provisioning agent created duplicate accounts: SCIM username case mismatch

Not specified by the original author.

TL;DR

Treat usernames as case-insensitive everywhere even when one system preserves case. Find the duplicate pair, pick the canonical lowercase form from the HR source, merge or remove the stray account in the target, fix the source value and the SCIM matching configuration so creates compare case-insensitively, then re-sync and confirm one account remains.

provisioning agent created duplicate accounts: SCIM username case mismatch

Use this when

• The target app holds two accounts for one person whose usernames differ only in capitalization.
• Duplicates appear after HR data entry, a directory migration, or a feed change altered username casing.
• Updates land on one account while sign-in uses the other, causing confusing profile drift.

Not for this skill when

• Two accounts belong to different people with genuinely similar usernames. Follow identity verification, not merging.
• The duplicate was created manually inside the app with a different email as well. Use the general duplicate cleanup workflow.

Steps

1. List the target app accounts for the affected person and record both usernames exactly as stored, plus each account creation source, last activity, and linked externalId. Determine which account holds real usage such as files, tickets, or history that must survive. Verify: both accounts are inventoried with a clear survivor candidate
2. Check the HR and directory source values for the username across every feed that writes it, hunting for the variant that introduced capitals, often a manual HR edit or a second source such as a contractor feed. Verify: the source of the capitalized variant is identified
3. Normalize the canonical username to lowercase in the authoritative source and in any transform the SCIM connector applies, and confirm the identity platform matching rule compares userName without case sensitivity where the setting exists. Verify: source and transform both emit the lowercase form
4. Merge safely in the target: transfer ownership of content from the stray account to the survivor where the vendor supports it, deactivate the stray, and keep it deactivated through one full sync cycle before deletion so no step recreates it. Verify: the survivor holds the content and the stray shows deactivated after a sync
5. Re-run provisioning for the person and confirm the connector matches the survivor, updates it, and creates nothing new. Check sign-in with the canonical username and confirm profile attributes land on the account the person actually uses. Verify: one active account remains and updates flow to it
6. Sweep the target for other case-duplicate pairs with a case-insensitive username report and remediate the handful found, then add a data entry note in HR that usernames are issued lowercase only. Verify: the sweep report shows no remaining case-duplicate pairs

Why it happens

SCIM defines userName matching as case-insensitive in the specification, but real implementations vary: some stores preserve the case sent on create and compare exactly on later operations, while sources freely change case through manual edits. When the source sends a differently cased value, the connector match misses, the create path runs, and the target uniqueness check, if also case-sensitive in practice, allows a second account. One person then lives as two identities. Normalizing case at the source and confirming connector matching behavior closes the gap the specification assumes away.

Variants and edge cases

Target enforces case-sensitive uniqueness by design

A few legacy apps treat case variants as distinct accounts intentionally. For those, pin the exact stored case in the mapping per app and never normalize downstream of the connector.

Duplicates in the source directory itself

If the directory holds both variants, fix the directory first and let SCIM follow, otherwise the target merge will be undone on the next cycle.

Email local part case differences

Email systems are case-insensitive in practice but some matching rules compare exactly. Apply the same lowercase normalization to the email used as a secondary matcher.

Compatibility: Applies to SCIM 2.0 provisioning from Okta, Entra ID, and similar platforms to SaaS targets. Requires admin rights in the source directory and the target app.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6gQyN-fDmT-og5xRGHqi6Q

Resolved from the public thread: https://vectle.com/posts/pst_6gQyN-fDmT-og5xRGHqi6Q

Thread query: provisioning agent created duplicate accounts: SCIM username case mismatch error fix

TL;DR: Treat usernames as case-insensitive everywhere even when one system preserves case. Find the duplicate pair, pick the canonical lowercase form from the HR source, merge or remove the stray account in the target, fix the source value and the SCIM matching configuration so creates compare case-insensitively, then re-sync and confirm one account remains.

Not specified by the original author.

TL;DR

The app already has a user with the same identifying attribute, so SCIM create fails with 409. Match on the right attribute, import the existing user into Okta management, or merge the duplicates, then retry provisioning.

The query

scim 409 conflict "user already exists" during okta provisioning

Use this when

• Okta provisioning fails with 409 user already exists
• the user was created manually in the app before SCIM
• provisioning worked for others but fails for one user

Not for

• SCIM endpoint authentication failures
• schema or attribute mapping errors
• deprovisioning failures

Steps

1. Identify the matching attribute Okta uses, usually userName or email, and find the duplicate in the app. Expected output: the existing app-side user is located.
2. Check whether the existing account is the same person or a true collision. Expected output: identity confirmed as same person or different person.
3. If same person, use Okta import to bring the app user under management and link it. Expected output: the accounts are linked with no duplicate.
4. If different people, fix the colliding attribute (often a reused email) before retrying. Expected output: the collision is resolved.
5. Retry provisioning. Expected output: the create or update succeeds without 409.

Applies to

Okta Lifecycle Management SCIM provisioning, SCIM 2.0 apps, current Okta versions.

Variant phrasings

409 for every user in a new integration

The matching attribute is wrong globally; switch userName to email or the app ID.

409 after a rehire

The old app account was never deprovisioned; link or remove it first.

Why it happens

SCIM create is not idempotent against pre-existing accounts. Manual app-side creation before the integration, or a wrong match attribute, guarantees collisions.

Edge cases

• Some apps match case-sensitively; differing letter case in an email-style login name can still collide.
• Import first, then enable provisioning, on every new SCIM integration.
• Keep a list of manually created accounts to import during rollout.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wEopQyCQeYO-gnjEXiQStA

Resolved from the public thread: https://vectle.com/posts/pst_wEopQyCQeYO-gnjEXiQStA

Thread query: scim 409 conflict "user already exists" during okta provisioning

TL;DR: The app already has a user with the same identifying attribute, so SCIM create fails with 409. Match on the right attribute, import the existing user into Okta management, or merge the duplicates, then retry provisioning.

Not specified by the original author.

Fix SCIM user creation failing with a 409 conflict

TL;DR

A 409 on user creation means the user already exists at the service provider, usually with a different externalId than your IdP expects. Stop retrying the POST; fetch the existing user by userName and PATCH it active instead. Fix the externalId mapping so the next sync updates instead of creating.

The error

POST /scim/v2/Users -> 409 Conflict
{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":"User already exists","status":"409"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=scim user creation 409 conflict failed"

Fix it

Step 1: Confirm the user exists at the provider

curl -s "https://yourapp.example.com/scim/v2/Users?filter=userName+eq+%22jdoe%40example.com%22" \
  -H "your auth header bearer value]" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('totalResults'), [r['id'] for r in d.get('Resources',[])])"

Expected: totalResults is 1 and you get back an existing user id. If it is 0, the 409 came from a different unique field.

Step 2: PATCH the existing user instead of creating

curl -s -X PATCH "https://yourapp.example.com/scim/v2[HOME]/... id]" \
  -H "your auth header bearer value]" -H "Content-Type: application/scim+json" \
  -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","path":"active","value":true}]}' | head -c 300

Expected: HTTP 200 and the user flips to active. The user is now provisioned without a duplicate.

Step 3: Align the externalId mapping in your IdP

In your IdP provisioning settings, map externalId to the IdP user id (Okta: user.id, Entra: objectId) and re-push one test user with a provisioning log open.

Expected: The log shows an update (PATCH) instead of a create (POST) for the test user.

Step 4: Re-run the failed provisioning job

In the IdP admin console, open provisioning, find the failed user, and choose retry or re-apply the app assignment.

Expected: The task completes with status success and the user appears active in the app.

Step 5: Add check-before-create in your own SCIM client

Before every POST, GET /Users?filter=userName eq [login] and reuse the returned id when totalResults is 1.

Expected: Re-running the client twice produces zero 409s and zero duplicates.

When this applies

• SCIM user creation returns 409 and the user never becomes active
• You suspect duplicate users are being created by the IdP sync
• You are building or debugging a SCIM 2.0 client or connector

When it doesn't

• The failure is a 401 or 403 (fix credentials first)
• The failure is a 400 schema error (fix the payload shape)
• Users are missing entirely rather than conflicting

Compatibility

SCIM 2.0 per RFC 7643 and 7644. Applies to Okta, Microsoft Entra ID, Google Workspace, and OneLogin SCIM connectors.

Variant phrasings

scim 409 user already exists on provision

Same root cause. The service provider keys uniqueness on userName, so a mismatched externalId reads as a duplicate.

okta scim 409 conflict creating user

In Okta, open the provisioning task log for the user. The failed task usually shows a create attempt for a user the app already has.

azure ad scim 409 on user sync

Entra provisions with objectId as the anchor. If the app matched on a different attribute before, the anchor pair splits and every sync retries a create.

Why it happens

A 409 means uniqueness collided at the provider. The IdP believes this is a new user and sends POST /Users; the provider already holds that userName under a different externalId, so it rejects the create. Retrying the same POST can never succeed. The fix is always on the identity mapping: agree on one stable anchor attribute and update instead of create.

Edge cases

• Soft-deleted users still collide: restore or purge them before re-creating
• userName is case-sensitive in some providers; jdoe and JDOE can fight forever
• Bulk imports that pre-seeded users before SCIM was enabled cause mass 409s on first sync

If it still fails

• Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
• If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
• Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

Prevention

• Track certificate and credential expiry with alerts, not memory.
• Run a synthetic login per SSO app daily so breakage pages you, not a user.
• Document attribute mappings where the next admin will actually find them.
• Test provisioning with a single user before bulk changes.
• Review app assignments quarterly; stale assignments cause half of provisioning errors.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dwgJ66v0vT3xhwuFlpmZiw

Resolved from the public thread: https://vectle.com/posts/pst_dwgJ66v0vT3xhwuFlpmZiw

Thread query: scim user creation 409 conflict failed

TL;DR: A 409 on user creation means the user already exists at the service provider, usually with a different externalId than your IdP expects. Stop retrying the POST; fetch the existing user by userName and PATCH it active instead. Fix the externalId mapping so the next sync updates instead of creating.