Microsoft Entra ID
ProvisioningCustomize Application Attributes
In brief
The documentation now states that null values are not sent by default. Clearing attribute values is available only in preview for API-driven inbound provisioning apps and isn’t supported for other provisioning scenarios.
What Entra admins need to know
Administrators must verify that their provisioning scenario supports this capability before relying on attribute clearing.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- The user is out of scope due to not meeting a scoping filter.
- The user is soft deleted in Microsoft Entra ID.
- The property
AccountEnabledis set to false on the user. Try to keep theIsSoftDeletedattribute in your attribute mappings. TheBy default, the Microsoft Entra provisioning service doesn'tsupportsend null values to target systems. Clearing attribute values is available in preview only for API-driven inbound provisioningnull values.apps. It isn't currently supported for other application provisioning scenarios or for inbound provisioning from Workday or SAP SuccessFactors. To enable this feature for API-driven inbound provisioning apps, see Clear attribute values (Preview).- They primary key, typically
ID, shouldn't be included as a target attribute in your attribute mappings. - The role attribute typically needs to be mapped using an expression, rather than a direct mapping. For more information about role mapping, see Provisioning a role to a SCIM app.
- While you can disable groups from your mappings, disabling users isn't supported.
@@ -466,7 +466,7 @@ Selecting this option forces a resynchronization of all users while the provisio - The user is out of scope due to not meeting a scoping filter. - The user is soft deleted in Microsoft Entra ID. - The property `AccountEnabled` is set to false on the user. Try to keep the `IsSoftDeleted` attribute in your attribute mappings.-- The Microsoft Entra provisioning service doesn't support provisioning null values.+- By default, the Microsoft Entra provisioning service doesn't send null values to target systems. Clearing attribute values is available in preview only for API-driven inbound provisioning apps. It isn't currently supported for other application provisioning scenarios or for inbound provisioning from Workday or SAP SuccessFactors. To enable this feature for API-driven inbound provisioning apps, see [Clear attribute values (Preview)](clear-attribute-values.md). - They primary key, typically `ID`, shouldn't be included as a target attribute in your attribute mappings. - The role attribute typically needs to be mapped using an expression, rather than a direct mapping. For more information about role mapping, see [Provisioning a role to a SCIM app](#provisioning-a-role-to-a-scim-app). - While you can disable groups from your mappings, disabling users isn't supported.