Custom user attribute value is not being synced to target application directory while using Entra SCIM Provisioning

Hello Priyanshu Kumar,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I will try to clarify your doubts regarding this issue, before that I would recommend you to provide some below extra information for better solution:

• Is the serialNumber attribute single-valued or multi-valued in Azure AD (Entra)? Is the serialNumber attribute mapped correctly as a string type in the SCIM attribute mappings configuration?
• Are there any transformation expressions applied in the mapping for serialNumber?
• Have you checked Entra provisioning service logs for any attribute mapping warnings or errors?
• Is the attribute set as required or optional in the target application schema?
• What is the full name of the attribute used in the source? (e.g., is it extensionAttribute1 or a specific object name?) This helps ensure the correct function syntax is provided in the solution, as extension attributes often require specific naming in the Entra ID GUI.

Till then I will recommend you to try the below solution:

Try using the SingleAppRoleAssignment or the Join expression function within the provisioning mapping to force the engine to extract the single value from the perceived array.

Using an Expression mapping: You need to change the mapping type for the Autodesk objectGUID attribute from a simple Direct mapping to an Expression mapping.

1. Navigate to the Provisioning Mappings: Go to your Autodesk Gallery App in Entra ID> Provisioning > Edit attribute mappings.
2. Locate the Mapping: Find the entry that maps your custom attribute (serialNumber) to the Autodesk target attribute (objectGUID or similar).
3. Change Mapping Type: Change the Mapping type from Direct to Expression.
4. Use the SingleAppRoleAssignment Function: Apply the following function to extract the single value: SingleAppRoleAssignment(serialNumber)
   • If serialNumber is not accepted as the direct attribute name, you may need to use the Join function, which is the most robust method for forcing a single string output from a source attribute: Join(",", serialNumber)
   • Note: Even though you use the Join function, if the attribute is single-valued, it will simply return the single value as a string, resolving the array issue.

Please do refer below documents for better understanding:

Customizing attribute mappings for user provisioning in Microsoft Entra ID: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/customize-application-attributes#editing-attribute-mappings

(Look for the 'Functions' section) This document lists all available functions, including Join and SingleAppRoleAssignment, and explains how to use them to manipulate data formats before provisioning.

Attribute mapping expressions for Microsoft Entra ID Application Provisioning: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/functions-for-customizing-application-data#join

Hope this helps! If it answered your question, please consider clicking Accept Answer and Upvote. This will help us and others in the community as well. If you need more info or the above solution did not work for you, please feel free to reach out in the comments with the extra information asked so that we will guide you further. Happy to help!

Regards,

Monalisha

Hello Monalisha,

Here are the answers to your questions:

• Is the serialNumber attribute single-valued or multi-valued in Azure AD (Entra)? Is the serialNumber attribute mapped correctly as a string type in the SCIM attribute mappings configuration? Ans: It is an object with single key value pair which contains the actual value.
• Are there any transformation expressions applied in the mapping for serialNumber? Ans: We tried a few like CStr but it won't work for object..
• Have you checked Entra provisioning service logs for any attribute mapping warnings or errors? Ans: Yes, provisioning is failing as Entra is sending same string "System.Object[]" to Autodesk objectGUID for all the users, which is causing errors as it says user already exists.
• Is the attribute set as required or optional in the target application schema? Ans: It is required and was there in default setup (as it's gallery app)
• What is the full name of the attribute used in the source? (e.g., is it extensionAttribute1 or a specific object name?) This helps ensure the correct function syntax is provided in the solution, as extension attributes often require specific naming in the Entra ID GUI. Ans: extension_99c8fda7219744eaa80038_serialNumber (not exact, i removed few characters)

If there is any way to pull the value from the object using expression, that might help in this case.

Hello Priyanshu Kumar,

Thank you for providing the detailed answers. This issue may occur when the SCIM provisioning engine encounters a custom extension attribute that is internally structured as a complex object or array, even if it logically contains a single value.

The issue is not that custom attributes aren't supported by Entra SCIM, but rather how the SCIM engine attempts to convert the complex extension_..._serialNumber object into the simple string expected by the Autodesk objectGUID attribute.

Since the source attribute is confirmed to be an object (which the engine sees as an array) and your attempts with CStr failed, the most robust solution is to use the Join function with the full extension attribute name to force the output into a single string.

You need to change the mapping for the Autodesk objectGUID attribute to an Expression mapping using the Join function with the exact, full extension attribute name provided.

1. Navigate to your Autodesk Gallery App in Entra ID > Provisioning > Edit attribute mappings.
2. Locate the mapping for the Autodesk target attribute (e.g., objectGUID).
3. Change the Mapping type from Direct to Expression.
4. In the Expression field, enter the following formula, replacing the example attribute name with the exact, full name you provided: Join(",", [extension_99c8fda7219744eaa80038_serialNumber]) Alternatively, you can use: First([extension_99c8fda7219744eaa80038_serialNumber]) Explanation:
   • The Join function takes the values from the array/object inside the square brackets [] and concatenates them into a single string.
   • Using "" (an empty string) as the first parameter ensures there is no separator between the values.
   • Since your object only contains one key-value pair (the actual serial number), this expression will successfully extract that single value and output it as a plain string, thus resolving the "System.Object[]" error.
5. Click OK and then SAVE the attribute mappings.
6. Restart the provisioning cycle.

Why the Array error occurs: The SCIM provisioning service, when it sees a custom extension attribute synced from AD via Entra ID Connect, often treats it as a complex type (an object or an array), especially if it's stored in a multi-valued container in the schema, even if only one value is present. When it tries a direct mapping to a simple string field (like objectGUID), it fails to serialize the complex object, resulting in the generic programming output: System.Object[]. The Join function successfully handles the deserialization and conversion to a clean string.

Please apply the Join expression above using the exact, full attribute name from your environment and restart the provisioning job. Let me know the result, and we can check the provisioning logs again if the issue persists.

Happy to help!

Thanks!

Hello Priyanshu Kumar,

Just checking if you had a chance to see my above reply. If you need any extra information do let us know.