Get-MgApplicationSCIM

SYNOPSIS

Retrieves all Entra ID applications configured for SCIM provisioning.

SYNTAX

All (Default)

Get-MgApplicationSCIM [-ExcludeAttributeMappings] [-IncludeFailedObjects]
 [-ForceNewToken] [-ExportToExcel] [-ExportPath <string>]
 [-RunFromAzureAutomation] [-NotificationRecipient <string>]
 [-NotificationSender <string>] [-DisableParallel] [-ThrottleLimit <int>]
 [-UseBatchRequest] [-EntraCloudSync]

ByObjectId

Get-MgApplicationSCIM [-ObjectID <string>] [-ExcludeAttributeMappings]
 [-IncludeFailedObjects] [-ForceNewToken] [-ExportToExcel]
 [-ExportPath <string>] [-RunFromAzureAutomation]
 [-NotificationRecipient <string>] [-NotificationSender <string>]
 [-DisableParallel] [-ThrottleLimit <int>] [-UseBatchRequest] [-EntraCloudSync]

ByDisplayName

Get-MgApplicationSCIM [-DisplayName <string>] [-ExcludeAttributeMappings]
 [-IncludeFailedObjects] [-ForceNewToken] [-ExportToExcel]
 [-ExportPath <string>] [-RunFromAzureAutomation]
 [-NotificationRecipient <string>] [-NotificationSender <string>]
 [-DisableParallel] [-ThrottleLimit <int>] [-UseBatchRequest] [-EntraCloudSync]

DESCRIPTION

This function returns a list of all Entra ID applications with SCIM provisioning enabled, along with their synchronization job details and settings.

EXAMPLES

EXAMPLE 1

$scimApps = Get-MgApplicationSCIM

Retrieves all Entra ID applications with SCIM provisioning enabled.

EXAMPLE 2

Get-MgApplicationSCIM -DisableParallel

Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls).

EXAMPLE 3

Get-MgApplicationSCIM -UseBatchRequest

Uses the Graph JSON $batch endpoint for the discovery phase (20 requests per HTTP call, automatic 429 retry). Requires the PS365 module; falls back to the default behavior when Invoke-MgGraphBatchRequest is not available.

EXAMPLE 4

Get-MgApplicationSCIM -EntraCloudSync

Returns only Entra Cloud Sync jobs, excluding application provisioning (SCIM) jobs.

EXAMPLE 5

Get-MgApplicationSCIM -ForceNewToken

Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token.

EXAMPLE 6

Get-MgApplicationSCIM -ExportToExcel

Exports the SCIM configuration details to an Excel file.

EXAMPLE 7

Get-MgApplicationSCIM -ObjectID "xxx-xxx-xxx"

Retrieves the SCIM configuration for a specific application by its ObjectID.

EXAMPLE 8

Get-MgApplicationSCIM -DisplayName "My App"

Retrieves the SCIM configuration for a specific application by its DisplayName.

EXAMPLE 9

Get-MgApplicationSCIM -DisplayName "Azure*"

Retrieves the SCIM configuration for all applications whose DisplayName starts with “Azure”.

EXAMPLE 10

Get-MgApplicationSCIM -DisplayName "*Provisioning*"

Retrieves the SCIM configuration for all applications whose DisplayName contains “Provisioning”.

EXAMPLE 11

Get-MgApplicationSCIM -RunFromAzureAutomation -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com'

Gets all SCIM provisioning jobs using managed identity and sends a health report for apps with synchronization issues.

PARAMETERS

-DisableParallel

(Optional) Forces sequential processing. By default, on PowerShell 7+ the function scans service principals in parallel (ForEach-Object -Parallel) to speed up discovery; on PowerShell 5.1 it always runs sequentially.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DisplayName

(Optional) Retrieves the SCIM configuration for a specific application by its DisplayName. Supports wildcards (* and ?) for partial name matching (e.g. “Azure*”, “Portal”).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: ByDisplayName
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-EntraCloudSync

(Optional) Returns only Entra Cloud Sync jobs (synchronization templateId ‘AD2AADProvisioning’ or ‘AD2AADPasswordHash’), excluding application provisioning (SCIM) jobs. Note: Microsoft Graph has no tenant-wide endpoint to list synchronization jobs by templateId; jobs are nested per service principal, so this filter is applied client-side after enumerating service principals.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExcludeAttributeMappings

(Optional) If specified, skips the retrieval of the attribute mapping schema (ObjectMappings). This speeds up execution significantly when mapping details are not needed.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportPath

Optional output directory for the Excel export (defaults to the user profile).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user’s profile directory.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ForceNewToken

(Optional) Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-IncludeFailedObjects

(Optional) If specified, fetches the list of objects currently in error (escrowed) for each synchronization job via the provisioning audit logs API. Requires the AuditLog.Read.All permission. If connecting interactively, this scope is added automatically.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-NotificationRecipient

(Required when RunFromAzureAutomation is enabled) Email address to receive synchronization health notifications.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-NotificationSender

(Required when RunFromAzureAutomation is enabled) Email address of the sender for synchronization health notifications.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ObjectID

(Optional) Retrieves the SCIM configuration for a specific application by its ObjectID.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases:
- Identity
ParameterSets:
- Name: ByObjectId
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-RunFromAzureAutomation

(Optional) If specified, uses managed identity authentication instead of interactive authentication. This is useful when running the script in Azure environments like Azure Functions, Logic Apps, or VMs with managed identity enabled. When this parameter is used, NotificationRecipient and NotificationSender are required. PowerShell modules used in Azure Automation must be a MAXIMUM of version 2.25.0 when using PowerShell < 7.4.0, because starting from version 2.26.0, PowerShell 7.4.0 is required, and Azure Automation does not support it yet as of February 2026. For PowerShell 7.4.0+, there are no version restrictions. https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147 https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151 https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ThrottleLimit

(Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429).

Type: System.Int32
DefaultValue: 5
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-UseBatchRequest

(Optional) Uses the Microsoft Graph JSON $batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) for the synchronization jobs discovery phase, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

NOTES

LIMITATIONS The groups assignments are not retrieved because based on https://main.iam.ad.ext.azure.com This function requires the Microsoft.Graph.Applications and Microsoft.Graph.Authentication modules.

https://ps365.clidsys.com/docs/commands/Get-MgApplicationSCIM

​Get-MgApplicationSCIM

​SYNOPSIS

​SYNTAX

​All (Default)

​ByObjectId

​ByDisplayName

​DESCRIPTION

​EXAMPLES

​EXAMPLE 1

​EXAMPLE 2

​EXAMPLE 3

​EXAMPLE 4

​EXAMPLE 5

​EXAMPLE 6

​EXAMPLE 7

​EXAMPLE 8

​EXAMPLE 9

​EXAMPLE 10

​EXAMPLE 11

​PARAMETERS

​-DisableParallel

​-DisplayName

​-EntraCloudSync

​-ExcludeAttributeMappings

​-ExportPath

​-ExportToExcel

​-ForceNewToken

​-IncludeFailedObjects

​-NotificationRecipient

​-NotificationSender

​-ObjectID

​-RunFromAzureAutomation

​-ThrottleLimit

​-UseBatchRequest

​CommonParameters

​INPUTS

​OUTPUTS

​NOTES

​RELATED LINKS