Sending an empty value with user provisioning (SCIM)

Jesper List 6

How do I send an empty value using user provisioning (SCIM)? Currently, when a field is empty, it isn't sending anything at all. We aren't receiving anything on our DB. If the field is filled in, it's actually sending data.

I assume I need to fill in something here, but not sure what.

Can someone help me with this?

1 answer

Danny Zollner 10,481 Reputation points Microsoft Employee

2021-01-08T20:12:53.833+00:00

Currently AAD Provisioning doesn't send null/empty values in almost all cases. It's something we're working on adding, but there are some special considerations we're working through to make sure that accidental overwriting of data with null/empty values is not easily achieved.

Barring attributes defined in the SCIM spec as being required, your application should process the lack of an attribute's presence in a POST/PATCH as it being null/empty. If it doesn't already have that functionality, it should probably be added.
Please sign in to rate this answer.

2 people found this answer helpful.
FlorianF 21 Reputation points

2022-03-09T17:46:33.623+00:00

@Anonymous is there any update on the thoughts to make writing EMPTY strings possible via AAD SCIM Provisioning Mapping - such as using an expresion in field mapping:

Coalesce([employeeId],"")

Danny Zollner 10,481 Reputation points Microsoft Employee

2022-03-09T18:22:53.253+00:00

No meaningful update - it's still in our backlog. It hasn't been forgotten about, but also isn't close enough to have a date that can be shared.

Jonas A 0 Reputation points

2023-01-30T09:40:54.8866667+00:00

Any update regarding the implementation of null support?

E.g. do not provision the attribute if it is null and not marked as required.

DanP110 26 Reputation points

2023-03-24T20:52:35.97+00:00

Have there been any recent changes in regards to this behavior? We have a custom name-spaced attribute, and we've noticed that we are getting empty strings in PATCH replace operations from one customer:

"Operations": [ { "op": "Replace", "path": "urn:ietf:params:scim:schemas:extension:ourname:2.0:User:ourattr", "value": "" } ]

FlorianF 21 Reputation points

2023-10-25T09:43:52.2066667+00:00

@Danny Zollner can you comment on this? Maybe even confirm this new behaviour?

Without testing it myself yet, this sounds promising.

From my point of view:
The target application should be informed, when AAD attributes are emptied out and an empty value shall reflected / written in target application -

Danny Zollner 10,481 Reputation points Microsoft Employee

2023-10-25T14:59:56.19+00:00

Not possible at this time, behavior outlined in the above message from 6+ months ago was not expected behavior and may have been a bug on either the AAD/Entra side or the SCIM server's side. Please see my answer on this recent thread for a deeper look at the scenario and why it isn't a quick fix: https://learn.microsoft.com/en-us/answers/questions/1389359/how-do-i-clear-an-attribute-value-using-expression

FlorianF 21 Reputation points

2023-11-22T16:23:38.4766667+00:00

@Danny Zollner Can you be more specific on the statement

"....but there are some special considerations we're working through to make sure that accidental overwriting of data with null/empty values is not easily achieved."...

I like to understand, which case is not worth to fully reflect the single source of truth AAD instead of ignoring the emptied attribute and not transfer it to target application.

a) Can you answer, is AD provisioning not sending the internal trigger, when attributes are emptied?

b) AD Provioning receives the trigger internally, but ignores all empty values and not even compares it to cached values, therefore also not sending updates to target app.

For option b) could it be a workaround to send invisible ASCII character such as discussed here on stackoverflow for another topic and applied as the following example:

Coalesce(ToLower([mail], ), "‌‌ ")

Looking forward for an answer.

I read the known issue page, but we really hoped SCIM can be our synchronsation protocol out of the box for full fledge user profile inclduing attribute, which can also be empty from time to time.

FlorianF 21 Reputation points

2023-11-25T09:32:16.14+00:00

Update: to my posting above.

The workaround is not working sadly. Even if we would be able to transfer invisible chars, there is no trigger in AD Provisioning to kick-on the transfer, when an attribute has been fully emptied.

Sure we read known issue page, but we still cannot understand WHY the single point of thruth AAD / Entra ID does not support a trigger, when attributes change state from filled to empty and inform eg AD Provisioning.

Looking forward to a solution, otherwise it would be lot's of manual effort to cleanse all those attributes with high effort in target application.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Sending an empty value with user provisioning (SCIM)

1 answer

Your answer