Discussion: Understand Impacts of Deleting Unconfirmed Users on SCIM Process

Background

We recently introduced a feature which deletes unconfirmed users if they are not confirmed within a certain pre-defined interval.

This created an issue with SCIM (for users without verified domains) because once a user is provisioned via SCIM, it remains unconfirmed. The automatic deletion then occurs, and then the customers are forced to re-provision. It is not clear what caused the deletion due to lack of audit event. SCIM does not automatically reprovision unconfirmed users (to be confirmed - this is an assumption).

This is causing an increased support burden and a poor customer experience.

References

Slack thread

Automatically delete unverified unconfirmed use... (#352514 - closed)

Add audit event for group member removal becaus... (#422582 - closed)

https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users

Goal of this issue

Discuss the following:

• How can we get ahead of this issue - is the change to 3 days enough?
• What are the tradeoffs/negatives for trading the confirmation from 1 day to 3?
• Does SCIM not auto-reprovision once the account is deleted?