Skip to main content

v26.3.12

v26.3.12​

Return the SCIM manager attribute in its complex form​

The SCIM endpoint returned the enterprise extension's manager attribute exactly as the identity provider sent it. Microsoft Entra ID sends the manager's user id as a bare string, so a user with a manager assigned came back as:

"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
  "manager": "61bb1e4c-a894-4899-be23-6de941710dbf"
}

RFC 7643 section 4.3 defines manager as a complex attribute, and the Entra ID provisioning client refuses to read that response back. Every user who had a manager assigned failed to provision with SystemForCrossDomainIdentityManagementServiceIncompatible, while users without a manager synced normally.

SCIM responses now return manager as a complex attribute:

"manager": { "value": "61bb1e4c-a894-4899-be23-6de941710dbf" }

Affected users provision on the next sync cycle with no reconfiguration, including users already stored before this release.

Only the SCIM response is normalized. The stored user attributes, the raw attributes on user.created, user.updated and user.deleted webhook events, and the directory sync API all keep the shape the identity provider sent, so no change is needed in your application.