The SCIM endpoint must be internet-facing for use with the Entra provisioning service unless you use Entra's on-premises provisioning agent. The agent requires outbound internet connectivity and opens a connection to Entra, eliminating the need for inbound connections to be allowed. The agent also doesn't need to be on the same server as the application, as long as it has internal (intranet) network connectivity to the application.