What happens when there is a lapse in connection to a SCIM server?

Question

When integrating Azure AD with a SCIM application, what happens if there is a lapse in connection?
E.g. the auth token in use is invalid and then regenerated or the syncing process is "disabled" for a time.

Does Azure require a new token to reconnect? Will ALL users be checked/synced with the SCIM application, or does it remember where it left off?

Answer 1

Hello @KT

Thank you for reaching out. I would like to confirm that if the token used to create SCIM Connection with Application in Azure AD gets expired or invalid, then Azure AD pushes that specific application's provisioning status to Quarantine state with error message similar to "EncounteredQuarantineException. The code for the error would be SystemForCrossDomainIdentityManagementCredentialValidationFailure."

We expect admin to generate a new token from target app, provide the same to Azure AD, perform test connection and save the configuration. Once the new admin credentials are supplied you would need to restart the provisioning job. The provisioning job would ideally skip the users which are already provisioned in target app and provision any new object.

For more details you can review following document: Application provisioning in quarantine status

I hope this helps.

----------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.