operate rejects the request. If the country does not match the name of a country in Clio Operate, Clio Operate leaves the country blank.
`userType`	`ods.users.userType` User type	Must be the system name of a user type. Overrides Default User Type. When the value changes, Clio Operate adds the user to the default teams for the new user type. Clio Operate does not remove the user from the teams of the previous user type.
`employeeNumber`	`ods.people.reference` and `ods.employmentDetails.employeeCode` Reference on the person record, and employee code on the employment details	From the enterprise user schema extension. Updates apply only when the user is already linked to an organisation.
`organization`	`ods.people.organisationId` and `ods.entityConnections` Organisation, with an employment connection	From the enterprise user schema extension. Must match the name of an organisation in Clio Operate exactly. If no organisation matches, Clio Operate rejects the request, so the user is not created or updated.
`department`	`ods.people.department` Department on the person record	From the enterprise user schema extension.
`manager`	`ods.entityConnections` Manager connection	From the enterprise user schema extension. Uses the Manager connection setting. Clio Operate skips the connection if the manager is not already a user in Clio Operate.

Clio Operate does not read name.honorificPrefix, locale, birthdate or roles. Group membership comes from the members of each group, not from a groups attribute on the user.

Group attributes

SCIM attribute	Where Clio Operate stores it	Notes
`id`	`ods.teams.id` The ID of the Clio Operate team	Clio Operate generates this value when it creates the team.
`externalId`	`ods.teams.externalReference` External reference on the team
`displayName`	`ods.teams.name` Team name	Clio Operate also uses this value as the team description when it creates the team.
`members`	`ods.teamMembers` and `ods.teams.parentTeamId` Team members	If a member is itself a group, its team becomes a child team of this team.

Choose what to synchronise, and enable provisioning

Decide whether to synchronise only the users and groups assigned to this enterprise application, or everything in your directory.

Assigned users and groups only. Clio Operate receives only the users and groups that you add to the enterprise application. Use this option to pilot provisioning, or where only part of your directory needs to reach Clio Operate.
All users and groups. Clio Operate receives all users and groups in the directory.

Then enable provisioning.

Test your provisioning configuration

Create a user or a group in your directory, or add one to the enterprise application. Then confirm that it appears in Clio Operate under Users > All.

Provisioning runs as a background process, so it does not report back immediately. Microsoft Entra can provision a single user or group on demand. On-demand provisioning synchronises that record straight away and is the fastest way to test.

What happens when Microsoft Entra removes a user or group

User disabled or out of scope. If you disable or soft-delete a user in Microsoft Entra, or remove them from the enterprise application, Microsoft Entra sets active to false. Clio Operate makes the user inactive, so they can no longer sign in.
User deleted. Microsoft Entra deletes the user 30 days after a soft delete, or straight away if you delete them permanently. Clio Operate marks the user as deleted and inactive. The person record remains in Clio Operate.
Group deleted. If the matching team has no members and no child teams, Clio Operate deactivates the team. Otherwise, Clio Operate rejects the request and the team stays active.

Was this article helpful?

Give feedback about this article