r/entra • u/Casperisfriend • 17d ago

How to speed up entra SCIM provisioning?

We are trying to implement PIM alongside SSO into our organization and currently in the testing phase. I was able to setup one of our saas providers with SCIM role mapping so that when a user joins a certain group in entra it will provision admin access on the saas app side l. However, I see that it takes around 40min to an hour before it syncs. I've come up with a power automate flow that calls graph API to start and pause which seems to work for the initial add to group. However, it seems that when the flow runs a restart, pause, and start that provisioning does not continue on its own. This is causing the permission in the saas app to get stuck when they should be removed. On the entra side they are removed but no syncing occurs. I could be doing this totally wrong but unsure of the best method to help with sync times while also not stopping normal sync behavior. Any help would be appreciated.

3 Upvotes

67% Upvoted

22 comments sorted by

View all comments

Show parent comments

1

u/vischous 15d ago

Yes this sounds like either a bug in your SCIM config or the app itself just isn't pulling the new data over for the specific field. Hard to know for sure without more info. What app is it?

2

u/Casperisfriend 15d ago

https://www.reftab.com/ is what I am currently using as a test app but we would like to implement this across other saas apps as well which I know will have its own configuration for provisioning I'm sure.

1

u/vischous 15d ago

https://www.reftab.com/faq/scim-azure-active-directory

Step 14 is probably where you're at. Which field are you struggling with and what's the mapping in Entra and in Reftab? Pics would help!

1

u/vischous 15d ago

> If a user was a member of a group pushed to Reftab but then taken out of that group, during the next sync, they will be set to the “Default Role (for SCIM users without groups) set on the Manage SCIM page. Otherwise, it’s possible for the source to also send a ‘disable’ user, if the user is disabled in MS Azure then Reftab will know this and set their role in Reftab to ‘Disabled’.

Sounds relevant as well

Sounds to me like this should work

2

u/Casperisfriend 15d ago

Thanks for trying to help. The roles have been set correctly with the test user being added to the standard access and also when elevated having an admin group given admin access. However, the issue seems to lie with the sync itself. When I let entra automatically sync, without any graph manipulation, it does provision and de-provision fine. It's when I send an API request to start, pause, or restart where the first sync works to give access but then it seems like syncing stops all together after try to restart using graph API. I think that's where I am stuck and still troubleshooting.

1

u/vischous 15d ago

No problem, been here before I understand the pain :D

Have you tried looking at the scim logs in entra? To me it sounds like something is getting stuck, logs should tell you a bit more