The most recent sets of standards, SAML 2.0 and WS-Federation, define two roles in an identity federation partnership: an Identity Provider (IdP) and a Service Provider (SP).

 Earlier SAML 1.x specifications used the terms Asserting Party (for IdP) and Relying Party (for SP). For consistency and clarity, however, PingFederate® adopts the later terms IdP and SP across all specifications.

A third role, defined in the SAML 2.0 specifications and available in PingFederate, is that of an IdP Discovery provider.

With OAuth 2.0 and OpenID Connect 1.0 support, PingFederate can be configured as an authorization server (AS), an OpenID Provider (OP), and a Relying Party (RP). (Note that OP and RP are the synonyms for IdP and SP, respectively.)

SCIM Provisioning "Unauthorized" Error — Root Cause

This error is coming from AWS IAM Identity Center's SCIM endpoint rejecting a request from Microsoft Entra ID (Azure AD) during automatic user provisioning. Here's what's happening:

What's Occurring

Entra ID is trying to query the SCIM endpoint to check if a user exists:

GET https://scim.eu-west-1.amazonaws.com/vdl76dbbc64-2-0dab8378198a/scim/v2/Users?filter=userName eq "ba150bf6-019b"

…and receiving a 401 Unauthorized (UnauthorizedException) response.

Most Likely Cause

The SCIM bearer token (secret token) has expired or been invalidated. This is the #1 cause of this error. Specifically:

1. Expired SCIM access token — AWS IAM Identity Center SCIM tokens have a limited lifespan. If the token was generated a while ago, it may have expired.

2. Token was regenerated — If someone regenerated a new SCIM token in the IAM Identity Center console, the old token configured in Entra ID is no longer valid.

3. Token was revoked — If automatic provisioning was disabled and re-enabled, the previous token is invalidated.

How to Fix

1. Go to AWS IAM Identity Center → Settings → Automatic provisioning

2. Generate a new SCIM access token (or regenerate the existing one)

3. Copy the new token and the SCIM endpoint URL

4. In Microsoft Entra ID → Enterprise Applications → [your AWS SSO app] → Provisioning → Manage → Connectivity

   • Update the Secret Token with the new bearer token

   • Confirm the Tenant URL matches the SCIM endpoint

5. Click Test Connection to verify it works

6. Save and restart provisioning