SCIM integration in Entra for Salesforce

Question

We are trying to setup SCIM in Microsoft Entra for Salesforce application so that we can auto provision users in salesforce once we added the user in a AD group. The SCIM Test connection is succesfull, but the users are not able to login to the Salesforce application and getting below error in Entra - Error code

SystemForCrossDomainIdentityManagementServiceIncompatibleFiltering

Error message

StatusCode: Conflict Message: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details. Web Response: {"schemas":"["urn:ietf:params:scim:api:messages:2.0:Error"]","detail":"REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid;","status":409}

Can someone check the above logs and share your feedback - how can we resolve this issue?

Answer 1

relevent document is not for salesforce

Answer 2

The SCIM endpoint is returning HTTP 409 with the Salesforce-specific error REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid. This means Salesforce is rejecting the SCIM request because the user being provisioned does not have a required profile/entitlement set in the payload.

From the Microsoft Entra side, the SCIM client is working (Test Connection succeeds), but the target SCIM service (Salesforce) is enforcing additional business rules beyond the base SCIM spec. To resolve this, the provisioning attribute mappings in the Salesforce enterprise app must be configured so that every provisioned user is sent a valid Salesforce profile/entitlement value.

Actionable steps:

1. Open the Salesforce enterprise application in Microsoft Entra admin center and go to Provisioning → Mappings for Users.
2. Identify the attribute that Salesforce expects for the profile/entitlement (for example, a SCIM attribute like entitlements, profileId, or a Salesforce-specific extension attribute). This must match what the Salesforce SCIM endpoint requires.
3. Map an appropriate Microsoft Entra attribute (for example, a fixed value, a group-based expression, or a user attribute) to this required Salesforce attribute so that every provisioned user receives a valid profile/entitlement.
4. Ensure the mapping is marked as Required if Salesforce always requires it, and verify that the value being sent is valid in Salesforce (matches an existing profile/entitlement ID or name, depending on how Salesforce expects it).
5. Save the mappings and run provisioning again (either on‑demand for a test user or wait for the next cycle). Confirm in the provisioning logs that the SCIM request now includes the required profile/entitlement attribute and that Salesforce returns 2xx instead of 409.

If Salesforce still returns 409 after adding the mapping, review the Salesforce SCIM documentation or logs to confirm the exact attribute name and allowed values for the required entitlement/profile.

---

References:

• Tutorial: Develop and plan provisioning for a SCIM endpoint in Microsoft Entra ID
• Known issues and resolutions with SCIM 2.0 protocol compliance of the Microsoft Entra user provisioning service
• SCIM synchronization with Microsoft Entra ID
• Troubleshoot on-premises application provisioning