Auth: Entra ID SSO/SCIM provisioning with group-to-role mapping

We would like to manage Salesbuildr user access directly through Microsoft Entra ID rather than maintaining users manually.

Specifically:

Entra group membership should be able to determine both platform access and the assigned Salesbuildr role (for example account manager, sales manager, billing, administrator).

When a user is removed from the relevant Entra group, their Salesbuildr access should be automatically revoked, independent of whether their Autotask or Microsoft 365 account stays active.

Impact:

Without this, access management has to be done manually in Salesbuildr on top of Entra/Autotask/M365, which duplicates work and creates a gap in the joiner/mover/leaver process. It also means Autotask licenses may need to be kept active longer than necessary just to keep a Salesbuildr user provisioned.

This would help reduce unnecessary PSA licensing costs and tighten access security for MSPs managing identity centrally through Entra ID.

A note on this: I don't have Jira access loaded in this session to check for an existing ticket on SSO/SCIM/Entra ID, so worth a quick search before filing in case something similar already exists.