Frequently asked questions
Frequently asked questions about the common issues and limitations of the directory sync providers.
Which SCIM version does Ory Polis support?
Ory Polis supports SCIM 2.0.
Why don't I see any event when a group is removed in OneLogin?
It is a known issue with OneLogin SCIM. OneLogin does not dispatch a specific deprovisioning event for groups that are deleted, so
you won't see any event such as group.deleted or group.user_removed when a group is removed. It is recommended to remove the
users from the group before deleting the group itself from the SCIM application.
Why don't I see a user.deleted event when a user is removed?
Okta and Microsoft Entra ID don't send a DELETE request when a user is removed from the application. They set the active
attribute to false instead, so the change reaches your webhook as a user.updated event. Treat active set to false as a
deprovisioning signal. See the Okta and
Entra ID provisioning
documentation.
Entra ID sends this disable when a user is unassigned from the application, goes out of scope, or is soft-deleted in the
directory. It sends a DELETE request, which reaches your webhook as user.deleted, when the user is permanently deleted —
automatically 30 days after a soft delete, or immediately when an administrator purges the user. If the user was unassigned first,
Entra ID stops managing them and sends no further event when they are deleted later.
Why is there no event for a user that was deactivated in Okta?
Okta does not dispatch a specific deprovisioning event for users that are suspended. This omission of a deactivation event is a known issue with Okta.
Does Google Workspace sync in real time?
No, Google Workspace sync is not real-time. Ory Polis syncs the Google Workspace directory on a schedule (e.g. every 2 hours). In a self-hosted deployment, you can configure a cron job to sync the directory on a schedule of your choice.
Can I sync specific groups from Google Workspace?
Not possible at the moment. Ory Polis syncs all the groups from Google Workspace. You have to filter the groups from your application's side.
How frequently does Microsoft Entra ID SCIM perform sync by default?
Microsoft Entra ID automatically provisions and updates user accounts in an app based on things like user and group assignment. The sync happens at a regularly scheduled time interval, typically every 20-40 minutes. Read More
Why does the PATCH request fail in Microsoft Entra ID SCIM?
This is a known issue with Entra ID SCIM implementation. You have to add the query param ?aadOptscim062020 to the SCIM endpoint
URL to make PATCH requests work. This query param update PATCH behavior and ensure SCIM compliance.
Read More