Change of ExternalId attribute in SCIM

Question

Hello,

I'm considering updating the ExternalID attribute to a different attribute in our Azure Entra ID SCIM provisioning setup. How should I update it so that I don't create new user accounts in the application? Is it even possible?

Thanks in advance

Answer 1

Hi Fraczek, Rafal SW/WRO-DCDZA,

Thanks for reaching out.

externalId is expected to be uniqueness constrained by the client but is explicitly defined in the reference section as having a mutability of readWrite.

To update the ExternalID attribute in your Azure Active Directory SCIM provisioning setup, you will need to make sure that the new attribute you choose to use has the same value as the current ExternalID attribute for each user. This is because the ExternalID attribute is used to uniquely identify each user in the application, and changing it will cause the application to see each user as a new user.

As far as how this links to Entra, SCIM/provisioning, and external apps - a user in the Entra side that is provisioned to a SCIM-enabled app will have a 1:1 relationship there. However, Organizations go through mergers/acquisitions, divestitures, and on-premises to cloud migrations. Those can lead to a group being recreated in Entra and having its Entra objectId change, and the objectId maps to SCIM externalId. Even with the object in Entra changing, the relation to external systems may still be intended to be the same.

Reference: https://datatracker.ietf.org/doc/html/rfc7643#section-3.1

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.