How to Correctly Handle SCIM Group Membership Updates in Azure: The Same Group Receives Multiple Patch Requests Concurrently

Question

Hi Team,We used the SCIM protocol to integrate with Microsoft Entra ID to implement the Patch interface of the Group, but found that Microsoft would only add a single member each time. For example, if a group has 500 members, it will send 500 Patch requests, adding only one member each time. Why not add 500 members at once?

Answer 1

The answer to "why not add 500 at once?" is that not all applications / directories can handle multiple group membership add/remove operations at once. While it is less efficient, one operation at a time is the most compatible behavior. Currently we support including multiple add/remove operations for the group "members" attribute only on provisioning integrations published in the Enterprise App Gallery.

We're aware of customer feedback requesting that it would be helpful if this and a few other QoL features were configurable for all SCIM provisioning jobs including custom non-gallery jobs and it is on our roadmap. Unfortunately, I can't provide an ETA at this time.