SCIM validator failing on Patch User - Replace Attributes but appears to be correct

Question

I have implemented a SCIM endpoint and am testing this using the Microsoft validator (https://scimvalidator.microsoft.com/).

On the "Patch User - Replace Attributes" test it is failing with the error: "The value of emails[primary eq true].value is Missing from the fetched Resource".

From what I can see I believe my implementation is correct and the updated value is being retrieved. What have I done wrong?

PATCH Request: {

"schemas": [

"urn:ietf:params:scim:api:messages:2.0:PatchOp"

],

"Operations": [

{

"op": "replace",

"path": "emails[primary eq true].value",

"value": "******@kunde.uk"

},

{

"op": "replace",

"value": {

"name.givenName": "Frida",

"name.familyName": "Bernadine"

}

}

]

}

The response is

{

"schemas": [

"urn:ietf:params:scim:schemas:core:2.0:User"

],

"id": "a1475273-0a2c-4fc8-0b48-08de2581bbee",

"userName": "******@ziemannmuller.uk",

"active": true,

"name": {

"givenName": "Frida",

"familyName": "Bernadine"

},

"emails": [

{

"primary": true,

"value": "******@kunde.uk"

}

]

}

When I do a GET on the User the response is:

{

"schemas": [

"urn:ietf:params:scim:schemas:core:2.0:User"

],

"id": "a1475273-0a2c-4fc8-0b48-08de2581bbee",

"userName": "******@ziemannmuller.uk",

"active": true,

"name": {

"givenName": "Frida",

"familyName": "Bernadine"

},

"emails": [

{

"primary": true,

"value": "******@kunde.uk"

}

]

}

Answer 1

Same for me.
I print directly the responses of the POST, PATCH and GET method and everything looks correct, but I still have this error on the PATCH test:

The value of emails[primary eq true].value is Missing from the fetched Resource

Here the result of the creation :

{
  "schemas" : [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id" : "10445",
  "externalId" : "******@fishergaylord.info",
  "userName" : "******@fishergaylord.info",
  "name" : {
    "givenName" : "Kailee",
    "familyName" : "Monserrat"
  },
  "active" : true,
  "emails" : [
    {
      "value" : "******@haag.co.uk",
      "primary" : true
    }
  ],
  "groups" : [
    {
      "value" : "level1",
      "display" : "level1",
      "$ref" : "http://localhost:3100/scim/v2/Groups/level1",
      "type" : "Group"
    }
  ],
  "meta" : {
    "resourceType" : "User",
    "location" : "http://localhost:3100/scim/v2/Users/10445"
  }
}

PATCH result:

{
  "schemas" : [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id" : "10445",
  "externalId" : "******@fishergaylord.info",
  "userName" : "******@fishergaylord.info",
  "name" : {
    "givenName" : "Furman",
    "familyName" : "Marques"
  },
  "active" : true,
  "emails" : [
    {
      "value" : "******@goldner.info",
      "primary" : true
    }
  ],
  "groups" : [
    {
      "value" : "level1",
      "display" : "level1",
      "$ref" : "http://localhost:3100/scim/v2/Groups/level1",
      "type" : "Group"
    }
  ],
  "meta" : {
    "resourceType" : "User",
    "location" : "http://localhost:3100/scim/v2/Users/10445"
  }
}

And the GET result:

{
  "schemas" : [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults" : 1,
  "startIndex" : 1,
  "itemsPerPage" : 1,
  "Resources" : [
    {
      "schemas" : [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "id" : "10445",
      "externalId" : "******@fishergaylord.info",
      "userName" : "******@fishergaylord.info",
      "name" : {
        "givenName" : "Furman",
        "familyName" : "Marques"
      },
      "active" : true,
      "emails" : [
        {
          "value" : "******@goldner.info",
          "primary" : true
        }
      ],
      "groups" : [
        {
          "value" : "level1",
          "display" : "level1",
          "$ref" : "http://localhost:3100/scim/v2/Groups/level1",
          "type" : "Group"
        }
      ],
      "meta" : {
        "resourceType" : "User",
        "location" : "http://localhost:3100/scim/v2/Users/10445"
      }
    }
  ]
}

Everything looks good and there is a value for the email.

Answer 2

Same issue here. Been trying for hours to get this to pass.

Initial Resource Creation Request

POST https://.ngrok-free.app/scim/v2/Users 1.1
Host: .ngrok-free.app
Content-Type: application/scim+json; charset=utf-8
{
  "active": true,
  "emails": [
    {
      "primary": "true",
      "value": "******@anderson.com"
    }
  ],
  "name": {
    "givenName": "Antwon",
    "familyName": "Wilmer"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "******@deckow.uk"
}

---

Initial Response Received

Initial Response Status: 201 Created

HTTP Request

PATCH https://.ngrok-free.app/scim/v2/Users/5bc76342-33af-4f41-9dae-cff2a454f78e 1.1
Host: .ngrok-free.app
Content-Type: application/scim+json; charset=utf-8
{
  "Operations": [
    {
      "op": "replace",
      "path": "emails[primary eq true].value",
      "value": "******@schmitt.biz"
    },
    {
      "op": "replace",
      "value": {
        "name.givenName": "Van",
        "name.familyName": "Triston",
        "active": true
      }
    }
  ],
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ]
}

---

Response Received

Response Status: 200 OK

Response Headers

Cache-Control: no-store, must-revalidate, max-age=0, private
Ngrok-Agent-Ips: 109.131.227.213
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: __profilin=p%3Dt; path=/; secure; HttpOnly; SameSite=Lax
Vary: Accept, Origin
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Miniprofiler-Ids: q40nmadi8ovtff3i9s17,8diafdnn7cmxeaod0k0h,7rihoai8mgx8kf51das7,ywjk11dues5odyfmcecj,ti3wihaqzlam4814ldxb,dhz06qvg5rw0lmixtwq5,1x9je68y6xouh66nspik,4xilte6x96qm8ruzkbhp,y5e50f60up315axm7gfn,pkhmy56g4a0wz9dpccyo,mijensbuzz82jvozs63z,y9zqbgio4gthpuj2uyvz,ufffn08htye28z51z5go,vvdnyzb16e3gn2aj4qvf,2x37xxjcgsxghraarjjz,j9pstujba60fl5n646jj,fzfozpb998k3dcbh7ydo,rl62983etpt6fy2joqpw,ln6kmbg3ugtboj2qxl3x,cgomck04bl2uh4mgxwxl
X-Miniprofiler-Original-Cache-Control: max-age=0, private, must-revalidate
X-Permitted-Cross-Domain-Policies: none
X-Request-ID: fc6892ee-bd54-403e-8a86-d6252fafd2e7
X-Runtime: 0.127427
X-XSS-Protection: 1; mode=block
Date: Sun, 01 Feb 2026 23:03:17 GMT
Content-Length: 306
Content-Type: application/scim+json; charset=utf-8

Response Body

{
  "active": true,
  "emails": [
    {
      "value": "******@schmitt.biz",
      "primary": "true",
      "type": ""
    }
  ],
  "id": "5bc76342-33af-4f41-9dae-cff2a454f78e",
  "meta": {
    "resourceType": "User"
  },
  "name": {
    "givenName": "Van",
    "familyName": "Triston"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "******@deckow.uk"
}

Answer 3

I'm having the exact same issue

Answer 4

I'm also experiencing this same issue, and it's not clear what's wrong, so I'm also interested in this. Not sure if it helps, but this is the data from my tests:

Correlation ID: 8b1d7501-1cf7-4cbc-a816-758a558c9c4d
Timestamp (UTC): 2025-11-18T18:37:48.822Z

Answer 5

It seems that the issue you're encountering with the SCIM validator may be related to the way you're specifying the path for the email attribute in your PATCH request. The error message indicates that the validator cannot find the expected value for emails[primary eq true].value.

In your PATCH request, you are using the path emails[primary eq true].value, which is intended to replace the value of the email where primary is true. However, ensure that the email structure in your response matches the expected SCIM schema.

Here are a few things to check:

1. Email Structure: Make sure that the email object in your response has the primary attribute set to true and that the value is correctly set to the email address you are trying to update.
2. Correct Path Usage: The path should correctly reference the primary email. If there are multiple emails, ensure that the primary email is the first one in the list or that your implementation correctly identifies it.
3. Response Consistency: Ensure that the response you are returning after the PATCH operation is consistent with the SCIM schema and reflects the changes made by the PATCH request.
4. Validation of the Response: After performing the PATCH operation, perform a GET request to confirm that the email has been updated as expected. The response should show the updated email value.

If everything seems correct but the issue persists, consider reviewing the SCIM implementation guidelines to ensure compliance with the expected behaviors for PATCH operations.

---

References:

• Understand the Microsoft Entra SCIM implementation