Find the symptom that matches what you're seeing, then follow the fix. For issues not covered here, contact Authenticx support with the relevant Entra provisioning log entries.
Authentication Errors
| Symptom | Likely Cause | Fix |
|---|---|---|
401 Unauthorized | Invalid OAuth client, secret, scope, or token endpoint. | Verify your Authenticx credentials, the token endpoint URL, and that the scope is set to acxapi. Re-run Test Connection in the Entra Admin Credentials screen. |
User Create / Update Errors
| Symptom | Likely Cause | Fix |
|---|---|---|
400 Bad Request on create | Required properties are missing from the SCIM payload. | Confirm userName, name.givenName, name.familyName, and the work email are all mapped in Entra. See Attribute Reference. |
| User disabled unexpectedly | accountEnabled mapping or scope-removal behavior is incorrect. | Confirm accountEnabled maps to active as expected. Check whether the user was removed from app assignment scope, which triggers deprovisioning. |
Role Errors
| Symptom | Likely Cause | Fix |
|---|---|---|
| Role not applied after provisioning | Role value does not match an active Authenticx role. | Check your role register and confirm the value sent is an active role name or ID in the same Authenticx organization. |
| Multiple-role error | Entra sent multiple roles without exactly one marked primary. | Configure Entra to send one role value to roles[primary eq true].value only. |
| Entra log shows success but role did not change in Authenticx | Entra produced a malformed filtered-array PATCH payload. | Remove any mapping to roles[primary eq true].primary. Keep only the mapping to roles[primary eq true].value. |
SchemaInvalid for roles[…] | Role target was created under the Enterprise User extension. | Delete the incorrect mapping and recreate it under the core User object. |
invalidPath for authenticxRole under the agent extension | The agent extension was used for role assignment instead of SCIM core. | Map roles to roles[primary eq true].value on the core User object. The agent extension is only for enableAgentUser. |
Agent-User Errors
| Symptom | Likely Cause | Fix |
|---|---|---|
| Agent-user not created after provisioning | enableAgentUser is missing, false, or mapped to the wrong target. | Verify the full extension URN urn:authenticx:params:scim:schemas:extension:agent:2.0:User.enableAgentUser is mapped to boolean true for the intended users. |
Group / Schema Errors
| Symptom | Likely Cause | Fix |
|---|---|---|
Group operations return 501 Not Implemented | Group provisioning is not supported by Authenticx SCIM. | Expected behavior. All /scim/v2/Groups operations return 501. Manage access through user assignments and roles only. |