Azure AD SCIM provisioning application - quarantine status

Question

Azure AD SCIM provisioning application - quarantine status

Ruchi 406

Hi,

Please provide the response to below queries related to Quarantining a SCIM application.

Azure documentation says application would be quarantined for following conditions - EncounteredQuarantineException, EncounteredEscrowProportionThreshold and QuarantineOnDemand. Will the application be auto resumed when the quarantine situation gets resolved for any of the scenario?
If the SCIM server endpoint throws an exception (for instance, database connectivity issue) for all the sync requests from Azure SCIM connector application for some time period, probably say 4-5 hours, will it quarantine the scim application?
When will "Retry duration" mentioned in the document gets applied? Would it be applicable for question 2 above.
https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-quarantine-status#why-is-my-application-in-quarantine
Are there any specific exceptions from SCIM Server endpoint which could be handled gracefully to apply retry logic without quarantining scim application?
Is it possible to customize the quarantine behaviour while onboarding gallery application for any SAAS application?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Danny Zollner 10,826 Microsoft Employee Moderator

Quarantine is the system's way of identifying "An overwhelmingly high number of the operations being attempted are failing" without wasting resources (compute, network traffic). It will self-recover and leave quarantine on the next cycle where the criteria that caused it to enter the quarantine state are no longer met. If it's a temporary issue like an outage/maintenance then during testing you can manually restart the provisioning job. For customers using this at scale (i.e.: a gallery multi-tenant app), it will self recover on its own and no action can be taken by the SCIM server to expedite that.

Specific answers to your questions:

Yes.
Yes.
Immediately - exact interval isn't documented, but it's an exponential backoff and roughly can be thought of as 30m -> 1h -> 2h -> 4h -> 8h.. ish.. so if there's a temporary outage lasting for an hour or less, everything should in turn recover within 1-2 hours as it'd probably be between the 2nd and 3rd retries.
Per-object failures are held to be retried and generate what can be referred to as retries or "escrows", if you accumulate enough of those then you'll hit quarantine - OR if there's a global failure (server down, failing initial startup test calls..). If there's a global issue then there is no avoiding entering quarantine, nor should there be.
No.

Ruchi 406 Reputation points

2023-06-28T05:26:38.37+00:00
Thanks @Anonymous .
So I understand is,

Retry mechanism is used to quarantine the scim application based on escrow threshold (Failures in processing the scim sync requests).

If there is any global failure (server down, failing initial startup test calls.), scim application would be immediately quarantined.

In any of the above scenarios, application will auto recover when the problem is resolved.

Would the similar kind of retry logic would be applicable here to check if the the problem is resolved.

Note: When we tested with the sample non-gallery application, we did not observe the auto recover once the application was quarantined. Basically when the SCIM server endpoint was not available, scim application was quarantined. But when the endpoint was up and running, scim application was not auto recovered. I assume, in case of application created via gallery app, it would auto quarantine.
Danny Zollner 10,826 Reputation points Microsoft Employee Moderator

2023-06-28T14:21:48.0533333+00:00

Auto recover does not mean instantly - the exponential backoff is still at play, and it will not retry (and subsequently discover that the quarantine-inducing issue is no longer happening) until that next cycle starts.

As mentioned above, roughly.. 30m -> 1h -> 2h -> 4h -> 8h.. etc, so if the server is inoperable through the first 4 attempts - starts at 12:00 and fails, retries at 12:30, 13:30, 15:30, 19:30.. then at 19:35 the issue with the server is resolved.. the SCIM client/AAD won't check until 27:30 (rather, 3:30 the next day..), and the job will remain in quarantine until that check OR until the IT admin who manages that provisioning job on the Azure AD side tells the job to restart.

Given you're looking at building a SCIM server attached to a multi-tenant app that will be listed in the AAD Enterprise App Gallery, I'd suggest not worrying about the quarantine mechanic in AAD Provisioning - it's a behavior associated with the AAD SCIM client, not with your SCIM server. Focus on offering a SCIM REST API with as close to 100% uptime as you can and you'll be fine.

Share via

Azure AD SCIM provisioning application - quarantine status

0 additional answers

Your answer