SCIM Provisioning users disabled and reenabled

Question

Hello, We have an application synced trough SCIM, when a user gets disabled in Azure, is removed from the application on the target side. When the user is enabled again, is not reprovisioned in the application; we cannot see the user in the groups in scope. Is there a way to allow the user provison again and see it in the groups in which is a member on the target side? Coming from this thread : https://learn.microsoft.com/en-us/answers/questions/1279939/scim-provisioning-of-disabled-users?comment=answer-1248380&page=1#comment-1504191. Best regards.

Answer 1

@Ippoliti Ricardo ,

This scenario is covered in the Known Limitations documentation.

When a user is disabled in Microsoft Entra, the provisioning service will send a disable request to the target application. At that point, the user is not managed by the service and we will not send a delete request when they are deleted from the directory. When a user goes from soft-deleted to active, the Entra provisioning service will activate the user in the target app, but will not automatically restore the group memberships. The target application should maintain the group memberships for the user in inactive state. If the target application does not support this, you can restart provisioning to update the group memberships. The user must be active in Microsoft Entra ID before they're provisioned.

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-on-demand?pivots=app-provisioning https://learn.microsoft.com/en-us/entra/identity/app-provisioning/customize-application-attributes

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.