Entra (formerly Azure AD) SCIM Client Considerations

This page outlines details specific to using the SCIM gateway with the Entra (formerly Azure AD) SCIM client.

Configuring Mappings

The Entra SCIM client maps Entra users and groups to a JSON SCIM resource, with a default mapping configuration that can be customised. The format used by the Entra SCIM client to define its mappings is the same used by the UNIFYConnect SCIM gateway. Mapping attributes paths can be copied from the Entra SCIM client mapping configuration to the UNIFYConnect SCIM Gateway configuration, and vice versa.

Write Operations

When the Entra SCIM client performs write operations, it performs several checks before and after the write request to validate the operation is needed, or was successful. Due to the nature of how UNIFYConnect processes these changes, there is a small delay between the write request being accepted and when the resulting changes are reflected in the adapter entities and thus the queryable data view available to a SCIM client. For this reason, it is likely that the confirming checks performed by the Entra SCIM client after a write operation will fail. This is expected behaviour.

The Entra SCIM client is designed to work with services like UNIFYConnect that have this reflection delay. Any write operations that fail the confirmation check will be reattempted after a scheduled delay, where the pre-write check will discover that previous attempt was successful, now reflected, and that both server and client data are in sync.

When manually running provisioning in the Entra SCIM client, the execution of the reattempt will also need to be performed manually.