3801219 - SAP Datasphere SCIM Integration to Microsoft Entra ID via IPS

It is required to integrate Datasphere with Microsoft Entra ID via SCIM. 

SCIM endpoint requires custom HTTP header x-sap-sac-custom-auth: true, without this header, the endpoint redirects to an authentication page and returns HTML instead of a SCIM JSON response.

When the x-sap-sac-custom-auth: true header is included (manual test with Bruno/Postman), the SCIM endpoint returns the expected JSON response.

• Error code: CredentialValidationUnavailable
• Error details: We received this unexpected response from your application: We are not able to deserialize the resource received from your SCIM endpoint because your SCIM endpoint is not fully compatible with the Azure Active Directory SCIM client. Here is the resource we received from your SCIM endpoint:

• SAP Datasphere
• Microsoft Entra ID
• SAP Cloud Identity Services
• Identity Authentication Service

1. Configure OAuth 2.0 client credentials for SCIM access to the SAP Datasphere tenant.
2. Call the SCIM endpoint without the HTTP header x-sap-sac-custom-auth: true.
3. Observe a redirect to the authentication page with an HTML response instead of SCIM JSON.
4. Repeat the call including the HTTP header x-sap-sac-custom-auth: true.
5. Observe the expected SCIM JSON response is returned.
6. Attempt to configure Microsoft Entra ID SCIM provisioning to add the custom header.
7. Note that custom HTTP headers are not supported on Microsoft Entra ID.

Custom HTTP headers are not supported on Microsoft Entra ID. Therefore Direct SCIM provisioning from Microsoft Entra ID to SAP Datasphere is not supported as Datasphere SCIM endpoint requires the custom HTTP header x-sap-sac-custom-auth: true. 

Workaround: Use SAP Identity Provisioning Service (IPS) as an intermediary for Entra ID → IPS → Datasphere SCIM provisioning to accommodate the SCIM requirements.

• Connect your Microsoft Entra ID to IAS as a Corporate Identity Provider (Corporate IdP) following: Configure Trust with SAML 2.0 Corporate Identity Provider | SAP Help Portal
• Set Entra ID as the default IdP in IAS, so authentication is transparently routed through it as per: Choose a Corporate Identity Provider as Default | SAP Help Portal
• From the end-user perspective, it behaves as if SAP Datasphere is connected directly to Entra ID.

• Configure Trust with SAML 2.0 Corporate Identity Provider | SAP Help Portal
• Choose a Corporate Identity Provider as Default | SAP Help Portal
• KBA 3794211 - CredentialValidationUnavailable error when running a connection test to the IAS endpoint in Azure Entra ID provisioning

credentialvalidationunavailable, azure entra id, ias, identity authentication, scim, provisioning, test connection, failed login attempt, system user, tenant url, endpoint, connection error, authentication, user provisioning, cloud identity services

, KBA , DS-API , SAP Datasphere APIs , DS-SEC-AUTZ , Authorizations (Locks, etc.) , LOD-ANA-AUT , SAC Authentication / Login , DS-HANA-AUTN , Authentication: SSO/SAML, OAuth Client , How To

SAP Datasphere all versions