Frequently asked questions
Frequently asked questions about the common issues and limitations of the directory sync providers.
Which SCIM version does Ory Polis support?
Ory Polis supports SCIM 2.0.
Why don't I see any event when a group is removed in OneLogin?
It is a known issue with OneLogin SCIM. OneLogin does not dispatch a specific deprovisioning event for groups that are deleted, so
you won't see any event such as group.deleted or group.user_removed when a group is removed. It is recommended to remove the
users from the group before deleting the group itself from the SCIM application.
Why don't I see a user.deleted event when a user is removed?
Okta and Microsoft Entra ID don't send a DELETE request when a user is removed from the application. They set the active
attribute to false instead, so the change reaches your webhook as a user.updated event. Treat active set to false as a
deprovisioning signal. See the Okta and
Entra ID provisioning
documentation.
Entra ID sends this disable when a user is unassigned from the application, goes out of scope, or is soft-deleted in the
directory. It sends a DELETE request, which reaches your webhook as user.deleted, when the user is permanently deleted —
automatically 30 days after a soft delete, or immediately when an administrator purges the user. If the user was unassigned first,
Entra ID stops managing them and sends no further event when they are deleted later.
Why is there no event for a user that was deactivated in Okta?
Okta does not dispatch a specific deprovisioning event for users that are suspended. This omission of a deactivation event is a known issue with Okta.
Does Google Workspace sync in real time?
No, Google Workspace sync is not real-time. Ory Polis syncs the Google Workspace directory on a schedule (e.g. every 2 hours). In a self-hosted deployment, you can configure a cron job to sync the directory on a schedule of your choice.
Can I sync specific groups from Google Workspace?
Not possible at the moment. Ory Polis syncs all the groups from Google Workspace. You have to filter the groups from your application's side.
How frequently does Microsoft Entra ID SCIM perform sync by default?
Microsoft Entra ID automatically provisions and updates user accounts in an app based on things like user and group assignment. The sync happens at a regularly scheduled time interval, typically every 20-40 minutes. Read More
Why does the PATCH request fail in Microsoft Entra ID SCIM?
This is a known issue with Entra ID SCIM implementation. You have to add the query param ?aadOptscim062020 to the SCIM endpoint
URL to make PATCH requests work. This query param update PATCH behavior and ensure SCIM compliance.
Read More
Why does my identity provider only sync the first few users of a directory?
Check which database engine you run. On DynamoDB a directory sync stops at DB_PAGE_LIMIT users or groups, which defaults to 50.
SCIM asks for each page by position with a startIndex, DynamoDB cannot skip to a position, and SCIM has no page token to use
instead, so every page an identity provider asks for returns the same first records. Use another database engine for directory
sync. On other engines a short sync is not caused by this limit.