Entra SCIM provisioning – OAuth2 Client Credentials Grant sends two sets of client credentials to token endpoint (Basic and form), causing token issuance to fail

Question

Entra SCIM provisioning – OAuth2 Client Credentials Grant sends two sets of client credentials to token endpoint (Basic and form), causing token issuance to fail

Andy Paciocco 25

I am trying to configure SCIM provisioning to a non-gallery app using the very new option of OAuth2 Client Credentials authentication, but the connection test is returning an error. This is because the provisioning service’s token request includes both:

an Authorization: Basic <base64(client_id:client_secret)> header, and

client_id & client_secret in the application/x-www-form-urlencoded body.

Our token server rejects this as “Multiple client credentials cannot be specified.” Per OAuth 2.0 client authentication guidance, only one client authentication method should be used per request. As a result, the connection test fails unless we insert a token manually.

Postman works against the same token endpoint using either Basic or body creds (individually).
Entra with the same client id/secret fails with “Multiple client credentials…” from the token server.

Proof (webhook test):

Pointed Token Endpoint to a webhook URL; set Tenant URL to another webhook URL.
Entra’s token request (captured):
- Headers: Authorization: Basic dGVzdDp0ZXN0
- Body (x-www-form-urlencoded): grant_type=client_credentials&client_id=test&client_secret=test ⇒ Entra is sending both Basic and form client credentials in the same request.

Is there any way to disable this dual-credential behavior?

Anonymous

2025-09-03T09:41:42.42+00:00

Hi @Andy Paciocco,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer accepted by question author

Anonymous

Hi @Andy Paciocco,

Thank you for posting your query on Microsoft Q&A.

As we understand, you are configuring SCIM provisioning in Microsoft Entra ID for a non-gallery application using the OAuth2 Client Credentials grant, but your token server is rejecting the request because Entra's provisioning service sends both a Basic Authorization header and client credentials in the request body, resulting in "Multiple client credentials cannot be specified" errors. This does not occur with Postman when you use only one authentication method.

This is because Microsoft Entra SCIM provisioning’s OAuth2 Client Credentials flow, as implemented, always sends both:

the Authorization: Basic <base64(client_id:client_secret)> HTTP header and
the client_id and client_secret in the body as per form encoding.

Many standards-compliant OAuth2 servers (such as those enforced by your organization) expect only one client credential method and will reject requests that include both.

Please follow the steps below to solve the issue:

1. Use the Azure AD Connect Provisioning Agent (On-Premises SCIM Agent):

Deploy the agent on a VM in your environment.
Configure your on-premises SCIM application connection through the agent in the Entra portal.
This method avoids the dual-authentication issue and uses only a Bearer token for authentication.

2. Check and Monitor for Microsoft Updates:

Microsoft is aware that strict token endpoints may reject dual authentication, and this behavior could change as the product evolves.

3. Workarounds If Using Cloud Provisioning Is Required:

If you must use Entra’s built-in cloud-based provisioning, confirm if your token server can be configured to accept both credentials, even if this is not standards-compliant (some servers have a flag for lenient authentication parsing).
Alternately, if supported, create a simple proxy/middleware that removes either the Basic header or the body credentials, but this introduces additional complexity.

Please refer to:

How to configure SCIM user provisioning

· Install the Microsoft Entra provisioning agent

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Andy Paciocco 25 Reputation points

2025-09-03T09:52:39.2966667+00:00

I can't accept this as answer as it does not solve my problem. I am not able to modify the behavior of my token server, so even if the flag to accept both credentials exists, I am unable to implement this solution. The On-Premises SCIM Agent solution is not useful as we already have a bearer token authorization workaround in place, but we have been waiting for this development allowing Entra to use OAuth. Leaving only the Check and Monitor for Microsoft Updates 'solution', which means I do nothing and wait for the day this problem is resolved in Entra.
Anonymous

2025-09-03T12:47:55.65+00:00
Hi @Andy Paciocco,

Thank you for your follow-up and for explaining your specific concern.

Currently, Microsoft Entra SCIM cloud provisioning always sends both the Authorization: Basic <base64(client_id:client_secret)> header and the client_id and client_secret in the request body when using OAuth2 Client Credentials Grant. There is no way to disable this dual-credential behavior or to configure the cloud provisioning service to comply with servers that require only one method.

This is a known limitation. Microsoft’s current documentation and recent forum discussions confirm that:

There is no configurable setting in Entra SCIM provisioning (cloud) to change this authentication pattern.

This dual-credential approach can lead to errors with standards-compliant OAuth2 servers that accept only one credential authentication method per request.learn.microsoft

If your environment cannot change token server behavior and you are already using all available workarounds (such as bearer token or on-premises agent), unfortunately, there is no supported cloud-based solution at this time except to wait for Microsoft to release an update that addresses this limitation.

Please refer to:

OAuth 2.0 client credentials flow on the Microsoft identity platform learn.microsoft

Configure SCIM provisioning using Microsoft Entra ID learn.microsoft

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

3 additional answers

Your answer

Anonymous

2025-09-03T09:41:42.42+00:00

Hi @Andy Paciocco,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Andy Paciocco 25 Reputation points

2025-09-03T09:52:39.2966667+00:00

I can't accept this as answer as it does not solve my problem. I am not able to modify the behavior of my token server, so even if the flag to accept both credentials exists, I am unable to implement this solution. The On-Premises SCIM Agent solution is not useful as we already have a bearer token authorization workaround in place, but we have been waiting for this development allowing Entra to use OAuth. Leaving only the Check and Monitor for Microsoft Updates 'solution', which means I do nothing and wait for the day this problem is resolved in Entra.
Anonymous

2025-09-03T12:47:55.65+00:00

Hi @Andy Paciocco,

Thank you for your follow-up and for explaining your specific concern.

Currently, Microsoft Entra SCIM cloud provisioning always sends both the Authorization: Basic <base64(client_id:client_secret)> header and the client_id and client_secret in the request body when using OAuth2 Client Credentials Grant. There is no way to disable this dual-credential behavior or to configure the cloud provisioning service to comply with servers that require only one method.

This is a known limitation. Microsoft’s current documentation and recent forum discussions confirm that:

There is no configurable setting in Entra SCIM provisioning (cloud) to change this authentication pattern.

This dual-credential approach can lead to errors with standards-compliant OAuth2 servers that accept only one credential authentication method per request.learn.microsoft

If your environment cannot change token server behavior and you are already using all available workarounds (such as bearer token or on-premises agent), unfortunately, there is no supported cloud-based solution at this time except to wait for Microsoft to release an update that addresses this limitation.

Please refer to:

OAuth 2.0 client credentials flow on the Microsoft identity platform learn.microsoft

Configure SCIM provisioning using Microsoft Entra ID learn.microsoft

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Answer 1

We are working on this solution and the first change which you will see coming is that the Non-Gallery application template soon will show you the option to choose the Client Credentials in Header or in Body but not in both. Per standard we will default to Header but you will have a UX option to change that to Body as needed. For all new SCIM Provisioning applications we are going to enable the Client Credentials authentication only in one way so that this problem does not occur. We are also working with all other ISVs who support client credentials authentication to update it in this way so that everyone is compliant.

Answer 2

John Case 0

The SCIM protocol specification explicitly states "The client MUST NOT use more than one authentication method in each request."

https://datatracker.ietf.org/doc/html/rfc6749#section-2.3

Does Microsoft intend to stay non-compliant indefinitely?

0 comments

Answer 3

Claudiu 0

Same issue.

0 comments