Azure AD SCIM Provisioning - User attribute updates

Question

Hi Team,

For empty user attributes, while adding some value, will the patch request from SCIM provisioning application in Azure AD contains REPLACE operation or ADD operation? 

Please suggest the scenarios where add and replace operations are used.

Answer 1

@Ruchi ,

The SCIM documentation specifies that the PATCH request from the SCIM provisioning application should contain an ADD operation since there would be no value to replace in that scenario. If there is a value to replace, the PATCH should contain a REPLACE operation. In practice though, it could be either, and the behavior is not always consistent, so you should support both in your SCIM server code.

The SCIM protocol RFC outlines the difference between the add and replace operations in PATCH requests for different scenarios.

https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups