How do I get SCIM to send requests to the correct IP address for a domain?

Question

How do I get SCIM to send requests to the correct IP address for a domain?

EricRose-3179 5

We changed our DNS records for a domain, and are still seeing SCIM requests from MS IP addresses to the old web server. How do we get someone to investigate and fix this problem?

Marilee Turscak-MSFT 37,371 Reputation points Microsoft Employee Moderator

2023-06-16T16:33:05.6733333+00:00

Hi @EricRose-3179 ,

We noticed your feedback that your experience on this thread was rated low.

However, the survey we are taking is testimony of our team providing timely attention to reported issue and partnering with customer to ensure their voice reaches the engineering team to improve the product.

If you feel our team members or the community have been providing right level of support and your scenario has got timely response, we would like to request you to reconsider the feedback. In case, you felt otherwise based on your support experience, please let me know and I will work with my team to further improve it.

Your encouragement and involvement help us improve our customer experience and our Azure services. Thanks for your continued contribution on Q&A and appreciate much for taking the time to share your feedback. We are eager to know what could have been done better to evolve your experience to a 5* star rating. Your candid feedback is very important to us.

Looking forward to your reply.
EricRose-3179 5 Reputation points

2023-06-19T00:17:42.2666667+00:00

A timely response means nothing if it doesn't contain useful information. I give feedback based on what value I feel I received and I feel it is mendacious of you to try and game the system by asking me to try and make the poll appear favourable to you guys. BTW, using simplistic metrics like time to respond means that threads will fill up with quick responses that are useless but score well on your KRIs. It's as stupid as valuing an software developer on lines of code written and not quality of code

1 answer

Your answer

Marilee Turscak-MSFT 37,371 Reputation points Microsoft Employee Moderator

2023-06-16T16:33:05.6733333+00:00

Hi @EricRose-3179 ,

We noticed your feedback that your experience on this thread was rated low.

However, the survey we are taking is testimony of our team providing timely attention to reported issue and partnering with customer to ensure their voice reaches the engineering team to improve the product.

If you feel our team members or the community have been providing right level of support and your scenario has got timely response, we would like to request you to reconsider the feedback. In case, you felt otherwise based on your support experience, please let me know and I will work with my team to further improve it.

Your encouragement and involvement help us improve our customer experience and our Azure services. Thanks for your continued contribution on Q&A and appreciate much for taking the time to share your feedback. We are eager to know what could have been done better to evolve your experience to a 5* star rating. Your candid feedback is very important to us.

Looking forward to your reply.
EricRose-3179 5 Reputation points

2023-06-19T00:17:42.2666667+00:00

A timely response means nothing if it doesn't contain useful information. I give feedback based on what value I feel I received and I feel it is mendacious of you to try and game the system by asking me to try and make the poll appear favourable to you guys. BTW, using simplistic metrics like time to respond means that threads will fill up with quick responses that are useless but score well on your KRIs. It's as stupid as valuing an software developer on lines of code written and not quality of code

Answer 1

Danny Zollner 10,821 Microsoft Employee Moderator

How long ago did you change this? And what was the TTL on the DNS records (that may not be known if it's already gone from your records...). This is likely an issue of DNS caching and isn't something that someone will fix, but rather you'll need to wait it out.

You can temporarily assign a new record for a subdomain or something like that, which if it didn't exist previously wouldn't be cached and may get discovered immediately?

EricRose-3179 5 Reputation points

2023-06-13T23:43:22.8733333+00:00

The change was made 5 days ago and the changes have successfully propagated. Someone has suggested that perhaps there's a proxy or defender setup that wraps the clients' AAD that might have old cached data or hardcoded static IP addresses. Is this likely?
Danny Zollner 10,821 Reputation points Microsoft Employee Moderator

2023-06-14T04:31:18.0766667+00:00

Do you happen to know what the previous TTL was? I've pinged the relevant software engineering team to check if they know how DNS resolution (and caching) is handled.

The other suggestions don't entirely make sense to me. Most AAD services, AAD Provisioning included, are architected in such a way that they do not have a footprint on any given internal network (i.e.: your client's internal network), and as they are hosted and operated by Microsoft it isn't possible for you or anyone else to put a proxy or similar device between it and the internet.

Now, if there's a proxy between the web server in question on your (client's) side and the internet, then that could be an issue.
EricRose-3179 5 Reputation points

2023-06-14T05:33:23.46+00:00

from memory it was around 5 minutes. Note that we have done further digging in logs from the various systems involved and found (for one specific client):

4699 correctly delivered requests in last 24 hours

and 84 incorrectly delivered requests in the last 24 hours

We have a smattering of other clients with a similar pattern: 5 to 10% of traffic delivered to the old IP address and the rest delivered to the new correct IP addresses.
Danny Zollner 10,821 Reputation points Microsoft Employee Moderator

2023-06-14T17:07:46.33+00:00

Ooh - that's interesting.. I don't think this new/updated version of the Microsoft Q&A platform has a private message functionality, and I'm not keen to throw my email address here.. could you message me on LinkedIn and I'll share my email address with you (and then will delete this comment), and I'll gather more information from you via email?
Danny Zollner 10,821 Reputation points Microsoft Employee Moderator

2023-06-19T17:10:12.6866667+00:00

@I suspect this issue may eventually self-resolve, but I'd appreciate the opportunity to get some information from you so that our software engineering team can look into this and identify the root cause, which would also end up resolving your issue if it doesn't self-resolve before then.
Danny Zollner 10,821 Reputation points Microsoft Employee Moderator

2023-06-19T17:13:22.3766667+00:00

Trying again..

Hi Eric - for context I'm part of the AAD product team and work closely with our provisioning service. I was able to locate an email address that you can get in touch with me via - if you can email AzCommunity@microsoft.com and say "Attn: Danny Zollner" in the subject, our community team will connect us.

I suspect this issue may eventually self-resolve, but I'd appreciate the opportunity to get some information from you so that our software engineering team can look into this and identify the root cause, which would also end up resolving your issue if it doesn't self-resolve before then.
EricRose-3179 5 Reputation points

2023-06-19T22:42:59.3933333+00:00

Danny,

Thanks for the response. We have made the decision to stop the web servers listening on the old IP addresses and finish the cutover to the new location. If there are ongoing issues for our clients, we'll address these with them as they report such. Testing with at one has shown that there aren't authentication issues from their tenant into our host app so I am reasonably confident that we won't see ongoing problems.

Unfortunately there is little more more I can add; we've had other services (notable site24x7) which had similar issues with a couple of servers not respecting the DNS change, and traffic from these endpoints in their system sending traffic to the old location. Beyond those AAD IP addresses I reported previously, I have no other details on what the issue is at your side, but I do suspect some caching gone wrong
Danny Zollner 10,821 Reputation points Microsoft Employee Moderator

2023-06-20T14:48:42.6566667+00:00

If you happen to have the tenant ID or jobId of the provisioning job(s) impacted, if you could reach out via email to provide them that would be immensely helpful in looking into this.

Share via

How do I get SCIM to send requests to the correct IP address for a domain?

1 answer

Your answer