Entra ID - provision user administrative roles alongside app roles using SCIM

Question

I have a SCIM integration that provisions users from EntraID to my SCIM application. I've followed the instructions provided in Provisioning a role to a SCIM app to make sure it provisions any roles that are assigned to a user. Unfortunately, this only provisions the roles that are assigned for that specific application.

Is there a way to read all roles (Administrative Roles) that user has assigned in EntraID, not just the roles assigned for the SCIM app itself?

Thanks!

Answer 1

Is there a way to read all roles (Administrative Roles) that user has assigned in EntraID, not just the roles assigned for the SCIM app itself?

No.

Most applications do not care about the administrative directory roles (Global Admin, etc..) assigned to users in Entra ID. Applications have their own concepts of entitlements. Those app-specific roles are usually represented on the Enterprise Application object in Entra ID, where they can be assigned to users, and SSO + Provisioning can both then leverage those app-specific assignments to send role/entitlement data in SSO claims or SCIM create/update payloads.

If your application does have a reason to care about the Entra ID directory roles assigned to users, it will need to make calls to Microsoft Graph API to obtain that data, as it is not possible to use a user's assigned Entra ID directory roles as a data source with our provisioning service at this time.