Why does Azure AD SCIM Provisioning use "add" operation instead of "replace" for updating existing user attributes during PATCH user call??

Pragya 20 Reputation points
2026-03-07T19:09:55.6333333+00:00

I have a question about Azure PATCH /{userId} SCIM operation .

Scenario:

  1. Azure AD calls GET /Users/{userId} on my SCIM endpoint
  2. My endpoint returns the user with existing attributes:   {   "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],   "id": "user-123",   "userName": "user@example.com",   "displayName": "John Doe",   "name": {     "givenName": "John",     "familyName": "Doe"   },   "externalId": "<pii removed>",   "emails": [     {       "primary": true,       "type": "work",       "value": "user@example.com"     }   ] }
  3. I modify only the name attribute in Azure AD (e.g., change givenName from "John" to "Johnny")
  4. Azure AD sends a PATCH request with multiple "add" operations (And no Replace operation?):    {      "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],      "Operations": [        {"op": "Add", "path": "displayName", "value": "Johnny Doe"},        {"op": "Add", "path": "userName", "value": "user@example.com"},        {"op": "Add", "path": "name.givenName", "value": "Johnny"},        {"op": "Add", "path": "name.familyName", "value": "Doe"},        {"op": "Add", "path": "name.formatted", "value": "Johnny Doe"},        {"op": "Add", "path": "externalId", "value": "..."}      ]    }

My Questions

  1. Why does Azure AD use "op": "Add" instead of "op": "Replace" for attributes that already exist?

According to RFC 7644 Section 3.5.2:

  • add - Adds a new value; if the target already contains a value, the value is replaced
  • replace - Replaces an existing value; returns error if attribute doesn't exist

Since Azure AD performs a GET request first and knows the attributes exist, wouldn't replace be more semantically correct?

  1. Why does Azure AD send ALL mapped attributes in the PATCH request, not just the ones I modified?

I only changed name.givenName, but Azure sent operations for displayName, userName, emails, etc. Is this expected behavior? Is there documentation explaining this sync strategy?

  1. Is there any configuration to change this behavior?

Can I configure Azure AD to:

  • Send only modified attributes?
  • Use replace instead of add for existing attributes?
Microsoft Security | Microsoft Entra | Microsoft Entra ID

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.