Overview
When utilizing SCIM with an enterprise connection where Azure AD is the Identity Provider, an inactive user in Azure AD should get blocked in Auth0, but the “blocked” field remains false in Auth0 even when the “active” field is false in Azure AD.
Applies To
- Azure AD Enterprise Connection
- SCIM
Cause
This is caused by having the “active” field passed as a string in Auth0 instead of a boolean type.
This is a known issue in Azure AD, documented in the following Microsoft article:
Solution
To resolve this issue, a query parameter should be added in the Tenant URL (in Azure AD) as documented in step six of Configure SCIM in Azure AD for OIDC Apps. The query parameter is: aadOptscim062020