# SCIM provisioning with Entra ID failing to sync groups – "Insufficient scope (need get:groups)" **URL:** \ **Category:** SonarQube Cloud\ **Tags:** sso\ **Created:** [March 10, 2026, 9:16pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377 "2026-03-10T21:16:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![andressantos10](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@andressantos10](https://community.sonarsource.com/u/andressantos10)\ **Post date:** [March 10, 2026, 9:16pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/1 "2026-03-10T21:16:28Z")
## ALM used Azure DevOps ## CI system used Azure DevOps Pipelines ## Languages of the repository Java, TypeScript and .NET ## Description We configured **Enterprise SSO (SAML)** and **SCIM provisioning** between **Microsoft Entra ID** and **SonarCloud**. SSO authentication works correctly and users can log in via the enterprise SSO link. SCIM provisioning connection tests also succeed on both sides. However, **group synchronization fails during provisioning cycles**. Users are provisioned successfully, but **groups fail to sync**. Example groups: ```auto grp_all@xxxxxx.com grp_corporate_sre_base@xxxxxx.com ``` These groups already exist in SonarCloud. Example: ```auto grp_all@xxxxxx.com Expected members: 269 Current members: 21 ``` ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/2/3/23622f57facfdf7778a0337d8d606a10705c1431.png) ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/7/4/7463ef6e7da0934354da1412d98afc7f512a77b8.png) ## Error observed Provisioning logs from Entra ID: ```auto EntrySynchronizationError Failed to match an entry in the source and target systems Group 'grp_all@xxxxxx.com' Resource: https://auth.sonarcloud.io/scim/v2/connections//Groups?filter=displayName+eq+"grp_all%40xxxxxx.com" Response Status Code: 403 Response Content: { "got":["get:users","post:users","put:users","patch:users","delete:users"], "need":[{"selection":["get:groups"]}], "detail":"Insufficient scope", "status":"403" } ``` Provisioning job details: ```auto Provisioning interval: 40 minutes Users in scope: ~290 Current cycle status: Initial sync paused ``` ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/5/9/59adc61dea7f6bb4a40ed367e79fcb9d960e3d9f.png) ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/2/9/29311338a46ed548d93eb5032e485ef4391a178c.png) ## Steps to reproduce 1. Configure SAML SSO between Entra ID and SonarCloud. 2. Configure SCIM provisioning using the bearer token generated in SonarCloud. 3. Enable automatic provisioning in Entra ID. 4. Assign users and groups to the Enterprise Application. 5. Wait for the provisioning cycle. Result: - Users provision successfully. - Groups fail with `Insufficient scope`. ## Potential workaround attempted We regenerated the SCIM bearer token in: ```auto SonarCloud Enterprise SSO & Provisioning Configure Provisioning ``` Then updated the token in Entra ID provisioning settings. The error persists. ## Additional question During the **first SSO login** , SonarCloud requires **email verification with a code**. In our Entra ID tenant, some users are **contractors who authenticate in our tenant but do not have a mailbox**. Because of this they cannot receive the verification code. Is it possible to **disable the first login email verification** for Enterprise SSO users? * * * If anyone has faced a similar SCIM groups provisioning issue with SonarCloud + Entra ID, any guidance would be appreciated. ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/7/b/7b5bca18e2f9b53b7d38b86f289e3d3b425f14d8.png) ---
**Author:** ![nour.zerhouni](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/nour.zerhouni/32/50665_2.png) [@nour.zerhouni](https://community.sonarsource.com/u/nour.zerhouni)\ **Post date:** [March 12, 2026, 4:23pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/3 "2026-03-12T16:23:29Z")
Hello @andressantos10, Thank you for reaching out, we’re glad to see that you are using SCIM! SCIM functionality is currently in Beta and only supports deprovisioning. We will be opening the Alpha access to the full provisioning soon. If you’d like to try it out early, feel free to reach out and provide you enterprise ID and I’ll be happy to provide access for you. ---
**Author:** ![andressantos10](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@andressantos10](https://community.sonarsource.com/u/andressantos10)\ **Post date:** [March 12, 2026, 4:57pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/4 "2026-03-12T16:57:24Z")
I send a directly message to include my org in the Alpha test. And I new issue to recreate SSO config “conflict occurred while creating the connection. Please request a new ticket..” ---
**Author:** ![andressantos10](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@andressantos10](https://community.sonarsource.com/u/andressantos10)\ **Post date:** [March 12, 2026, 6:00pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/5 "2026-03-12T18:00:04Z")
Now, I’ve the message error after SSO login ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/f/4/f44d4ca5806881dab94c6a9a13b0c4aea10baf8a.png) ---
**Author:** ![andressantos10](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@andressantos10](https://community.sonarsource.com/u/andressantos10)\ **Post date:** [March 12, 2026, 11:02pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/6 "2026-03-12T23:02:57Z")
Resolved. The `email` attribute was incorrectly written as `user.email`. The correct attribute is `user.mail`. ---
**Author:** ![Sarath\_Nair](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sarath_nair/32/37788_2.png) [@Sarath\_Nair](https://community.sonarsource.com/u/Sarath_Nair)\ **Post date:** [March 13, 2026, 6:18am UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/7 "2026-03-13T06:18:15Z")
@andressantos10, Thanks for confirming. One way to catch this early is when you test the connection is the self-service page. You must see the `email` attribute in the response. If not, this would mean somethign wrong with your attribute mapping. Also as @nour.zerhouni said, please let us know if would like early access to the full provisioning flow. Cheers, Sarath ---
**Author:** ![andressantos10](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@andressantos10](https://community.sonarsource.com/u/andressantos10)\ **Post date:** [May 25, 2026, 9:53pm UTC](https://community.sonarsource.com/t/scim-provisioning-with-entra-id-failing-to-sync-groups-insufficient-scope-need-get-groups/179377/9 "2026-05-25T21:53:43Z")
Sorry about this delay on your message. We can enable this alpha test to enable SCIM with groups? Other question about this: - I created a new organization inside Enteprise org. \*\* org-xpto-adohas devops platform as Azure Devops \*\* org-xpto-gh has devops platform as Github Enterprise. I believe that, since SSO was created at the Enterprise level and all organizations are under Enterprise, both will automatically have the same permissions, regardless of the DevOps platform. Is that correct?