The SCIM is not able to provision users with the correct group for slack

Question

We are getting this error when we try to provision users with the correct AD group and it is telling the user already exists in the target system instead of updating the user on the target system.

The expected outcome is user should be able to provision with the correct AD group.

StatusCode: Conflict Message: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details. Web Response: {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":: ,"status":409}. This operation was retried 0 times. It will be retried again after this date: 2026-02-18T02:04:24.3751417Z UTC

We tried running this command on the graph explorer but still the behavior is same.

Entra is trying to provision the accounts as new, rather than acknowledge them as existing. IE its sending POST messages because it doesn't believe, or hasn't properly synced the existing Slack userID into the Entra datastore.    We need to force Entra to restart the synchronization job: https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-restart?view=graph-rest-beta&tabs=http   To note, This needs to be done using the BETA branch - no idea why it doesn't work on 1.0, but we have reports from other customers that have to do this, that it doesnt work otherwise.    additionally, you need to change the criteria to the following:  

`{
   "criteria": {
       "resetScope": "Full"
   }
}`

  This is because the original payload doesn't include the "connectorDataStore" scope - and without that, Entra won't pull the Slack userID from the SCIM request if one already exists. It'll just skip it rather than fix it.    SCIM implementation is the responsibility of the IDP, and in this case Microsoft made some choices that make it hard to "fix" if the changes were made outside of Entra. I can definitly admit this is a really sledgehammery fix, but what this will do is get Entra to acknoweldge the Slack account exists, and map it with the matching email address.

This is the command https://graph.microsoft.com/beta/servicePrincipals/af7f7870-6133-461b-ac51-62d520334e5d/synchronization/jobs/scim.906aefe976a74f65b82d5ec20775d5aa.5d971198-9904-460c-aa67-20f119b7b955/microsoft.graph.restart

 Screenshot 2026-02-17 211316.png

Answer 1

Thanks for identifying this workaround. This is probably a feature gap between v1 and beta. It means there is a limitation in the v1 that is in beta.
Its okay to use it if it solves the problem but with caution.