How can we customize SCIM query filter in Azure?

Question

How can we customize SCIM query filter in Azure?

Ashish Vishwakarma 1

Azure is using userName to apply filter. Can anyone suggest if there is any way to customize this filter? I want to use userName + externalId to be passed in the filter as parameter.

1 answer

Your answer

Answer 1

Danny Zollner 10,816 Microsoft Employee Moderator

Taking my response from your Stack Overflow post with the same question :)

Attributes set as matching properties in the mappings will be used sequentially to try to identify a match. For example, with userPrincipalName -> userName as matching precedence 1 and objectId -> externalId as matching precedence 2, Azure AD Provisioning would do a GET /Users?filter=userName eq "user@keyman .com". If that filtered GET returns zero results, then a GET /Users?filter=externalId eq "GuidValue" would be performed. If both came back with zero results, a POST will be used to create a user, otherwise if one result is found from either of those filtered GET calls, the objects will be linked between systems and a PATCH will be used to update any attributes on the SCIM service's user if needed.

There is no way to jointly call two attributes, such as /Users?filter=username eq "user@keyman .com" and externalId eq "GuidValue"

JamesTran-MSFT 37,226 Reputation points Microsoft Employee Moderator

2021-09-27T15:32:15.217+00:00

@Ashish Vishwakarma
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Ashish kumar 1 Reputation point

2021-10-04T05:31:24.307+00:00

Thank you @Anonymous , Same I tried and it is working. I've removed matching precendence from userPrincipalName. Now I'm using only objectId=>externalId. My requirement was to allow same userName/loginName value multiple times but guid should be different in my DB. So I can't use userName as filter because it may return 2 or more users. Using objectId mapped with externalId and setting matching precedence 1 to externalId and removing matching precendence from userPrincipalName I can do so.
Danny Zollner 10,816 Reputation points Microsoft Employee Moderator

2021-10-04T16:20:04.26+00:00

The SCIM standard requires that userName is uniqueness constrained. This may work for you but you are not compliant with the standard, to be clear.

Share via

How can we customize SCIM query filter in Azure?

1 answer

Your answer