This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I've been reading Microsoft SCIM documentation and I see that some parts of it say that soft-delete attribute is optional and others that is required.
Can I get a confirmation on whether this attribute is required?
Thanks
There is no soft delete attribute - do you mean "active"? Active is not required, but it is not possible to force a non-gallery SCIM application to default to hard deletion (HTTP DELETE call) instead, so you'd be left without a way to disable users via SCIM.
Thanks!
Yes I refer to the mapping isSoftDeleted (Azure AD) - active (SCIM) like shown here
During some tests I notice the behaviour you mention, after deleting a user in my Azure AD I was just getting a PATCH operation. I believe I read it will trigger a DELETE only after the user has been deleted for 30 days, Do you know if that is correct?
Something that I'm not sure I understand correctly is the concept of "non-gallery SCIM application". In my case my company already has published its application to the Azure AD Gallery, but for testing purposes I just provision to my localhost version. Do you know where I can find more specific information related to Azure AD-SCIM provisioning for Gallery Apps? is it possible to get a Delete call when developing locally, something that emulates the behaviour of a Gallery App?
Thank you for help, much appreciated
A gallery application would be one available in the Azure AD Enterprise App gallery. In the context of provisioning, it's a gallery app that has a provisioning integration attached to it via an integration process where an Azure AD engineering team works with your company to build a customized SCIM integration. The alternative would be adding a custom non-gallery application during the Enterprise App create/add process and enabling SCIM on that.
For the custom non-gallery application SCIM route, you cannot alter these behaviors at all. It will always default to soft delete (active = false), and the only way that a hard delete will be triggered would be if the user in Azure AD is soft deleted and then hard deleted out of the recycle bin. The users purge out of the recycle bin automatically after 30 days, but if you manually hard delete them out of the recycle bin earlier, that will trigger this earlier.
For gallery applications where you've already integrated with Azure AD (as described above), it's possible but not preferrable that the default would be hard deletion (HTTP DELETE call to a SCIM URL). This isn't preferrable as hard deletion would then lead to the user object in the connected SCIM app being fully removed from the application, and a loss of any linkage between that user and resources in the app they may have access to. Disable (Active = false) is far less destructive there and is the preferred route.
(Wouldn't fit above..)
If you're specifically looking for some way to situationally hard delete based on certain criteria or configuration choices - that level of control does not exist today, unfortunately.
Thank you very much for the explanation.
A small expansion on the topic if you don't mind.
For what I have read about Azure Gallery doc and related SCIM doc I expect that the SCIM integration for gallery and non-gallery apps is very similar, maybe for gallery apps you get to fine tune things more (after you have complied with SCIM 2.0 specification (Gallery onboarding checklist) ?
I haven't come across documents about the cooperative integration, how that works? I mean what can be more fine-tune?
There are some behaviors and configuration options that cannot be modified on the generic SCIM app that can be on gallery integrations. Things like # of requests sent per second, soft delete vs hard delete, certain variations on the way Azure AD sends SCIM requests (i.e.: our generic SCIM client today, unfortunately, sends manager as a string, which is not compliant with the SCIM spec. It should be a complex attribute with a sub-attribute called "value" that is a string.). Not everything can be modified even then, but there's definitely more control than with the generic SCIM application.
We do hope to eventually introduce most of these controls/fixes to the generic SCIM app in the future, as well.