Error when Provisioning from Entra ID: Resource already exists

SonarQube Cloud
1

Hi,

I seem to have a strange issue when setting up provisioning with Entra ID.

SSO and account provisioning works fine, but there is a problem with group sync.

In Entra provisioning logs I see this (email redacted):

User ‘my.email@company.com’ will be created in customappsso (User is active and assigned in Microsoft Entra ID, but no matching User was found in customappsso)

and then:

Failed to create User ‘my.email@company.com’ in customappsso; Error: StatusCode: Conflict Message: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the ‘Response’ property of this exception for details. Web Response: {“schemas”:[“urn:ietf:params:scim:api:messages:2.0:Error”],“detail”:“Resource already exists”,“status”:“409”,“scimType”:“uniqueness”}. This operation was retried 1 times. It will be retried again after this date: 2026-08-06T22:39:50.5168763Z UTC

Again, SSO works fine, groups themselves are being synced properly, my user gets added to some even, but not all, and I am seeing this error. I think my mappings are correct, but I am not an expert here.

Anyone seen this as well? Any ideas what might be wrong or how to debug it further?

Thanks!

2

One additional point of context: this issue is now having a direct operational impact on us.

While users are being provisioned into the correct SonarQube Cloud organisations, the corresponding group memberships are not being synchronised correctly. As a result, the expected administrative permissions are not being assigned, which currently leaves us unable to administer those organisations through the intended Entra ID provisioning model.

Given the impact on our ability to operate the platform, I wanted to highlight that this is now more than a configuration question from our perspective and is affecting production use of the service.

3

Looking at https://sonarcloud.io/api/users/current

{
  "isLoggedIn": true,
  "login": "First.Last-dlNqO@saml-redacted",
  "name": "First.Last",
  "email": "First.Last@company.com",
  "externalIdentity": "First.Last",
  "externalProvider": "sso",
  "scmAccounts": [],
  "groups": [
    "Members",
    "GroupFromIDP",
    "Members",
    "GroupFromIDP",
    "Members",
    "GroupFromIDP"
  ],
  "permissions": {
    "global": []
  },
  "avatar": "redacted",
  "settings": [
    {
      "key": "gitar.dismiss.promotion",
      "value": "1"
    },
    {
      "key": "notifications.readDate",
      "value": "1786033655140"
    }
  ],
  "createdAt": "2025-06-18T11:58:58+0000",
  "id": "redacted"
}

So my account is from some time last year, even though I deleted in the UI SonarQube Cloud

It looks like provisioning recreates or renames something as the “dlNqO” part in login is different from before I deleted the account, but it still has some older creation date. And only adds the user to the first group in SSO but not to any others.

Interesting.

4

It seems that my account sometimes loses org memberships until logging in again. So SSO works flawlessly, but provisioning is struggling.