SCIM user create failed" mutability attribute not supported
Fixes SCIM user-create failures caused by read-only attributes by reading the target app's schema and removing those attributes from the Okta mapping. Use when the target rejects an attribute as not mutable. Not for 409 duplicates or missing required fields.
TL;DR
The target app marks some SCIM attributes readOnly, and Okta tried to write one. Read the app's schema, find the readOnly attributes, and remove them from the Okta provisioning mapping.
"SCIM user create failed" mutability attribute not supportedUse this when
- SCIM create fails and the error mentions mutability, readOnly, or an attribute not being supported.
- The default Okta mapping was never customized for this app.
- Create fails but the schema looks right at first glance.
Not for this skill when
- The error is a 409. That is a duplicate, not mutability.
- A required field is missing. That is the opposite problem: add a mapping.
- The connector cannot authenticate at all. Fix credentials first.
Steps
- Fetch the app's SCIM schema for the User resource and list every attribute marked readOnly. Verify: you have the authoritative list.
- In Okta, open the app's Provisioning settings and then the To App attribute mapping. Verify: you can see each mapped attribute.
- Unmap or drop each readOnly attribute from the mapping. Common culprits are id, meta, and groups on some apps. Verify: no readOnly attribute remains mapped.
- Force a single-user push to test. Verify: the create succeeds.
- Re-enable scheduled provisioning. Verify: the next cycle is clean.
Variant phrasings
SCIM 400 mutability
The status-first phrasing.
"attribute is read only" SCIM
The message-first search.
Okta mapping readOnly error
The cause-first phrasing.
Compatibility: Okta SCIM 2.0 provisioning, Classic and Okta Identity Engine. ReadOnly sets vary by target app.
Why it happens
SCIM defines mutability per attribute, and Okta's default mapping is generous: it includes attributes many apps refuse to accept on write. The app rejects the whole create over one readOnly field.
Edge cases / pitfalls
- Some apps accept an attribute on update but not on create; the mapping may need a create-only exclusion.
- Enterprise schema extensions carry their own mutability flags that the base schema does not show.
- Removing the groups attribute from the mapping can break group push for that app; check before dropping it.
- Apps that document an attribute but reject it anyway: trust the live behavior, not the docs.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_1A1rCQeBKGkp1dzswBpUxg