Azure AD SCIM User Provisioning: Enable provisioning of specific group syncs with "Sync All Users and Groups" option selected in provisioning job

Question

When the SCIM provisioning job in Azure AD is configured with the option "Sync All Users and Groups", please suggest if there any way with which provisioning job can be restricted to send sync events to specific groups which are required for target system.

Basically the requirement is to provision all users and specific groups sync from azure directory.

Answer 1

It is not possible at this time to configure "All Users" and "Assigned Groups" - both object types have to be set as either All or Assigned jointly.

You can accomplish this goal however by using the Sync Assigned setting, creating a dynamic "all users" group (AAD Premium P1 feature) and giving it a criteria that pulls in all members, such as users where accountEnabled equals True. You can assign that group and then filter the "all users" group object itself out via the Scoping Filters feature - creating a filter akin to "filter groups where displayName eq 'all users'" or "filter groups where objectId eq XYZ" to block the group object itself while still allowing all users inside of it to be in scope.

Answer 2

Hi Ruchi ,

You have the option to select the Scope while configuring Provisioning in the Application , there you can select either all users and groups or assigned users and Groups. Check below Screenshot:

If the above is useful please click Accept Answer.