EntraId is requesting multiple access tokens for OCI IAM SCIM provision

Microsoft does not document a guarantee that the Entra provisioning service will cache and reuse an OCI-issued access token until, or near, its expiration; repeated token requests while an earlier token remains valid can therefore be expected and should not by itself be treated as a provisioning fault.

The documented OAuth 2.0 client-credentials behavior is that Entra can silently request new access tokens without user interaction. The documentation does not state that one token is retained for its full lifetime, nor does it expose a setting that controls token caching or renewal timing.^1^

What can be confirmed

• Entra acts as the SCIM client and sends requests to the target application's SCIM endpoints.^2^
• With OAuth client credentials, the provisioning service can obtain fresh access tokens automatically.^1^
• Microsoft’s gallery requirements specify that SCIM access tokens should expire between 60 minutes and six hours, but do not promise that Entra will use a token until expiration.^3^
• The OCI provisioning tutorial contains no customer-configurable token-cache or token-reuse setting. It also states that the supported OCI integration is the customized gallery application; custom/BYOA OCI integrations are not supported by that tutorial.^4^

Generic MSAL behavior—caching access tokens and renewing them near expiration—does not establish the behavior of the managed Entra provisioning service. The MSAL documentation applies to applications built with MSAL, not to the internal implementation of this SCIM connector.^5^

Possible acquisition boundaries

Microsoft does not publish an exhaustive list of events that invalidate or bypass the provisioning service’s token cache. Consequently, the following should be treated as investigation points rather than confirmed OCI-connector rules:

• Test Connection operations. Test Connection initiates a connection attempt against the SCIM endpoint and can involve obtaining credentials for that attempt.^1^
• Separate provisioning executions or service workers. The public documentation does not promise that tokens are shared across provisioning cycles, workers, service instances, or regions.
• Authentication failures. A rejected SCIM request, such as HTTP 401, may coincide with another token request, but no documented OCI-specific retry rule confirms that behavior.
• Configuration changes or job restarts. These may establish a new execution context, but Microsoft does not document their precise effect on the token cache.
• Proactive renewal. A token can be valid yet still be replaced before its exp time. No documented renewal threshold is published for this service.

Token expiration is therefore the time after which OCI must no longer accept the token; it is not a minimum period during which Entra must continue using it.

How to determine whether this is operationally significant

Correlate the OCI token and SCIM logs by timestamp:

1. Record each token request’s client ID, scope, grant type, response status, issuance time, expiration time, and a non-sensitive token identifier or hash. Do not log client secrets or complete access tokens.
2. Correlate each request with:
   • Entra Test Connection activity;
   • provisioning-cycle start times;
   • provisioning configuration changes or restarts;
   • OCI SCIM responses, especially 401, 403, 429, and 5xx;
   • OCI token-endpoint throttling or failures.
3. Verify whether provisioning succeeds despite the additional requests.
   • If it does, the request frequency alone is not evidence of a defect.
   • If OCI rate-limits token issuance or provisioning fails, capture the correlation IDs, UTC timestamps, sanitized request/response headers, provisioning job ID, and Entra provisioning logs.

If failures or material token-endpoint load result, open a Microsoft support case asking for the connector’s observed token-acquisition cadence to be reviewed. Include whether this is the supported Oracle Cloud Infrastructure Console gallery application or a custom/non-gallery connector, because the documented OCI support boundary differs.^4^

Changing the OCI token lifetime should not be expected to force longer reuse: Microsoft documents no relationship between the configured lifetime and how long the provisioning service retains a token.

References

1. Tutorial: Develop and plan provisioning for a SCIM endpoint in Microsoft Entra ID
2. SCIM support in Microsoft Entra ID - Microsoft Entra ID
3. User provisioning requirements for Microsoft Entra App Gallery
4. Configure Oracle Cloud Infrastructure Console for automatic user ...
5. Authenticate applications and users with Microsoft Entra ID