We recently enabled SCIM provisioning for our SonarQube Cloud Enterprise after having SAML SSO already configured and working. Our existing users were created through SAML and were already using SonarQube Cloud successfully. After enabling SCIM, we observed the following behavior:
SCIM does not match the existing SAML users. - Instead, it creates a second account for the same person.
We now have duplicate accounts for several users.
Some users lost access to projects and existing analysis tokens stopped working with: "Not authorized or project not found.
SonarQube Cloud identifies an SSO user by the value your IdP sends as the SAML login attribute (NameID). SCIM matches on userName. If those two aren’t the exact same attribute, in the same format and case, we see two different people and create a second account.
The rest follows from that. SSO users get their permissions purely from group membership, and only reach an organization if they’re in a group inside it, so the duplicate account starts with nothing. And a token belongs to one account: your users are now authenticating as the new duplicate while the token still sits on the old account.
Could you go to your enterprise’s Administration > Single Sign-On (SSO) page and check the attribute mapping there against what your IdP sends for SCIM userName? That’s where the mismatch will show up.
If the mapping already lines up and you still get duplicates, come back with the raw SAML assertion and SCIM payload for one affected user plus timestamps, and we’ll dig in.
Funnily, we have a similar but exactly opposite issue: SCIM does not create some users because they already exist. Same outcome, though: users lost access to projects. @Guillaume_Peoch could this be related? Or just a coincidence?
I confirm that both the SAML NameID and SCIM userName are mapped to the userPrincipalName (UPN) in Microsoft Entra ID.
It is worth noting that since enabling SCIM provisioning, new users assigned to the access group can access SonarQube Cloud without any duplicate accounts being created.
The issue only affects existing users who were already members of the access group and had SAML accounts before SCIM was enabled. These users now have duplicate accounts following the activation of SCIM.
Additionally, since enabling SCIM, my account has lost its Enterprise Admin privileges, even though I had these permissions before. As a result, I can no longer access or manage the SSO and SCIM settings in SonarQube Cloud.
Could you please advise on how to resolve the duplicate account issue for existing users and restore my Enterprise Admin permissions?
Thanks for confirming the mappings. The duplicate accounts are due to a change in how users were identified when SCIM was enabled. Existing SAML accounts weren’t matched to the SCIM-provisioned ones.. The old accounts can no longer be used to sign in, so you can safely keep them. For affected users, generate new tokens and re-grant any permissions that were assigned directly (not through groups) on the account they now use.
If you’d rather remove the duplicates entirely, you could recreate the SSO connection and SCIM configuration. This is a broad reset, not just regenerating the SCIM token. Deleting SSO deletes all existing SSO users, so they can’t sign in until they get fresh accounts on their next sign-in, with no tokens or permissions. It also removes organization-to-group mappings, which must be configured again. Old accounts may still appear in user lists afterwards. Before proceeding, ensure you have non-SSO Enterprise Admin access and a non-SSO admin for every organization.
For Enterprise Admin access, are you signing in through SSO or with your DevOps (GitHub, GitLab, Bitbucket, or Microsoft) account? These are separate accounts, and admin permissions do not automatically carry over after setting up SSO. To grant Enterprise Admin access to your SSO account, sign in with the account that already has Enterprise Admin permissions, then go to Administration > Enterprise permissions and grant Administer Enterprise to your SSO account.
To clarify the situation regarding my Enterprise Admin access:
Initially, I was connecting to SonarQube Cloud using my Azure DevOps account and had Enterprise Admin permissions.
After configuring SAML SSO, I started authenticating exclusively through SAML and still had full Enterprise Admin access, including the ability to manage SSO settings.
It was only after enabling SCIM provisioning that I lost my Enterprise Admin permissions.
I can still access and administer the organization, but I can no longer access the Enterprise administration settings.
Could you please advise how I can restore my Enterprise Admin permissions on my current SSO account