Provisioning

After federation is configured, you need to provision users in BlokSec so they can authenticate. Provisioning creates a BlokSec account for each user and sends them an invitation to set up the BlokSec authenticator app on their phone.

How provisioning works

Each user needs two things:

A BlokSec account linked to their Microsoft 365 email address
The BlokSec app installed on their phone with their account activated

When a user signs in to Microsoft 365, BlokSec looks up their account by email address. If the account exists and is active, BlokSec sends a push notification (or displays a QR code) for the user to approve. If the account doesn’t exist, the user sees an error.

Invite users

In the BlokSec admin console, navigate to your Microsoft 365 application
Go to the Users tab
Click Invite User
Enter the user’s email address (must match their Microsoft 365 email)
Click Send Invitation

Invite user form with an email address field and Send Invitation button — Invite a user by entering their Microsoft 365 email

The user will receive an invitation email with a QR code and a link. They can either:

Tap the link on their phone to open it in the BlokSec app
Scan the QR code with their phone’s camera if they received the email on another device

Import existing Entra identities

If your users already exist in Microsoft Entra, you don’t have to invite them one at a time. The import reads your directory and creates or links BlokSec accounts in bulk.

Open the application, expand Provisioning, and choose Import Entra Identities. The wizard has three steps.

Import Entra Identities wizard on step 1, listing directory users with checkboxes and an Include disabled accounts toggle — Step 1 — choose which directory users to import

Step 1 — Select users

Search by name, email, or UPN and tick the users you want. Two markers tell you when a row can’t be selected:

Imported — this user already has a BlokSec account on this application. Nothing to do.
UPN in use — a different BlokSec account already holds this sign-in address. Resolve that account first, then import again.

Disabled accounts are hidden by default. The list asks Entra for enabled accounts only. Turn on Include disabled accounts to see the rest — useful when you want to provision someone ahead of their start date, or when an account is temporarily disabled but the person is still staffed. Importing a disabled user creates their BlokSec account normally; it does not enable them in Entra, and they still can’t sign in to Microsoft 365 until you enable them there.

Step 2 — Review matches

BlokSec then looks for accounts it should link to rather than create.

Matching compares both identifiers Entra holds for a person — the mail attribute and the userPrincipalName — against the email addresses of users already in your BlokSec organization. Both are compared case-insensitively, so J.Halpert@example.com and j.halpert@example.com are treated as the same person rather than becoming two accounts.

Checking both matters because the two values often differ. A user’s mail is frequently an alias while their UPN is the address they actually sign in with, and matching on only one of them silently creates duplicates.

Each row lands in one of three states, and you can override any of them:

Result	What BlokSec does	What you can do
One match	Links the existing BlokSec user to the Entra identity	Change it, or search for a different user to link
Several matches	Asks you to pick	Choose the right user, or create a new one instead
No match	Creates a new BlokSec user	Search for an existing user to link instead

You also choose here whether newly created users get an invitation email straight away.

Import wizard review step showing Entra users alongside the BlokSec action for each row, with match and create outcomes — Step 2 — review what will be linked and what will be created

Step 3 — Apply

The import runs in batches of ten with a progress indicator, and each row reports created, matched, or failed with a reason.

Batching is what makes the import safe to interrupt. If something fails partway, every batch that already committed stays committed — you are never left with a half-written account — and the wizard offers to retry the remaining rows without redoing the ones that succeeded.

How the link is remembered

When BlokSec imports a user, it records that person’s Entra object ID on their BlokSec account, and their ImmutableID as well where the directory provides one.

This is worth knowing because it is what makes the import safe to re-run. The link is to the directory identity itself, not to the text of an email address, so renaming a user in Entra or changing their UPN does not break the link or cause them to be imported a second time as a duplicate.

What the import will not do

Import users outside the federated domain. Only users whose sign-in address is on a domain federated with BlokSec can be imported. BlokSec re-checks with Microsoft that the domain is still federated before listing users and again before each batch is written.
Import into a domain that has been un-federated. If Microsoft reports the domain as managed, the import stops rather than writing accounts that could not sign in.

Import troubleshooting

You see	What it means	What to do
UPN in use by …	Another BlokSec user already holds an account with this sign-in address on the application.	Remove or reassign that account in the console, then import again.
outside the federated domain	The directory reports a sign-in address on a domain that is not federated with BlokSec.	Federate that domain, or change the user’s address in Entra.
federation was reverted	Microsoft reports the domain as managed, so BlokSec will not import into it.	Run the Microsoft 365 integration again to re-federate the domain, then retry the import.
A user with this email already exists	Someone added a matching user while you were reviewing.	Go back to the review step so the row is matched instead of created.
The invitation column shows a warning	The account was created but the email could not be sent.	Resend the invitation from the user’s page.

Every import writes an audit entry recording the outcome of each row. See Monitoring for how to review it.

User activation

After receiving the invitation, the user:

Downloads the BlokSec app (if they haven’t already)
Opens the invitation link or scans the QR code
Authenticates with their phone’s biometrics (Face ID, fingerprint, or device PIN)
Their account is now active and ready for passwordless sign-in

You can track which users have activated their accounts in the Users tab. Users who haven’t activated yet will show as “Invited”.

User list showing a mix of active and invited users with their activation status — Track user activation status

Removing a user

To remove a user from BlokSec:

Go to the Users tab
Find the user and click the menu icon
Select Remove User

The user will no longer be able to authenticate with BlokSec. If the domain is still federated, they won’t be able to sign in to Microsoft 365 until they are re-provisioned or federation is removed.