Share via

Azure SCIM does not send custom attributes on initial user creation

Hoopla Dev 20 Reputation points
2025-10-08T18:13:09.04+00:00

I have the following attributes defined in Azure Provisoning Attribute mappings:

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:domain_role

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:locations

I have those attributes mapped in Auth0 for SCIM events. However, these two attributes won't be sent on the initial user create event. Only gets passed on user updated event by forcing it provision on demand. I have the schema of the above attributes set to FlowAlways as well.

However, if I changed the attribute mappings to the following:

urn:ietf:params:scim:schemas:extension:DomainRole:2.0:User:CustomAttribute

urn:ietf:params:scim:schemas:extension:Locations:2.0:User:CustomAttribute

It gets passed along on initial user create event. But I cannot seem to add them on Auth0 mappings due to a syntax error. So far only urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:domain_role works on Azure and its corresonding Auth0 mapping field would be urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.domain_role but the problem is that it does not get passed along on SCIM user create event.

Any help would be appreciated.

Azure App Configuration
Azure App Configuration
An Azure service that provides hosted, universal storage for Azure app configurations.
0 comments
Answer accepted by question author
  1. Praveen Chivarla 1,275 Reputation points Microsoft External Staff Moderator
    2025-10-09T09:46:53.2+00:00

    Hi Hoopla,

    Thank you for posting your query on Microsoft Q&A.

    The issue where custom attributes in Azure SCIM provisioning do not appear on the initial user creation event but do appear during update events is a recognized behavior in Microsoft Entra ID provisioning.

    • During the initial SCIM user creation (POST operation), the provisioning service often sends only core mandatory attributes.
    • Custom attributes configured with FlowAlways mapping may not be included in this initial creation payload.
    • These custom attributes are sent in subsequent update (PATCH) operations, such as when using on-demand provisioning to force a sync.
    • This behavior is due to how the Microsoft Entra provisioning service optimizes initial create operations.

    Steps to Troubleshoot and Mitigate:

    1. Verify Attribute Mapping and Schema Extension: Ensure your custom attributes use the correct SCIM schema URNs, typically in the format: urn:ietf:params:scim:schemas:extension:<CustomExtensionName>:2.0:User:<CustomAttribute> Confirm these are properly added in Azure provisioning and correspond accurately in your target application’s SCIM schema.
    2. Set Attribute Flow to FlowAlways: In the Azure portal, for each custom attribute mapping, set the flow behavior to FlowAlways to try sending attributes on each provisioning cycle.
    3. Trigger Provisioning On-Demand: Use the Azure portal’s on-demand provisioning feature to manually start a sync cycle, which triggers updates and sends the custom attributes.
    4. Check Provisioning Logs: Review provisioning logs in Azure for any errors or attribute filtering related to custom attributes that might prevent sending.
    5. Update Schema if Needed: If your target app rejects or errors on certain URNs, adjust the schema or mapping to ensure compatibility.

    Known Limitations:

    • Custom attributes might not be sent during initial user creation by design in current Microsoft Entra provisioning service behavior.
    • This is not a preview limitation but a current state that may improve with future updates.

    References:

    Please click "Accept as Answer" if this resolves your issue. This will help others with similar questions find the solution.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.