SCIM provisioning error 409 conflict on user create: troubleshooting Entra ID

TL;DR

Treat the 409 as a matching failure, not a network failure. In Entra ID provisioning logs, find the conflicting identifier the target SCIM service already holds, compare the source anchor and target matching attributes, then either link the existing SCIM user or correct the duplicate source value and restart provisioning for that user only. Do not bulk restart the whole job until one user provisions cleanly end to end.

SCIM provisioning error 409 conflict on user create

Use this when

• Entra ID provisioning logs show a 409 on a POST to the Users endpoint for one or a few users.
• The same users succeed on read or search but fail on every create attempt.
• The target app was pre-seeded, migrated, or already holds accounts from another identity provider.

Not for this skill when

• Every request returns 401 or 403. That is a credential or permission problem, not a 409 matching problem.
• The SCIM service itself is down for all tenants. Wait for the vendor incident to clear first.

Steps

1. Open Microsoft Entra admin center, go to Identity, Applications, Enterprise applications, open the app, then Provisioning and Provisioning logs. Filter by the affected user and the failure timestamp and open the step details to see the identifier Entra sent and the response body from the SCIM service. Verify: the log entry shows a create step with status conflict and names the matching value
2. Query the target SCIM service Users endpoint with a filter on that userName and on the matching email, including inactive users, because most SCIM servers enforce uniqueness across soft-deleted records too. Record the existing resource id and its externalId if one is present. Verify: the query returns the single conflicting resource or proves the conflict is on a different attribute
3. In Entra, open the app Attribute mapping page and note which source attribute maps to userName and which attribute is marked as the matching identifier with its precedence. Compare those values with the HR source record for the hire and look for case differences, trailing spaces, or a reused employee number. Verify: you can name the exact attribute whose value collides
4. If the existing SCIM account belongs to the same person, set its externalId to the source anchor value Entra expects, or correct the source value to the agreed unique key, then save the mapping. If the account belongs to someone else, fix the duplicated source value in the HR system instead of touching the stranger account. Verify: source and target unique values now agree for the same person
5. Use Provision on demand for that single user, watch each step from export through create or link to completion, and confirm the target now shows one active resource tied to the correct anchor. Only then restart the full provisioning job so the remaining queue flows with the fixed rule. Verify: on-demand provisioning reports success and no new 409 appears for that user
6. Add a pre-hire uniqueness check to the onboarding checklist, searching the target app for the planned userName and email before the first sync runs. This catches vendor pre-created accounts and rehires before Entra attempts a conflicting create. Verify: the checklist step exists and a sample rehire is flagged before provisioning runs

Why it happens

SCIM servers return 409 when a create violates a uniqueness constraint, most often on userName or email. Entra decides to create when its matching query finds no target resource for the source anchor, which happens when the account was created outside Entra, the matching attribute changed, or the externalId link was never written. The create then collides with data the matcher could not see as linked. Repairing the match data or the link makes the next cycle take the update path, while blind restarts repeat the same create and the same conflict indefinitely.

Variants and edge cases

409 on email instead of userName

Some apps enforce unique emails across tenants or workspaces. If the hire used the same email at a contractor workspace, merge or rename the old account first, then re-run on-demand provisioning for the linked identity.

Conflict returns after the user is deleted in the target

Many SCIM services keep a tombstone for days and still enforce uniqueness. Wait for the purge window or restore and deactivate the tombstone, then link it, rather than creating around it.

Only contractor conversions conflict

Contractors often hold accounts under a vendor domain that later changes to the corporate domain. Update the matching attribute in both the HR record and the target account in the same change window so the matcher sees one continuous identity.

Compatibility: Applies to Microsoft Entra ID automatic provisioning to SCIM 2.0 gallery and non-gallery apps. Requires Application Administrator rights and read access to the target SCIM service.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst-Z3WsHDNtFJ3lfLr5kSRw