Microsoft Entra ID
Microsoft's cloud-based identity and access management service, formerly known as Azure Active Directory. It provides single sign-on, multi-factor authentication, OAuth 2.0 authorization, and related capabilities, functioning as the core identity and authentication platform across the Microsoft cloud services ecosystem.
Timeline (last 90 days)
Using IQ MCP Server requires a Microsoft Entra work or school account, a tenant whose home region supports all Fabric workloads, and access to at least one report or semantic model; the content does not have to be placed on Fabric or Premium capacity.
Copilot Studio offers three authentication options: no authentication, Microsoft authentication (connecting to channels such as Teams, Power Apps, and Microsoft 365 Copilot via Entra ID), and manual authentication (supporting Entra ID or any OAuth2 identity provider).
Entra ID的SCIM供给服务更倾向于使用PUT操作来替换整个资源，而不是PATCH；其请求体包含完整的用户表示，如果端点在PUT处理中只更新部分字段可能意外覆盖已有数据。
当用户在Entra ID中被禁用或从供给范围中移除时，Entra ID可能发送active: false的PATCH，也可能直接停止发送请求，具体取决于配置是软删除还是硬删除；如果配置为硬删除，Entra ID可能发送DELETE请求。
如果SCIM端点未实现DELETE，Entra ID发送的DELETE请求会返回405，导致Entra ID重试并最终使该对象进入隔离状态。
Entra ID的供给服务通过定时轮询目录变更（增量同步）来驱动，其请求节奏和批量行为与用户的实时操作并不完全一致；同步请求失败时，Entra ID会把该对象标记为隔离（quarantine），按指数退避重试，期间可能暂停整个供给作业。
Okta和Entra ID与RFC 7644的偏离主要体现在三个方面：操作语义（Okta偏好PATCH，Entra ID偏好PUT）、属性过滤（Entra ID可能发送RFC未强制要求的属性如manager，Okta可能省略某些标准属性）、错误处理（两个目录对端点错误码反应不同）。
截至当前，Okta和Entra ID的默认行为仍未完全对齐SCIM互操作性配置的约定，因此开发者仍需以实际抓包行为为准。
一个实用的做法是在SCIM端点中同时支持PATCH和PUT，并在PATCH处理中显式检查active属性的任何操作；对于Entra ID的DELETE请求，实现软删除逻辑（标记为非活跃）而非物理删除，可以避免重试风暴。
SAFi v1.5.0 supports enterprise identity and access management capabilities, including Microsoft Entra ID single sign-on, TOTP multi-factor authentication, SCIM 2.0 user and role provisioning, automated account deprovisioning, DNS-based domain verification and tenant-aware workspace routing.
8 more timeline events
All Facts (18)
Azure AD has been renamed to Microsoft Entra ID.
60%UnverifiedUsing IQ MCP Server requires a Microsoft Entra work or school account, a tenant whose home region supports all Fabric workloads, and access to at least one report or semantic model; the content does not have to be placed on Fabric or Premium capacity.
50%UnverifiedCopilot Studio offers three authentication options: no authentication, Microsoft authentication (connecting to channels such as Teams, Power Apps, and Microsoft 365 Copilot via Entra ID), and manual authentication (supporting Entra ID or any OAuth2 identity provider).
50%Unverified一个实用的做法是在SCIM端点中同时支持PATCH和PUT，并在PATCH处理中显式检查active属性的任何操作；对于Entra ID的DELETE请求，实现软删除逻辑（标记为非活跃）而非物理删除，可以避免重试风暴。
50%UnverifiedEntra ID的SCIM供给服务更倾向于使用PUT操作来替换整个资源，而不是PATCH；其请求体包含完整的用户表示，如果端点在PUT处理中只更新部分字段可能意外覆盖已有数据。
50%Unverified当用户在Entra ID中被禁用或从供给范围中移除时，Entra ID可能发送active: false的PATCH，也可能直接停止发送请求，具体取决于配置是软删除还是硬删除；如果配置为硬删除，Entra ID可能发送DELETE请求。
50%Unverified如果SCIM端点未实现DELETE，Entra ID发送的DELETE请求会返回405，导致Entra ID重试并最终使该对象进入隔离状态。
50%UnverifiedEntra ID的供给服务通过定时轮询目录变更（增量同步）来驱动，其请求节奏和批量行为与用户的实时操作并不完全一致；同步请求失败时，Entra ID会把该对象标记为隔离（quarantine），按指数退避重试，期间可能暂停整个供给作业。
50%UnverifiedOkta和Entra ID与RFC 7644的偏离主要体现在三个方面：操作语义（Okta偏好PATCH，Entra ID偏好PUT）、属性过滤（Entra ID可能发送RFC未强制要求的属性如manager，Okta可能省略某些标准属性）、错误处理（两个目录对端点错误码反应不同）。
50%Unverified截至当前，Okta和Entra ID的默认行为仍未完全对齐SCIM互操作性配置的约定，因此开发者仍需以实际抓包行为为准。
50%UnverifiedSAFi v1.5.0 supports enterprise identity and access management capabilities, including Microsoft Entra ID single sign-on, TOTP multi-factor authentication, SCIM 2.0 user and role provisioning, automated account deprovisioning, DNS-based domain verification and tenant-aware workspace routing.
50%UnverifiedMCP hosts connect to the Core server via streamable HTTP, and then sign in with Microsoft Entra ID through a browser-based OAuth flow.
50%UnverifiedPlatforms such as Microsoft Entra ID support restricting Device Code logins through Conditional Access Policies.
50%UnverifiedFirst-party integrations can directly leverage the Microsoft Graph API to obtain data permissions, and achieve unified identity and access management through Microsoft Entra ID (formerly Azure Active Directory).
50%UnverifiedAzure AD triggers a DELETE request in some configurations when an administrator directly removes a user from an application assignment, but if a user gained access through a group assignment and is then removed from the group, Azure AD may only send a group membership change event without sending a user-level deprovisioning request.
50%UnverifiedSCIM (System for Cross-domain Identity Management) is the de facto standard for enterprise identity synchronization and is widely adopted by mainstream identity providers such as Okta, Azure AD (Microsoft Entra ID), and Google Workspace.
50%UnverifiedPlatform players such as Microsoft Entra ID and Okta account for more than 60% of the enterprise market.
50%UnverifiedIn Azure AD (now Microsoft Entra ID), service principals are divided into three types: application type, managed identity type, and legacy type.
50%