How does azure SCIM provisioning handle changes in the Target System

Kajan Nallathamby 21 Reputation points

Just needed a few things cleared up about Azure SCIM Provisioning.

I understand if a user in the target system gets deleted. On the next poll it would find out the user is missing and re-create it.
My question is on other fields that were mapped, like the email field or the name field. What would happen if they were changed in the target system. The next poll would still find the user, does azure do any checks on all the mappings to see if it got modified and send a PATCH? or would they be out of sync? If so would they be synced again on the next a "Clear state and restart" is initiated?


Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
14,640 questions
0 comments No comments
{count} votes

Accepted answer
  1. JamesTran-MSFT 29,141 Reputation points Microsoft Employee

    @Kajan Nallathamby

    For your question regarding the changes happening in the Target System, would they be updated in the Source System.

    • Is there a reason why you want to change attributes in the Target System rather than the Source System?
    • Or why you would want to update the Source System from the Target System?

    Based off the How provisioning works documentation regarding the AzureAD provisioning service using the SCIM2.0 user management API, you can see that "user data" only flows one way, from the Source System to the Target System. With that in mind, the initial provisioning cycle, will query all users and groups from the source system retrieving all the attributes defined in the attribute mappings, if the user is found then it's updated using the attributes provided by the source system, this is a similar process for the incremental cycles.

    When it comes to the Clear State and Restart option, that will only initiate a new initial cycle. This action will clear any stored watermark and causes all the source objects to be evaluated again.


    From my understand, I believe user provisioning using the SCIM2.0 connector is "one-way" by design as to prevent updating the Source System from the Target System.


    Additional Links for your reference:

    Deprovisioning workflow

    Customizing Attribute Mappings

0 additional answers

Sort by: Most helpful