Microsoft Entra SCIM provisioning to Salesforce Sandbox fails with profileId entitlement mapping

Hello,

We are configuring Microsoft Entra ID provisioning to Salesforce Sandbox.

We tested two provisioning approaches:

1. A custom Enterprise Application using SCIM.
2. A new native Salesforce Sandbox gallery application from Microsoft Entra.

The custom SCIM connection is successful using OAuth2 Client Credentials.

SCIM Tenant URL:

https://<salesforce-sandbox-domain>/services/scim/v2/

OAuth Token Endpoint:

https://<salesforce-sandbox-domain>/services/oauth2/token

On-demand provisioning reaches Salesforce, but user creation fails with HTTP 409 Conflict.

Error returned through Entra provisioning:

SystemForCrossDomainIdentityManagementServiceIncompatibleFiltering

Web Response:

{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":"REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid","status":409}

The following attributes are being sent correctly according to the Entra provisioning data flow:

userName = userPrincipalName

emails[type eq "work"].value = userPrincipalName

urn:ietf:params:scim:schemas:extension:salesforce:2.0:User:federationIdentifier = userPrincipalName

Salesforce provided a Standard User profile ID for testing.

We tried several mappings for entitlements/profileId:

• entitlements.value
• entitlements[type eq "profileId"].value
• entitlements[type eq "Profile"].value
• entitlements[primary eq "True"].value
• urn:ietf:params:scim:schemas:core:2.0:User:entitlements
• Split("<profileId>", ",")
• AppRoleAssignmentsComplex([appRoleAssignments]) -> entitlements

In the Entra data flow, the profileId value is shown as being sent, but Salesforce does not interpret it as a valid profileId entitlement.

We also tested a new native Salesforce Sandbox gallery application from Microsoft Entra. The connection test fails before reaching mappings with:

SalesforceCredentialValidationUnavailable

Details:

We received an unexpected response from Salesforce.com. Please try again. If the problem persists, please contact Microsoft Azure support.

Question:

What is the correct Microsoft Entra provisioning mapping/schema required to send a Salesforce profileId as a valid SCIM entitlement during user creation?

Should this be done with SingleAppRoleAssignments, AppRoleAssignmentsComplex, or a specific entitlements sub-attribute?