SCIM answers 401 or 403 (token expired, revoked or missing a scope)

Symptom

Provisioning in Microsoft Entra ID or Okta fails. The identity provider's log shows 401 Unauthorized or 403 Forbidden answers, and new people do not appear in the console.

Cause

Fix

1. Open «Manage» › «SCIM tokens» and check the token's state: «Active», «Expiring soon», «Expired» or «Revoked». The «Last used» column tells you whether the provider is using it.
2. Expired or revoked token: choose «Create token», with both scopes, and copy the «Tenant URL» and «Secret token» into the identity provider.
3. Expiring token: use «Rotate token» with a grace period (for example 24 hours) and update the provider within it.
4. Missing scope: create a new token with «Users (scim:users)» and «Groups (scim:groups)».
5. Seats: see Limit reached.
6. In the identity provider, use "Test connection" and restart provisioning.

If you see «This organization already has five live SCIM tokens. Revoke one first.», revoke an old token before creating another.

How do I stop it happening again?

Choose a suitable validity (up to 2 years), note the end date and rotate the token before «Expiring soon» runs out.

When to escalate

If the token is «Active», has both scopes and the provider still gets 401, contact support with the time and the token's name (never the secret).