Azure AD Enterprise Applications | Automatic SCIM Provisioning | Rate Limiting

Rajat Jindal 0

We are trying to build an enterprise app which can provision users from Azure AD to our SaaS based app for customers.

Want to understand if there is a way to Rate Limit the calls for automatic user provisioning using SCIM. This is needed as in case our system is not able to handle a large number of requests specially during the first time provisioning, we will reject the request but we don't want the SCIM provisioning to go into quarantine as it needs manual intervention to fix that.

Marilee Turscak-MSFT 37,061 Reputation points Microsoft Employee

2023-01-12T18:53:06.19+00:00

Hi @Rajat Jindal ,

I just wanted to check if you were able to review the follow-up comment by @Anonymous and get the information you needed? If the information helped you, please "Accept the answer". This will help us and improve searchability for others in the community who might be researching similar questions.

Otherwise let us know how we can assist!

1 answer

Danny Zollner 10,496 Reputation points Microsoft Employee

2023-01-11T17:13:54.01+00:00

If the custom non-gallery application's generic SCIM connector is being used, there is no way to rate limit the requests coming from AAD to your app. If you submit a request for a gallery application with a SCIM provisioning integration, a rate limit can be set. Worth noting that the minimum allowed number of requests per second for a gallery app is 25/second, and that there is a substantial backlog of provisioning integration requests and it will likely be at least 3 months before a new request is processed.
Please sign in to rate this answer.
Rajat Jindal 0 Reputation points

2023-01-11T19:24:08.8066667+00:00

Hi Danny,

Thanks for the update.

We are actually building a custom gallery enterprise application that will be published to the Azure AD gallery for our customers to use. Questions:

So once the application is built, we will have to open a ticket to set rate limit for the app? Will this rate limit be across all the customers who install the app on their AD or will it be per installation?

What is the default rate limit for automatic user provisioning, if not set? Does this apply to all request per second (GET/POST/PUT/PATCH etc) or are there separate limits for each type of request?

How do we open a provisioning integration request? Is there a way to fast track it?

Can we also change the default provisioning interval which is 40 mins by default by opening a ticket?

Danny Zollner 10,496 Reputation points Microsoft Employee

2023-01-11T21:51:59.0233333+00:00

It will apply to all instances of the application installed by all customers.

There is not a default rate limit - the service's default behavior is to compose and send requests as fast as possible. In practical terms, the peak is usually somewhere between 150-250 requests per second in instances of high volume/low complexity operations (think: performing a bunch of PATCH updates to a single attribute value). Rate limiting is not differentiated or tracked individually across HTTP methods, from our side it is a single counter.

[https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/v2-howto-app-gallery-listing - prioritization is determined by the amount of customer demand for your application.

No.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure AD Enterprise Applications | Automatic SCIM Provisioning | Rate Limiting

1 answer

Your answer