The Microsoft Entra SCIM Validator is a free, public, browser-based wizard from Microsoft. Its landing page states the contract precisely: it enables you to "test your server for compatibility with the Entra ID SCIM client" (scimvalidator.microsoft.com, retrieved 2026-11-01). The tool it most resembles is not a conformance suite; it is a dialect checker. It validates a server against the behavior of one client, the largest one in the market, and its checks are a documented subset of RFC 7644's surface. A green run is neither necessary nor sufficient for SCIM conformance in general; it is evidence about the client that will actually call the server in production.
The mental model matters because the two failure classes look identical in the UI. A failed validation can mean the server is wrong against the RFC, or that the server is right against the RFC and wrong against Entra's dialect (capitalized ops, string booleans, the joining-property filter). Reading failures through the dialect lens first is the faster path in both cases; the error decoder on this lab-site maps scimType values to the RFC semantics behind them.
Microsoft documents ten validations (validator tutorial, updated 2026-08-29, accessed 2026-11-01). Every verification step in every one of them is a filtered GET on the joining property, which makes the eq filter the load-bearing feature of the whole run:
| Validation | What it exercises |
|---|---|
| Create New User User operations | POST /Users, expect 201 with the created id in the response; then a filtered GET on the joining property must return the user with matching values; DELETE cleanup only where hard delete is supported. |
| Create Duplicate User User operations | the identical POST twice: 201 on the first, 409 on the second. |
| Add Attributes User operations | POST, then PATCH with an add operation for non-required attributes, then a filtered GET to verify. |
| Replace User Attributes User operations | POST, then PATCH with replace, then a filtered GET to verify. |
| Update Joining Property User operations | POST, then PATCH the joining property itself, then a filtered GET on the new value. |
| Update Active Attribute to False User operations | POST, then PATCH active=false, then a GET confirming the stored record. |
| Create New Group Group operations (Enable Group Tests) | POST /Groups, expect 201 with the id; filtered GET verifies; DELETE cleanup where supported. |
| Create Duplicate Group Group operations (Enable Group Tests) | 201 then 409 on the identical create. |
| Update Group Attributes Group operations (Enable Group Tests) | POST, then PATCH replace on non-member attributes, then filtered GET. |
| Create a New Group Resource (membership) Group operations (Enable Group Tests) | POST the group, POST the member user, then PATCH the group with an add on members. |
What the tool does not exercise follows from the list: PUT replacement, soft-delete restore, pagination, sorting, bulk, ETag conditional requests, POST search, and negative-response shapes beyond the duplicate 409 (validator tutorial, updated 2026-08-29, accessed 2026-11-01). Microsoft does not publish the validator's internal error taxonomy; a Microsoft answer on its own Q&A concedes as much: "There isn't comprehensive documentation on all errors that can be returned by the SCIM validator, as far as I know" (Microsoft Q&A answer, 2023-10-13).
The tutorial's known-issues list contains three entries, and two of them are cases where the tool itself produces a failure that says nothing about the server (updated 2026-08-29, accessed 2026-11-01):
Soft deletes. "Soft deletes (disables) aren't yet supported." A validation that deactivates and then expects the record to read back as deactivated can fail against a correct implementation of the soft-delete model the rest of Microsoft's documentation prescribes.
Time zones. "The time zone format is randomly generated and fails for systems that try to validate it." The generated value can be one the server correctly rejects under its own timezone rules; the failure names the server, but the generator produced the value.
The third entry is a fail-then-ignore: the remove operation "may attempt to remove mandatory/required attributes for certain systems. Such failures should be ignored." Reading the three together is the practical skill: a red result is the start of a lookup, not the end of the analysis, and Microsoft's undocumented error taxonomy is the reason the lookup has to reach the RFC text.
The validator is the while-building tool. Gallery onboarding is a different gate with different rules (Microsoft's gallery validation documentation, updated 2026-09-11, accessed 2026-11-01): the tutorial is explicit that publishing to the App Gallery requires running "the Azure Logic Apps validation template and submitting the results". The template runs 25 tests (7 user, 7 group, 11 SCIM compliance) in 60 to 90 minutes, needs a bearer token valid for at least 24 hours, and reports into Microsoft through the Entra admin center.
Three differences carry real design weight. Authentication: publishing requires the endpoint to support "the OAuth 2.0 client credentials grant or workload identity federation"; non-gallery custom apps can run on a long-lived static bearer token pasted into the Secret Token field. Schema discovery: the validator offers a discover-schema mode, but the live provisioning service does not run schema discovery against custom non-gallery apps; discovery is the sole method for expanding a gallery app's schema, which makes it effectively a gallery feature. What passing means: the template's own exceptions mean "overallResult can read Failed even when your integration is ready to submit"; the individual test results, including the skipped and warning rows, are the real report.
The gallery documentation also ships an SCIM onboarding agent: "an instruction file that any AI coding agent can run. You supply the agent host and model; Microsoft supplies the agent" (updated 2026-09-11). The agent deploys the validation template, runs the tests, diagnoses failures, and retries the fixable ones; the same repo carries a validation checklist for agent-driven runs.
The wizard's flow is three steps: select a testing method, configure it, validate (updated 2026-08-29, accessed 2026-11-01). The mechanics that decide the run's quality:
Three entry modes. Default attributes (system-provided, then hand-edited), discover schema (the tool calls the endpoint's /Schemas and learns the attributes; the tutorial recommends it "as it reduces the overhead of updating your app as you build it out"), or upload a schema exported from an Entra sample app. Enable Group Tests is an opt-in checkbox; group validations do not run without it.The joining property is chosen per resource type for users and groups, defined as "an attribute that user and group resources can be uniquely queried on at the source and matched in the target system". It is the matching key from the primer wearing the validator's name, and every verification GET in the run filters on it.
Value expressions regenerate per run: {%generateRandomString 6%}@contoso.com produces a fresh random local part each pass, alongside generateRandomNumber, generateAlphaNumeric, andgenerateAlphaNumericWithSpecialCharacters. They exist for the duplicate-409 test specifically: the Create Duplicate User validation needs two POSTs whose payloads are identical to each other, and a fresh generated value each run keeps consecutive runs from colliding with leftovers in the store. A literal address reused across runs 409s on the first create of the second run, which reads as a failure of the wrong thing.
| Tool | What it checks | How it runs | Status |
|---|---|---|---|
| scim2/test-suite | black-box compliance from RFC 2119 requirements extracted out of RFC 7642/7643/7644; discovers capabilities via /ServiceProviderConfig and /ResourceTypes; optional features run in soft mode | downloadable Go test binary against any URL; compliance report as text, JSON, or an interactive HTML view with the RFC text side by side | self-labeled "Initial Draft"; no releases; last push 2026-03-28 (GitHub API, 2026-11-01) |
| SCIM Sandbox | suite groups A1-A9: discovery, schema, user CRUD, PATCH, filtering/pagination/sorting, group lifecycle, bulk, security and robustness, negative cases; capability discovery with override flags | hosted (Server Manager, Compliance runner, request Playground) and as a Maven library runnable in CI | active (v0.0.5, 2026-10-11; pushes through 2026-10-30); caveat from its own landing page: "SCIM request and response payloads are stored without redaction for debugging. Use this as a development sandbox, not a hardened production service" |
| Microsoft Entra SCIM Validator | compatibility with the Entra ID SCIM client: the ten documented validations above | hosted interactive wizard at scimvalidator.microsoft.com, endpoint URL + token driven | maintained; validator and build docs updated 2026-08/09; dialect checker, not a conformance suite |
| Azure Logic Apps gallery template | 25 tests across user provisioning, group provisioning, and SCIM compliance; detects supported features and skips non-applicable ones | Azure-hosted automated run (60-90 minutes, bearer token valid at least 24 hours); results submitted through the Entra admin center; drivable by the SCIM onboarding agent file | the gallery-onboarding check; template code in the MIT-licensed AzureAD/SCIMReferenceCode repo (pushed 2026-10-28) |
| Okta SCIM test suites | SCIM 2.0 and 1.1 CRUD test files (create/read/update/deactivate) plus the OIN manual QA suite | JSON files imported into Runscope (commercial); the Provisioning Connector SDK ships scim-sdk-tests.jar for method-by-method CLI runs | test files free, formats stable for years; Runscope is a commercial service |
| scim.dev SCIM Verify | practical SCIM 2.0 checks: create, update, patch, delete on users and groups; YAML-configurable | hosted at scim.dev/verify (login required); an OSS sibling, scimverify, runs as an npm CLI | hosted tier is commercial; CLI is GPL-3.0 (npm 1.0.5, 2025-10-22) |
The reading of the table: conformance running is served, generically thin. Requirement-mapped open coverage is one stalled suite; the most active generic entrant is at v0.0.5; the vendor suites are production-grade for their own dialects and silent about everyone else's. A server built against the checklist below passes the parts all of them share.
| Rule | Why | Source |
|---|---|---|
| TLS 1.2, and only TLS 1.2 | "The only acceptable protocol version is TLS 1.2. No other SSL/TLS version is permitted," with an exact cipher-suite floor, on Entra connections. | Entra provisioning tutorial, ms.date 2026-09-15 |
| Answer within 60 seconds | "Ensure that your server responds within 60 seconds of a request to prevent Okta from closing the socket connection." Slow cold starts read as outages. | Okta SCIM FAQs, accessed 2026-11-01 |
| Send Retry-After as integer seconds | Okta's client honors the header only when it carries integer seconds; an HTTP-date (valid per HTTP) or a missing header defaults to a 5-minute wait, the wait doubles per failure, and after 10 attempts the task fails permanently. | Okta SCIM concepts, accessed 2026-11-01 |
| application/scim+json on every response | "The header for all the responses should be of content-Type: application/scim+json," and every returned resource carries an id. | Entra provisioning tutorial, ms.date 2026-09-15 |
| Do not require case-sensitive PATCH op values | Entra emits the op values capitalized (Add, Replace, Remove); the matching rule is "Don't require a case-sensitive match on structural elements in SCIM, in particular PATCH op operation values." | Entra provisioning tutorial, ms.date 2026-09-15 |
| Store values verbatim; never send nulls | "Values sent should be stored in the same format they were sent"; the client side of the same contract is "If a value isn't present, don't send null values." Value transformation breaks the client's verification reads. | Entra provisioning tutorial, ms.date 2026-09-15 |
The PATCH builder on this lab-site rehearses the op matrix and the Entra default-mode shapes against sample resources, and the filter playground evaluates the eq-on-joining-property query the validator's verification steps depend on.
The suites above all need an endpoint to point at. Flexi-SCIMserves an on-demand SCIM server for exactly that: bring up a server, point a conformance suite or a client integration at it, and exercise requests without standing up infrastructure. Itsapp page on this site documents the requests; the hosted service lives at flexi-scim.etelej.com. This guide references the app and does not wire to it; a live playground integration is future work in its own right.
Normative - the documents this page's cites resolve to:
- RFC 7644: SCIM Protocolthe standard the dialect is measured against; retrieved 2026-11-01
Secondary - the validator, gallery, and provider documentation:
- Microsoft Entra SCIM Validatorthe tool and its landing-page contract, retrieved 2026-11-01
- SCIM Validator tutorialentry modes, joining property, expressions, the ten validations, known issues; updated 2026-08-29, accessed 2026-11-01
- Gallery validation documentationthe Logic Apps template, the OAuth and workload-identity bar, overallResult semantics, the onboarding agent; updated 2026-09-11, accessed 2026-11-01
- Entra provisioning tutorialthe build-doc rules in the checklist; ms.date 2026-09-15
- Okta SCIM concepts and FAQsthe 60-second window and Retry-After parsing rules; accessed 2026-11-01
- Microsoft Q&A on validator errorsthe undocumented error taxonomy concession, answer dated 2023-10-13
Prior art - the rest of the landscape table, each dated in place:
- scim2/test-suite, SCIM Sandbox, scim.dev, Okta SCIM test guide, AzureAD/SCIMReferenceCodeactivity and status from the GitHub/npm survey behind this lab-site, 2026-11-01; the SCIM Sandbox storage caveat is quoted from its own landing page
- Flexi-SCIMthe on-demand test server, public identity only