Once Clio Operate can authenticate users against Microsoft Entra ID, each user still needs a Clio Operate user record. You can create those records manually or provision them automatically from Microsoft Entra via SCIM.

Add users manually for a small number of users or to test your authentication setup. Use SCIM provisioning when you want Microsoft Entra to remain the source of truth, so that joiners, leavers and group changes flow through without manual work.

Before you start

• Authentication is configured so that an identity provider is available for users to attach to. See Using O365 for Authentication.
• Administrator access to Clio Operate, so that you can open the admin console.
• For SCIM provisioning, administrator access to Microsoft Entra so that you can create an enterprise application and configure provisioning.

How Clio Operate secures the connection to Office 365

The Office 365 integrations use the industry standard OAuth 2.0 protocol, so Clio Operate never stores your Office 365 credentials. An administrator or end user signs in to Microsoft, and Microsoft issues security tokens to Clio Operate. Think of these tokens as temporary passes that you can revoke at any time.

Clio Operate stores tokens in its database, encrypted with 256-bit AES.

Because each account is linked to an interactive Microsoft sign-in, your existing identity controls still apply. Accounts can have MFA enabled, and Microsoft evaluates the sign-in against your Conditional Access policies in the same way as any other sign-in. No account needs an app password, and no account needs excluding from your security baselines.

SCIM provisioning is the exception. Microsoft Entra calls Clio Operate rather than a user signing in, so no interactive sign-in takes place. Microsoft Entra authenticates with a bearer token that you generate in Clio Operate. Treat that token as a credential, because it grants the ability to create and update user records.

Add a user by hand

1. Open the admin console and navigate to Users > All.
2. From the ribbon, select Add user.
3. Complete the user's details, then select User Account at the bottom of the blade.
4. Set the user to Active, and confirm they are not locked.
5. Set Identity Provider to the provider you configured for Microsoft Entra.
6. Set Identity Claim to the user's UPN in Office 365, which is usually their email address.
7. Complete the rest of the form, select Confirm, then select Save.

Add the user to the teams that grant them access to the Clio Operate features they need. Without a team, a user can sign in but will see very little.

Provision users automatically with SCIM

Clio Operate supports the SCIM API and can accept provisioning requests from Microsoft Entra ID. Setting this up has four stages: register a client application in Clio Operate, enable the SCIM feature, create an enterprise application in Microsoft Entra, and then configure and enable provisioning.

Register a SCIM client application in Clio Operate

1. Open the admin console and navigate to Integrations > Manage Identity Server.
2. Select Add App, then select Add client credentials application.
3. Enter a Client name, for example [Client] SCIM.
4. Enter a Client ID, for example [Client]SCIM.
5. Enter a Client Secret. Select Randomise to generate one.
6. Set the access token lifetime. See Choosing the access token lifetime below before choosing a value.
7. Open the client and select the option to generate a bearer token.

Copy the bearer token. You need it when you configure provisioning in Microsoft Entra, and you cannot see it again afterwards.

Choosing the access token lifetime

Microsoft Entra stores the bearer token and does not renew it. When the token expires, provisioning stops. You have two options:

• Set a lifetime that covers the expected life of the integration.
• Set a shorter lifetime and rotate the token before it expires. To rotate it, generate a new token in Clio Operate and paste it into Microsoft Entra. Provisioning stops until you have done both.

Choose the lifetime that aligns with your credential policy. Clio Operate does not impose one.

Enable the SCIM feature

1. Open the Modeller and navigate to Global features.
2. Find the SCIM feature, enable it, and open its configuration.
3. Add a new provider.
4. Set Identity Provider to the provider that will send users to Clio Operate.

Then complete the user and group settings.

Groups in your identity provider become teams in Clio Operate. You can grant permissions to those teams, so that provisioned users receive a basic set of permissions through group membership. The alternative is to assign user types either during provisioning or manually, which adds users to teams that already have the appropriate permissions.

Create an enterprise application in Microsoft Entra

These steps need Microsoft Entra administrator access.

1. Open the Microsoft Entra admin center and navigate to Enterprise applications.
2. Add a new enterprise application.
3. Select the option to create your own application.
4. Enter a name, for example [Client] - Clio Operate - SCIM [environment], and select the option to integrate any other application you do not find in the gallery.
5. Select Provisioning, then select Automatic.
6. Set Tenant URL to https://[your-Clio-Operate-instance]/api/scim/[identity-provider], replacing both placeholders.
7. Set Secret Token to the bearer token you copied.
8. Test the connection to confirm that Microsoft Entra can reach your Clio Operate instance.

Configure the attribute mapping

Microsoft Entra decides which of its attributes to send in each provisioning request. Clio Operate then maps what it receives onto its own records.

You change the mapping in Microsoft Entra, not in Clio Operate. In the Microsoft Entra admin center, navigate to Entra ID > Enterprise apps, select your application, then select Provisioning. Under Manage, select Attribute Mapping.

For what each mapping type and property does, see Microsoft's Customize user provisioning attribute-mappings for SaaS applications.

Leave the Microsoft Entra default email mapping as it is. Microsoft Entra sends the email address as emails[type eq "work"], Clio Operate maps it correctly.

If someone has changed that mapping to emails[type eq "email"], set it back. With the non-standard mapping in place, Microsoft Entra omits the email address from the request to create a new user, so new users arrive without one.

Map exactly one email address as primary. If a provisioning request includes contact rows with no primary set, Clio Operate automatically promotes one the next time the record is saved. That counts as a change to the record, and on a user attached to many matters, it can trigger a large reindex.

User attributes

Clio Operate maps the SCIM 2.0 user schema onto its own schema as follows.

Group attributes

Choose what to synchronise, and enable provisioning

Decide whether to synchronise only the users and groups assigned to this enterprise application, or everything in your directory.

• Assigned users and groups only. Clio Operate receives only the users and groups you add to the enterprise application. Use this to pilot provisioning, or where only part of your directory should reach Clio Operate.
• All users and groups. Clio Operate receives all users and groups in the directory.

Then enable provisioning.

Test your provisioning configuration

Create a user or a group in your directory, or add one to the enterprise application, then confirm it appears in Clio Operate under Users > All.

Provisioning runs as a background process, so it does not report back immediately. Microsoft Entra provides an option to provision a single user or group on demand, which synchronises that record straight away and is the quickest way to test.

Related articles

• Using O365 for Authentication
• O365 Integration: Overview