Skip to content

Commit 7d1090f

Browse files
himanshusainigFAREAST\hsainiCopilot
authored
Update Standard Logic App setup instructions and add validation test overview (#134)
- Replace SetupLogicApp-Standard-Agent.md content with refreshed setup guide - Add SCIM-Validation-Test-Overview.md Co-authored-by: FAREAST\hsaini <hsaini@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent abcd6dd commit 7d1090f

2 files changed

Lines changed: 226 additions & 47 deletions

File tree

‎Microsoft.SCIM.LogicAppValidationTemplate/StandardLogicApp/SCIM-Validation-Test-Overview.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# SCIM Provisioning Validation — Test Overview
2+
3+
## Purpose
4+
5+
The SCIM Validation Logic App runs **22 automated tests** against an ISV's SCIM 2.0 endpoint to verify it is ready for publication in the Microsoft Entra app gallery. Tests cover the full provisioning lifecycle — user and group CRUD, attribute mappings, soft delete, provision-on-demand, direct SCIM compliance, and credential validation.
6+
7+
The Logic App is deployed as a Standard Azure Logic App with 5 workflows that execute in parallel, completing a full validation run in 30–60 minutes.
8+
9+
---
10+
11+
## Architecture
12+
13+
```
14+
Orchestrator_Workflow (entry point)
15+
├── Initialization_Workflow — reads sync schema, builds dynamic test bodies
16+
├── UserTests_Workflow — 7 tests (parallel with Group/SCIM)
17+
├── GroupTests_Workflow — 7 tests (parallel with User/SCIM)
18+
└── SCIMTests_Workflow — 8 tests (parallel with User/Group)
19+
└── Final_TestResults — aggregates 22 results, determines pass/fail
20+
```
21+
22+
**Dynamic capability detection:** The Initialization workflow reads the provisioning schema and automatically determines which tests apply based on the ISV's attribute mappings:
23+
24+
| Capability | How detected | Tests affected |
25+
|------------|-------------|----------------|
26+
| Group support | Group object mapping enabled in sync rules | 7 group-related tests |
27+
| Manager support | `manager` attribute in User mappings | User_Update_Manager_Test |
28+
| Soft delete support | `active` attribute in User mappings | Disable_User_Test |
29+
30+
Tests that don't apply are reported as **SKIPPED** (not failures).
31+
32+
---
33+
34+
## Test Inventory (22 Tests)
35+
36+
### User Provisioning Tests (UserTests_Workflow) — 7 tests
37+
38+
| # | Test Name | What It Validates |
39+
|---|-----------|-------------------|
40+
| 1 | **Create_User_Test** | Creates a user in Entra ID, triggers a provisioning cycle, and verifies the user appears on the SCIM endpoint via `GET /Users?filter=userName eq "..."`. Validates the full create pipeline: Entra → Provisioning Engine → SCIM POST /Users → verification. |
41+
| 2 | **Update_User_Test** | Modifies mapped attributes (e.g., jobTitle, department) on an existing provisioned user in Entra ID, triggers a sync cycle, and verifies the updated values are reflected on the SCIM endpoint via PATCH. |
42+
| 3 | **Disable_User_Test** | Sets `accountEnabled=false` on a provisioned user in Entra ID, triggers a sync cycle, and verifies the SCIM endpoint receives `active: false`. **Skipped** if the ISV's schema has no `active` attribute mapping. |
43+
| 4 | **Delete_User_Test** | Deletes a provisioned user from Entra ID, triggers a sync cycle, and verifies the user is removed from the SCIM endpoint (hard delete via DELETE /Users/{id} or soft delete depending on configuration). |
44+
| 5 | **User_Update_Manager_Test** | Assigns a manager to a provisioned user and verifies the SCIM endpoint receives the manager reference update. **Skipped** if the ISV's schema has no `manager` attribute mapping. |
45+
| 6 | **Restore_User_Test** | Validates the unassign → reassign lifecycle. Creates and provisions a user (Phase 1), unassigns the app role to trigger deprovisioning — verifies the user disappears from the SCIM endpoint (Phase 2), then reassigns the app role and verifies the user is re-provisioned (Phase 3). Checks whether the SCIM identity link is preserved across the cycle. |
46+
| 7 | **POD_User_Test** | Tests **Provision on Demand** — creates a user, assigns them to the app, calls the Graph `provisionOnDemand` API, and verifies the user appears on the SCIM endpoint without waiting for a full sync cycle. |
47+
48+
### Group Provisioning Tests (GroupTests_Workflow) — 7 tests
49+
50+
| # | Test Name | What It Validates |
51+
|---|-----------|-------------------|
52+
| 8 | **Create_Group_Test** | Creates a group in Entra ID, assigns it to the app, triggers a sync cycle, and verifies the group appears on the SCIM endpoint via `GET /Groups?filter=displayName eq "..."`. |
53+
| 9 | **Update_Group_Test** | Modifies group attributes (e.g., displayName) and verifies the change propagates to the SCIM endpoint. |
54+
| 10 | **Delete_Group_Test** | Removes a group and verifies it is deleted from the SCIM endpoint. |
55+
| 11 | **Group_Update_Add_Member_Test** | Adds a user as a member of a provisioned group and verifies the SCIM endpoint receives a PATCH with the member addition. Validates multi-member PATCH support. |
56+
| 12 | **Group_Update_Remove_Member_Test** | Removes a member from a group and verifies the SCIM endpoint receives the member removal PATCH. |
57+
| 13 | **POD_Group_Test** | Tests **Provision on Demand** for groups — creates a group, assigns it to the app, calls `provisionOnDemand`, and verifies the group appears on the SCIM endpoint. |
58+
| 14 | **Restore_Group_Test** | Unassigns a group from the provisioning app, triggers a sync cycle (group should be deleted from SCIM endpoint), then reassigns and re-provisions. Validates that the SCIM endpoint handles group re-creation correctly. Includes a 30-second delay before AppRole reassignment. |
59+
60+
> **Note:** All 7 group tests are **skipped** if the ISV's schema does not have an enabled Group object mapping.
61+
62+
### SCIM Compliance Tests (SCIMTests_Workflow) — 8 tests
63+
64+
| # | Test Name | What It Validates |
65+
|---|-----------|-------------------|
66+
| 15 | **Schema_Discoverability_Test** | Calls `GET /Schemas` on the SCIM endpoint and flattens the response into attribute name strings (e.g., `emails[type eq "work"].value`, `name.givenName`, `roles[primary eq "True"].value`). Compares against the target directory attributes from the provisioning job schema. Reports any missing attributes. Uses case-insensitive pipe-delimited matching. |
67+
| 16 | **SCIM_Null_Update_Test** | Sends a PATCH request that sets an attribute to `null` and verifies the SCIM endpoint handles null/empty attribute updates without error (HTTP 200). This is a common compliance gap. |
68+
| 17 | **SCIM_User_Create_Test** | Directly calls `POST /Users` on the SCIM endpoint (bypassing the Entra provisioning engine) with a well-formed SCIM user body built from the ISV's schema. Verifies HTTP 201 and a valid response body. |
69+
| 18 | **SCIM_User_Update_Test** | Directly calls `PATCH /Users/{id}` on the SCIM endpoint with attribute updates. Update values are auto-generated (`upd-{guid}`) unless overridden via `scimTargetUserValues[1]`. Verifies the endpoint accepts standard SCIM PATCH operations. |
70+
| 19 | **SCIM_Group_Create_Test** | Directly calls `POST /Groups` with a SCIM group body. **Skipped** if groups are not supported. |
71+
| 20 | **SCIM_Group_Update_Test** | Directly calls `PATCH /Groups/{id}` with attribute updates. **Skipped** if groups are not supported. |
72+
| 21 | **SCIM_User_Pagination_Test** | Ensures ≥11 users exist on the endpoint (creates throwaway users from `initializationData.scimUserBody` if needed), then paginates `/Users?startIndex=N&count=5` across multiple pages. Verifies `startIndex`, `totalResults`, and page traversal. Cleans up created users afterward. |
73+
| 22 | **Validate_Credentials_Test** | Tests the OAuth 2.0 Client Credentials flow — acquires a token from the ISV's token endpoint using client ID/secret, then validates the SCIM connection. **Skipped** when `scimTokenEndpoint` is empty (static bearer token setup). |
74+
75+
---
76+
77+
## Test Categories Summary
78+
79+
| Category | Tests | Exercises |
80+
|----------|-------|-----------|
81+
| **User Lifecycle** | 7 | Full CRUD + Manager + Restore + POD via Entra provisioning engine |
82+
| **Group Lifecycle** | 7 | Full CRUD + Membership + POD + Restore via Entra provisioning engine |
83+
| **SCIM Direct Compliance** | 7 | Direct HTTP calls to SCIM endpoint — schema, CRUD, null update, pagination |
84+
| **Credential Validation** | 1 | OAuth client credentials flow |
85+
| **Total Scored** | **22** |
86+
87+
---
88+
89+
## What "Passing" Means
90+
91+
| Scenario | Acceptable? |
92+
|----------|-------------|
93+
| All 22 tests: `success` | **Ready for gallery submission** |
94+
| Group tests: `SKIPPED` (no group mapping) | Acceptable if ISV only supports /Users |
95+
| Disable_User_Test: `SKIPPED` (no `active` mapping) | Acceptable — ISV should document |
96+
| Manager test: `SKIPPED` (no `manager` mapping) | Acceptable — ISV should document |
97+
| Validate_Credentials_Test: `SKIPPED` | Expected with static bearer token — no OAuth configured |
98+
| Schema_Discoverability_Test: `FAILED` with missing attrs | Must add missing attributes to `/Schemas` response |
99+
| Pagination tests: `FAILED` | Must implement pagination per RFC 7644 §3.4.2.4 |
100+
| Any test: `FAILED` | **Must fix before submission** |
101+
102+
---
103+
104+
## How to Run
105+
106+
### Method A: AI Agent (Automated, 30–60 min)
107+
Load `scim-onboarding.agent.md` into any AI coding agent (VS Code Copilot, Cursor, Claude Code, etc.) and send: *"Validate my SCIM integration."* The agent handles everything conversationally.
108+
109+
### Method B: Manual Setup (1–3 hours)
110+
Follow the step-by-step instructions in `SetupLogicApp-Standard-Agent.docx` to manually create resources, deploy the Logic App, configure parameters, and trigger tests.
111+
112+
Both methods produce the same output: a `validation-result-<RunId>.json` file to submit to Microsoft at [aaduserprovisioning@microsoft.com](mailto:aaduserprovisioning@microsoft.com).
113+
114+
---
115+
116+
## Key Onboarding Requirements Validated
117+
118+
- SCIM 2.0 user endpoint (group endpoint recommended)
119+
- Filter queries on matching properties return 200 (not 404)
120+
- Empty filter queries return 200 + empty results
121+
- Multi-member PATCH on /Groups (if groups supported)
122+
- ≥25 requests/second throughput
123+
- OAuth 2.0 Client Credentials for production (static token accepted for pilot)
124+
125+
---
126+
127+
*Document version: June 2026 — Covers Logic App validation template v4 with 22 tests across 5 workflows. Includes User Pagination, Restore tests, Schema_Discoverability_Test v2 with flatten loops, scimTargetUserValues, and Provision on Demand.*

0 commit comments

Comments
 (0)