## TL;DR
Add a stable, non-empty externalId to every create the source sends. Find which source attribute should carry the externalId, usually the immutable HR employee id, map it in the provisioning configuration, backfill it for users already in flight, and confirm the target schema really requires it. Then re-run one create and check the stored externalId in the target before resuming the full sync.

```text
required attribute externalId is missing
```

## Use this when
- Target SCIM logs reject creates because the required attribute externalId is missing.
- Users whose source records lack an employee id fail while fully populated users succeed.
- A new target app or a stricter schema validation was recently enabled.

## Not for this skill when
- The missing attribute is optional in the target schema and creates succeed. No action is needed.
- The failure is an authentication rejection. Resolve credentials before schema work.

## Steps
1. Open the target SCIM service schema or its provisioning documentation and confirm externalId is required on create, noting its format rules such as maximum length or character set. Then capture one failing create payload from the source provisioning logs to confirm the field is absent rather than empty or misnamed. Verify: the payload truly omits externalId and the schema truly requires it
2. In the source identity system, choose the canonical value: an immutable employee id or directory object id that never changes on rename, transfer, or rehire. Reject email or username as the value because both change and would break the link the externalId exists to preserve. Verify: the chosen attribute is populated and stable for a sample of active users
3. Open the provisioning attribute mapping, add or correct the mapping from the chosen source attribute to the target externalId, and set the mapping to apply on create and update with a flow that never sends a blank. If the platform supports it, mark the attribute as a matching identifier with the agreed precedence. Verify: the saved mapping shows the source, target, and apply rules as intended
4. Backfill the in-flight population: find hires whose source records lack the chosen identifier, fix those HR or directory records first, and confirm no active user still produces a blank value. A mapping alone cannot fix empty source records and the failures will simply continue for that subset. Verify: a report of active in-scope users with a blank identifier returns zero rows
5. Provision one previously failing user on demand, then read the created resource in the target and confirm the stored externalId equals the source value exactly. Create a second test with an update to confirm the value stays stable and is not overwritten by a blank on later cycles. Verify: the target resource holds the correct externalId after both create and update
6. Resume the full sync and monitor the first cycles for the same schema rejection, then document the canonical identifier choice in the provisioning design notes so future app onboardings map it from day one. Verify: no externalId rejections appear in the resumed cycles

## Why it happens
SCIM targets use externalId as the durable correlation key between their resource and the source system record. Some services enforce it as required because without it they cannot safely match updates, deletes, or reactivated accounts. Sources omit it when the mapping was copied from an app that did not need it, or when the underlying HR identifier is blank for a worker class such as contingent staff. Sending a stable value on every create satisfies the schema and gives both sides a permanent join key for all later lifecycle operations.

## Variants and edge cases
### externalId present but still rejected
An empty string or whitespace value fails required checks just like an absent field. Trim the source value in the mapping expression and reject blanks at the HR record level.

### Two sources write different externalId values
When both an HR feed and a directory sync write the attribute, pick one owner and disable the other mapping, otherwise the value oscillates and matching breaks intermittently.

### Target requires externalId only for a user class
Guest or service accounts created outside the HR flow may need a generated identifier from the provisioning tool itself. Supply a prefixed object id for that class and document the exception.

Compatibility: Applies to SCIM 2.0 provisioning from Entra ID, Okta, and similar sources to SaaS targets that enforce the core user schema. Based on the SCIM core schema specification.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rm8l9LnCfweGKbknJFXt_w