A cloud-based identity and access management service for securing user authentication and resource access
Why does Azure AD SCIM Provisioning use "add" operation instead of "replace" for updating existing user attributes during PATCH user call??
Pragya
20
Reputation points
I have a question about Azure PATCH /{userId} SCIM operation .
Scenario:
- Azure AD calls GET /Users/{userId} on my SCIM endpoint
- My endpoint returns the user with existing attributes: { "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "id": "user-123", "userName": "user@example.com", "displayName": "John Doe", "name": { "givenName": "John", "familyName": "Doe" }, "externalId": "<pii removed>", "emails": [ { "primary": true, "type": "work", "value": "user@example.com" } ] }
- I modify only the name attribute in Azure AD (e.g., change givenName from "John" to "Johnny")
- Azure AD sends a PATCH request with multiple "add" operations (And no Replace operation?): { "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [ {"op": "Add", "path": "displayName", "value": "Johnny Doe"}, {"op": "Add", "path": "userName", "value": "user@example.com"}, {"op": "Add", "path": "name.givenName", "value": "Johnny"}, {"op": "Add", "path": "name.familyName", "value": "Doe"}, {"op": "Add", "path": "name.formatted", "value": "Johnny Doe"}, {"op": "Add", "path": "externalId", "value": "..."} ] }
My Questions
- Why does Azure AD use "op": "Add" instead of "op": "Replace" for attributes that already exist?
According to RFC 7644 Section 3.5.2:
- add - Adds a new value; if the target already contains a value, the value is replaced
- replace - Replaces an existing value; returns error if attribute doesn't exist
Since Azure AD performs a GET request first and knows the attributes exist, wouldn't replace be more semantically correct?
- Why does Azure AD send ALL mapped attributes in the PATCH request, not just the ones I modified?
I only changed name.givenName, but Azure sent operations for displayName, userName, emails, etc. Is this expected behavior? Is there documentation explaining this sync strategy?
- Is there any configuration to change this behavior?
Can I configure Azure AD to:
- Send only modified attributes?
- Use replace instead of add for existing attributes?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Sign in to answer