How can I force a sync of group Members in SCIM provisioning

Question

I am using Enta IDs scim provisioning. If I have a group in Entra ID which is out of sync in respect of it's members - how can I force an Update that adds missing members and remove members no longer in that group?

Answer 1

Hello Brogi, Clemens

Provisioning on demand for syncing groups with every number of group members can be challenging due to limitations in SCIM provisioning. Issues such as group memberships not being re-added after group deletion and the need for specific configurations to sync groups are common. The articles and documentation provide various solutions and insights into managing these challenges, including using specific settings in provisioning jobs and leveraging APIs for listing sync members.

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-on-demand?pivots=app-provisioning#known-limitations.

Hope this helps. Do let us know if you have any further queries

If this answers your query, do click `Accept Answer` and `Yes`

Answer 2

Take a look at on demand provisioning ( and the limitations):

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-on-demand?pivots=app-provisioning#known-limitations

Answer 3

I believe the issue is as follows:

When a group is synchronized and there are many changes — for example, when several members are added to or removed from the group — EntraID sends a separate PATCH request for each change as part of the SCIM provisioning process. However, these requests are not sent sequentially; instead, they are dispatched in parallel using multithreading. This parallel execution leads to database locks, causing some of the requests to fail and, ultimately, the synchronization to break. A more effective approach would be to consolidate the operations into as few requests as possible — ideally into a single request — to prevent such issues from occurring.