Connecting Pacer to Your Microsoft Entra ID Directory (UAT)

Pacer Implementation Guide | UAT Environment

Automated user provisioning (SCIM) setup for Azure and Microsoft 365 administrators

This guide is for the person with admin access to your organization's Azure Portal (also called Microsoft Entra ID or Azure Active Directory). Follow the steps in order.

What this does. Once connected, your Azure directory automatically creates, updates, and deactivates Pacer user accounts whenever you add, change, or remove someone in your own directory. You manage users in one place, not two.

Before You Start

Prerequisites

• Single sign-on (SSO) to Pacer is already configured in your Microsoft Entra tenant. This guide adds automated provisioning to that existing setup.
• The person completing these steps has the Application Administrator, Cloud Application Administrator, or Global Administrator role in Entra.

Planning Decisions

Agree on the following with your internal Pacer owner before configuring anything. Each answer determines how a field is mapped in Step 5.

Agree on how users will be managed going forward. This is an internal process decision rather than a technical one. Once provisioning is on, Entra becomes the source of truth for Pacer users. If anyone on your team has been creating or inviting users directly in Pacer, that practice should stop, and new users should be added through your directory instead.

Topic	Question to answer	How it affects mapping
All locations	Do some users need access to every location rather than specific ones (for example, based on job title)?	grantAccessToAllLocations. Map only if you need an if/then rule that grants all locations to certain users, using an Expression mapping.
Specific location	Is there a field in Entra that identifies which location each user should access? If not, users can still be created by provisioning, and location access is assigned directly in Pacer. If so, confirm the values match the location names in Pacer exactly.	locationAccess. Map only if a matching directory field exists.
Role	Pacer has four roles: General User, Moderator, Administrator, and Owner. We recommend creating everyone as a General User and having your Pacer administrator upgrade access in Pacer. Do you have an Entra field that identifies each user's Pacer role?	userRole. Recommended: leave unmapped, or set a Constant of User.
Community access	In Pacer, users are granted access to one or more Communities. Recommended and most common: give every user created through provisioning the same Community or Communities. Get the list of exact names from Pacer > Settings > Communities.	communityAccess (required). Same for everyone (recommended): use a Constant value. Varies by user: map from a directory field.
Management company	Does everyone work for the same company, or do you need to identify each person's company? Identifying each company is most common for franchisors granting access to franchisees. If it varies, add each company to Pacer > Settings > Management Companies first.	managementCompany (required). Same for everyone: use a Constant value. Varies by user: map from a directory field.

Review existing Pacer users before the first sync. Because SSO is already in place, Entra will match people who already have Pacer accounts using their username. Before turning provisioning on, confirm that every existing user in Pacer has their company ID as their Pacer username (the same sign-in name they use for SSO, typically their work email). Update any that do not match so Entra links to the existing account rather than creating a duplicate.

Connection Values

You will need four values. The Tenant URL and Token Endpoint are the same for every Pacer customer. Your Client ID is unique to your organization and will be provided by the Pacer Dev Team. The Client Secret will be sent separately.

Value	What it is	Value to use
Tenant URL	Where Azure sends provisioning requests	https://scim-b2hahkh8dseyfxbr.centralus-01.azurewebsites.net/scim/v2
Client ID	Identifies your organization to Pacer	Provided by the Pacer Dev Team. Unique to your organization.
Client Secret	The password for the Client ID above	Sent separately by the Pacer Dev Team. Treat it like a password and do not share it outside your organization.
Token Endpoint (Token URL)	Where Azure exchanges the Client ID and Secret for an access token	https://pacer-v6-identity-test.azurewebsites.net/connect/token

Step 1: Sign In to Microsoft Entra

Go to the Microsoft Entra admin center at https://entra.microsoft.com and sign in with your admin account. The Azure Portal (https://portal.azure.com) offers the same screens if you prefer it.

Step 2: Open Your Existing Pacer Application

Because SSO is already in place, your organization already has a Pacer Enterprise Application. Provisioning is added to that same application, so one user assignment controls both sign-in and account creation.

1. Go to Enterprise Applications.
2. Search for and open the application your organization uses for Pacer SSO. If you are unsure which one it is, check with whoever configured SSO.

If you cannot find an existing application, or the Provisioning page in Step 3 does not offer Automatic mode, contact the Pacer Dev Team before continuing.

Step 3: Open the Provisioning Section

1. In the left-hand menu, click Provisioning.
2. Click Connect your application.
3. Under Provisioning Mode, change Manual to Automatic.

Step 4: Connect Pacer via OAuth

1. Expand the Admin Credentials section.
2. Set the Authentication Method dropdown to OAuth2 Client Credentials Grant. Do not use "Secret Token" or "Workload Identity Federation."
3. Fill in the four fields that appear:

Field label	What to enter
Tenant URL	https://scim-b2hahkh8dseyfxbr.centralus-01.azurewebsites.net/scim/v2
Client Identifier (or Client ID)	The Client ID the Pacer Dev Team provided for your organization
Client Secret (or Secret)	The secret the Pacer Dev Team sent you separately
Token Endpoint (or Token URL)	https://pacer-v6-identity-test.azurewebsites.net/connect/token

1. Click Test Connection.
   • ✓ Green success message: proceed to the next step.
   • ✗ Error: confirm all four values were copied exactly, with no extra spaces, and try again.
2. Click Save at the top of the screen.

Step 5: Create and Map Pacer Attributes

Before mapping your directory users to Pacer, create Pacer's custom attributes in Azure. These fields (Management Company, Community, Role, and others) do not appear by default.

5a. Create the Custom Attributes

1. In the left-hand menu under Provisioning, click Mappings.
2. Click Provision Microsoft Entra ID Users.
3. Scroll to the bottom of the page and check Show advanced options.
4. Click Edit attribute list for customappsso. This may display your app's name instead, for example Edit attribute list for Pacer.
5. Scroll to the bottom of the attribute list to add new rows. Add only the fields you need (see the last column below). The Name and Type values are fixed by Pacer and must be typed exactly as shown. Leave Multi-Value unchecked for all of them.

Name to enter in Entra (fixed)	Type	Do you need this field?
urn:ietf:params:scim:schemas:extension:pacer:2.0:User:managementCompany	String	Required. If unmapped or blank, every new user creation will fail.
urn:ietf:params:scim:schemas:extension:pacer:2.0:User:communityAccess	String	Required. If unmapped or blank, every new user creation will fail.
urn:ietf:params:scim:schemas:extension:pacer:2.0:User:locationAccess	String	Map if a directory field identifies each user's location. If unmapped, the user is created with no location access, which you then assign directly in Pacer.
urn:ietf:params:scim:schemas:extension:pacer:2.0:User:grantAccessToAllLocations	Integer	Only if some employees need access to every location. Defaults to 0 (specific locations only, per locationAccess).
urn:ietf:params:scim:schemas:extension:pacer:2.0:User:defaultLocationName	String	Optional. Defaults to the employee's first assigned location.
urn:ietf:params:scim:schemas:extension:pacer:2.0:User:userRole	String	Optional. Must be Owner, Moderator, Administrator, or User (not case sensitive). Any other value, or blank, defaults to User.

The String / Integer dropdown sets only the data Type, not the mapping method. Whether a value is the same for every employee (Constant) or different per employee (Direct or Expression) is decided in Step 5c.

1. Click Save at the top and return to the main mapping table.

5b. Determine Where Each Value Comes From

Read this before mapping. Adding a field in Step 5a only tells Azure the field exists. It does not assign a value to any employee. This part is specific to your organization.

For each field, identify which scenario applies:

1. Same value for every employee (for example, one Community or one Management Company company-wide). Set Mapping Type to Constant in Step 5c and enter the value directly. No custom directory field is needed.
2. Already exists in your directory (an on-premises AD field, department, extensionAttribute1 through 15, an HR system sync, etc.). Map directly from that field in Step 5c. Your IT team can confirm where this data lives.
3. Differs per employee and does not exist yet. A new custom field starts blank for everyone, and the Azure Portal has no screen to enter a value per user. Someone with Microsoft Graph or PowerShell access must populate it for each employee first, for example:
   Update-MgUser -AdditionalProperties @{ "extension_<appid>_PacerCommunityAccess" = "Operations" }
   Skipping this means Azure silently sends blank values. That causes user creation to fail for the required fields (communityAccess, managementCompany) and falls back to Pacer defaults for the rest.

If you are unsure which applies, contact the Pacer Dev Team before mapping.

5c. Map the Fields

Map your directory data to the target attributes above. The Pacer Dev Team will confirm your specific mapping, but the following rules are required:

• Active status: use this exact expression. Mapping Type Expression, value:
  Switch([IsSoftDeleted], , "False", "True", "True", "False")
  New employees are active by default either way. This mapping's purpose is removal: it is the only way Entra tells Pacer that a person was unassigned and their access should be turned off. Do not map accountEnabled directly. It reflects whether the entire Azure account is disabled, not Pacer access, so it usually stays true and the employee would keep Pacer access indefinitely.
• Remove unused phone numbers. Delete the Phone number (work) and Fax number mappings.
• Use Pacer's custom fields, not generic ones. Map to the urn:ietf...pacer:2.0... fields from 5a, not enterprise:2.0:User:department, which Pacer does not read.
• communityAccess and managementCompany are required. Blank or unmapped values cause every new user creation to fail (see 5b). Check Required on both mapping rows so Azure catches missing values before sending them.

See the Appendix for the standard (non-custom) field mappings.

Step 6: Choose Who Gets Provisioned

1. Click Users and groups in the left-hand menu.
2. Click + Add user/group.
3. Review who is already assigned. Because this application is already used for SSO, the users and groups listed here will be provisioned once provisioning is turned on.
4. Add or remove users and groups so the list reflects exactly who should have Pacer access.

Recommended: test before turning provisioning on. Under Provisioning, use Provision on demand to provision one or two test users. Confirm they appear correctly in Pacer with the right Community, Management Company, and location access before completing Step 7.

Step 7: Turn It On

1. Return to Provisioning in the left-hand menu.
2. At the top, switch Provisioning Status from Off to On.
3. Click Save.

Azure will now automatically sync the selected users to Pacer. The first sync can take anywhere from a few minutes to a few hours depending on the number of users.

Confirming It Works

• Go to Provisioning then Provisioning logs to see a history of what was created or updated and whether anything failed.
• When someone is removed from the Users and groups list (Step 6), their Pacer access is automatically turned off. Their data is not deleted, only deactivated.
• If they are later re-added, Pacer automatically restores their access. No manual steps are needed on either side.
• This affects only their access under your company's Pacer subscription. If the same person also has Pacer access through another company (for example, a consultant working with multiple clients), that access is untouched.

If Something Goes Wrong

Contact the Pacer Dev Team rather than troubleshooting alone, and include:

1. A screenshot of the error from the Provisioning logs page.
2. The name and email of the affected test user.

Contact: Pacer Dev Team. Reply to the email that delivered these instructions.

Appendix: Reference and Troubleshooting

Standard Field Mapping Reference

The Target attribute is what Pacer requires and is the same for every customer. The Default Entra source is Azure's out-of-the-box example. If your organization stores this data elsewhere (HR system, on-premises AD sync, custom extension attribute), map from that field instead. Only the target attribute must match exactly.

Pacer field	Target attribute (fixed)	Default Entra source	What it becomes in Pacer
First Name	name.givenName	givenName	Employee's first name
Last Name	name.familyName	surname	Employee's last name
Email	emails[type eq "work"].value	mail	Employee's email and login contact
Username (SSO)	userName	userPrincipalName	Pacer login name
Job Title	title	jobTitle	Employee's job title
Mobile Phone	phoneNumbers[type eq "mobile"].value	mobile	Employee's mobile phone number
Country	addresses[type eq "work"].country	country	Employee's country
Employee ID	externalId	None by default	Any unique identifier your directory already has (e.g. employeeId, employeeNumber, an on-premises sync attribute). Stored for reference and SSO matching.
Active status	active	None by default; set manually	Required expression: Switch([IsSoftDeleted], , "False", "True", "True", "False"). Do not map accountEnabled directly. Only this expression correctly removes access when someone is unassigned in Step 6.

Reusing an Existing Custom Field in a Different App

If your organization already created custom employee fields in Azure during an earlier setup (they appear with a long internal name such as extension_<appid>_PacerCommunityAccess), they will not automatically appear as a Source attribute in a different Enterprise Application. Azure ties each custom field to the app it was created under.

To reuse one:

1. Open the Enterprise Application where the field is missing.
2. Go to Provisioning, Mappings, Provision Azure Active Directory Users, Show advanced options, then Edit attribute list for [app name].
3. Click Add Attribute.
4. In Name, enter the field's exact internal name (the full extension_xxxxxxxx..._FieldName value) as it appears in the app where it already works. Do not rename it.
5. Set Type to match the original, usually String.
6. Save. The field now appears in both the Source attribute and Target attribute dropdowns for this app.

Test Connection Troubleshooting

Error	Likely cause and fix
401 / Unauthorized	The Client ID or Client Secret does not match what Pacer expects. Re-paste both with no leading or trailing spaces.
404 / Not Found	The Tenant URL is missing /scim/v2 at the end or contains a typo. It must be exactly https://scim-b2hahkh8dseyfxbr.centralus-01.azurewebsites.net/scim/v2
"Unable to obtain access token" or other token errors	The Token Endpoint is incorrect or unreachable. It must be exactly https://pacer-v6-identity-test.azurewebsites.net/connect/token