Microsoft Entra ID is deprecating OAuth 2.0 Authorization Code Grant for SCIM (System for Cross-domain Identity Management) provisioning applications. Organizations must identify affected apps and migrate them to OAuth 2.0 Client Credentials flow before the deprecation deadline.
This repository contains a PowerShell scanner script (Get-SCIMProvisioningAuthReport.ps1) that automates the detection of SCIM provisioning apps in your Entra ID tenant that still use the deprecated Authorization Code Grant flow.
Reference: Plan for change — Update SCIM provisioning applications to use modern authentication
SCIM provisioning in Entra ID supports two OAuth 2.0 authentication methods for connecting to third-party SaaS applications:
| Auth Method | Status | Description |
|---|---|---|
| Authorization Code Grant | User-delegated flow requiring interactive consent. Being phased out for SCIM provisioning. | |
| Client Credentials Grant | ✅ Recommended | Application-level flow using client ID/secret. No user interaction required. |
Apps using Authorization Code Grant will stop working after the deprecation date. Affected apps must be re-authorized using Client Credentials flow.
The scanner identifies apps based on their sync job template ID (run-profile tag). The following 25 gallery applications support OAuth 2.0 Authorization Code Grant for SCIM provisioning:
| Application | Run-Profile Tag |
|---|---|
| Google Workspace | GoogV2OutDelta |
| Zoom | zoom |
| Slack | slackOutDelta |
| GitHub | GitHubOutDelta |
| Box | BoxOutDelta |
| Dropbox | DropboxSCIMOutDelta |
| RingCentral | ringCentral |
| TravelPerk | travelPerk |
| Amazon Business | amazonbusiness |
| Facebook Work Accounts | facebookWorkAccounts |
| Vonage | vonage |
| Zoho One | zohoOne |
| Uber | uber |
| Gong | gong |
| LogMeIn | logMeIn |
| BPanda | bPanda |
| Atea | atea |
| SecureLogin | secureLogin |
| Puzzel | puzzel |
| ChatWork | chatWork |
| Swit | swit |
| Taskize Connect | taskizeConnect |
| Contentstack | contentstack |
| GoToMeeting | gotomeeting |
| Facebook Workplace | facebookWorkplace |
Note: If a SCIM provisioning app uses a template ID that is NOT in this list, it uses Bearer Token or Client Credentials and requires no action.
Install the Microsoft Graph PowerShell module:
Install-Module Microsoft.Graph.Applications -Scope CurrentUser -ForceThe scanning account or service principal needs the following Microsoft Graph permissions:
| Permission | Type | Purpose |
|---|---|---|
Application.Read.All |
Delegated or Application | Read service principal metadata and tags |
Synchronization.Read.All |
Delegated or Application | Read synchronization jobs and template IDs |
- You must have access to the target Entra ID tenant
- Global Reader, Application Administrator, or Cloud Application Administrator role is sufficient
- For multi-tenant scenarios, run the script in each tenant separately
Open a PowerShell 7+ terminal (or Windows PowerShell 5.1).
cd C:\path\to\SCIM-CodeAuthGrantDeprecation.\Get-SCIMProvisioningAuthReport.ps1A browser window will open for interactive sign-in to Microsoft Graph. Sign in with an account that has the required permissions.
The script will:
- Fetch all gallery service principals in the tenant
- Use batch Graph API calls (20 per batch) for performance
- Check each SP's synchronization jobs against the known Code Auth Grant template list
- Display a color-coded summary in the terminal
- Export a detailed CSV report to the current directory
=== SCIM Provisioning - OAuth 2.0 Code Auth Grant Scanner ===
Total Gallery SPs Scanned : 245
Total SCIM Provisioning Jobs Found : 12
Code Auth Grant Apps (Action Needed) : 3 ← RED if > 0
Other Auth Method Apps (No Action) : 9 ← GREEN
Apps listed under "ACTION REQUIRED" (in red) are using the deprecated Authorization Code Grant and must be migrated.
The script generates a timestamped CSV file:
SCIM_Provisioning_AuthMethod_Report_20260509_192345.csv
CSV columns:
| Column | Description |
|---|---|
DisplayName |
Service principal display name in Entra ID |
AppId |
Application (client) ID |
ObjectId |
Service principal object ID |
TemplateId |
Sync job template/run-profile tag |
AppTemplate |
Friendly application name |
JobStatus |
Current provisioning job status (e.g., Active, Quarantine) |
AuthType |
OAuth2 Authorization Code Grant or Other (Bearer Token / Client Credentials) |
IsCodeAuthGrant |
TRUE if the app uses the deprecated flow |
The scanner uses an optimized detection approach based on known run-profile tags rather than inspecting credential metadata:
- Fetch Gallery SPs — Queries all service principals tagged with
WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1 - Batch API Calls — Uses Microsoft Graph
$batchendpoint to check synchronization jobs for up to 20 SPs per request - Template Matching — Compares each sync job's
templateIdagainst the 25 known Code Auth Grant run-profile tags - Classification — Labels each app as either:
OAuth2 Authorization Code Grant→ Action requiredOther (Bearer Token / Client Credentials)→ No action needed
- The Entra ID synchronization API does not expose the OAuth grant type directly in the job metadata
- Apps that support Code Auth Grant use specific, well-known template IDs assigned by Microsoft
- This approach eliminates the need to inspect credential secrets or authorization configurations
- It dramatically reduces API calls compared to checking every SP's full sync configuration
- If a batch request fails, the script falls back to individual per-SP API calls
- SPs without synchronization jobs are silently skipped (404 responses in batch are ignored)
- Permission errors are caught and logged without terminating the scan
For each app flagged as using OAuth 2.0 Authorization Code Grant:
Navigate to: Entra ID → Enterprise applications → Select the flagged app → Provisioning
- Click Admin Credentials
- Under the Authorization section, switch from Authorization Code to Client Credentials
- Enter the required credentials:
- Tenant URL: The SCIM endpoint URL of the target application
- Client ID: The OAuth 2.0 client ID from the target application
- Client Secret: The OAuth 2.0 client secret from the target application
- Click Test Connection to verify connectivity
- Click Save
- Click Stop provisioning (if currently running)
- Click Start provisioning to begin a new sync cycle with updated credentials
- Monitor the provisioning logs for successful sync cycles
- Re-run this scanner to confirm the app no longer appears in the "Action Required" list
Important: Each SaaS vendor has specific instructions for generating Client Credentials. Refer to the vendor's documentation for the correct Tenant URL, Client ID, and Client Secret values.
To run the scanner on a recurring schedule (e.g., weekly compliance check):
# Use app-only authentication for unattended execution
$clientId = "<your-app-registration-client-id>"
$tenantId = "<your-tenant-id>"
$certThumbprint = "<certificate-thumbprint>"
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateThumbprint $certThumbprint- Parse the CSV output and push results to your SIEM, ServiceNow, or compliance dashboard
- Set up alerts when
IsCodeAuthGrant = TRUEapps are detected - Track remediation progress over time by comparing reports
| Issue | Solution |
|---|---|
Insufficient privileges error |
Ensure the account has Application.Read.All and Synchronization.Read.All permissions |
| Script returns 0 SCIM apps | Verify the tenant has SCIM provisioning configured for gallery apps |
| Batch API calls fail with 429 | The script handles throttling with fallback; try again after a few minutes |
| Module not found error | Run Install-Module Microsoft.Graph.Applications -Force |
| CSV file not created | Ensure the current directory is writable; check the terminal for the export path |