How does azure SCIM provisioning handle changes in the Target System

Question

Hey,
Just needed a few things cleared up about Azure SCIM Provisioning.

I understand if a user in the target system gets deleted. On the next poll it would find out the user is missing and re-create it.
My question is on other fields that were mapped, like the email field or the name field. What would happen if they were changed in the target system. The next poll would still find the user, does azure do any checks on all the mappings to see if it got modified and send a PATCH? or would they be out of sync? If so would they be synced again on the next a "Clear state and restart" is initiated?

Thanks,
Kajan

Answer 1

@Anonymous

For your question regarding the changes happening in the Target System, would they be updated in the Source System.

• Is there a reason why you want to change attributes in the Target System rather than the Source System?
• Or why you would want to update the Source System from the Target System?

Based off the How provisioning works documentation regarding the AzureAD provisioning service using the SCIM2.0 user management API, you can see that "user data" only flows one way, from the Source System to the Target System. With that in mind, the initial provisioning cycle, will query all users and groups from the source system retrieving all the attributes defined in the attribute mappings, if the user is found then it's updated using the attributes provided by the source system, this is a similar process for the incremental cycles.

When it comes to the Clear State and Restart option, that will only initiate a new initial cycle. This action will clear any stored watermark and causes all the source objects to be evaluated again.

From my understand, I believe user provisioning using the SCIM2.0 connector is "one-way" by design as to prevent updating the Source System from the Target System.

----------

Additional Links for your reference:

Deprovisioning workflow

Customizing Attribute Mappings