Entra ID: SCIM: Reconcilliation Loop Documentation

Question

Hi,

I'm ramping up on AAD integration concepts and was surprised to find that SCIM is push-based. In that Entra ID pushed updates to SCIM endpoints that my application exposes.

I can't find any documentation about how SCIM is used for reconciliation. Particularly:

• what happens if my server is down
• what happens if my server sends back 504s? What if it happens to send 504s exactly when Entra hits it, for 5 days, and then comes back?
• Basically - how does Entra use SCIM to ensure that my view of the world matches its?

Again, though I see that SCIM has APIs that should allow for building a robust GET, check, PATCH if needed reconciliation flow... I'm very nervous about building on this without understanding how to set expectations around Entra's behaviors and my expectations for the staleness of my view of the world.

Answer 1

Hello Cole Mickens (DetSys),

Thanks for your question.

I will be providing you with relevant links that can assist you.

The standard user object schema and rest APIs for management defined in SCIM 2.0 (RFC 7642, 7643, 7644)

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups

Regards,

You can mark it 'Accept Answer' if this helped.