SCIM Validator "Invalid credentials!" when testing SCIM schema

Question

SCIM Validator "Invalid credentials!" when testing SCIM schema

Jurij 0

Hi everyone,

I'm running into a problem when trying to test a SCIM schema. After clicking "Discover Schema", everything seems to work fine — the schema is detected successfully.

However, when I click "Test Schema", I get the following error:

Invalid credentials! Please Check the following Errors: Other Errors could be: SCIM Validator address not in the allowed range. Check our IP address range in the 'Tools and Resources' section of this portal.

What confuses me is the "Invalid credentials" message. If the credentials were actually wrong, why would "Discover Schema" work in the first place? The token I provided seems to be valid since it successfully fetched the schema. So I’m not sure why it would fail during the test step.

Could this error actually be related to an IP restriction instead? Is it about the IP address of my SCIM provider, or the IP from which I’m accessing the portal?

Any ideas or guidance would be much appreciated — thanks in advance!

Goutam Pratti 4,720 Reputation points Microsoft External Staff Moderator

2025-05-09T00:03:48.33+00:00

Hello Jurij ,

I Understand you are running into a problem when trying to test a SCIM schema. After clicking "Discover Schema", everything seems to work fine — the schema is detected successfully.

However, when you click "Test Schema", you get the following error:

Invalid credentials! Please Check the following Errors: Other Errors could be: SCIM Validator address not in the allowed range. Check our IP address range in the 'Tools and Resources' section of this portal.

The Microsoft Entra provisioning service currently operates under the IP Ranges for Microsoft Entra ID as listed here. You can add the IP ranges listed under the AzureActiveDirectory tag to allow traffic from the Microsoft Entra provisioning service into your application. You need to review the IP range list carefully for computed addresses. An address such as '40.126.25.32' could be represented in the IP range list as '40.126.0.0/18'. You can also programmatically retrieve the IP range list using the following API.

Additionally make sure that you are using the only acceptable protocol version is TLS 1.2. No other SSL/TLS version is permitted.

Make sure you follow the document for the configurations to avoid erros:https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups

If you're still encountering the same error, please provide a screenshot for better trouble shooting the issue.

Hope this information helps. Let us know if you have any additional queries. Happy to assist you further.

1 answer

Your answer

Goutam Pratti 4,720 Reputation points Microsoft External Staff Moderator

2025-05-09T00:03:48.33+00:00

Hello Jurij ,

I Understand you are running into a problem when trying to test a SCIM schema. After clicking "Discover Schema", everything seems to work fine — the schema is detected successfully.

However, when you click "Test Schema", you get the following error:

Invalid credentials! Please Check the following Errors: Other Errors could be: SCIM Validator address not in the allowed range. Check our IP address range in the 'Tools and Resources' section of this portal.

The Microsoft Entra provisioning service currently operates under the IP Ranges for Microsoft Entra ID as listed here. You can add the IP ranges listed under the AzureActiveDirectory tag to allow traffic from the Microsoft Entra provisioning service into your application. You need to review the IP range list carefully for computed addresses. An address such as '40.126.25.32' could be represented in the IP range list as '40.126.0.0/18'. You can also programmatically retrieve the IP range list using the following API.

Additionally make sure that you are using the only acceptable protocol version is TLS 1.2. No other SSL/TLS version is permitted.

Make sure you follow the document for the configurations to avoid erros:https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups

If you're still encountering the same error, please provide a screenshot for better trouble shooting the issue.

Hope this information helps. Let us know if you have any additional queries. Happy to assist you further.

Answer 1

Michele Ariis 5 MVP

Hi Jurij, that “Invalid credentials!” in Test is often due to IP restriction, not the token:

Whitelist the IP range of the SCIM Validator (see “Tools and Resources”).

Verify that Test sends the Authorization: Bearer <token> correctly.

Make sure your SCIM endpoint handles the paging parameters (startIndex, count).

Then it should unlock

Jurij 0 Reputation points

2025-05-09T10:39:55.5766667+00:00

Hi @Michele Ariis ,

thanks for the pointers!

When I go to “Tools and Resources,” I only see an option to download a list – I can’t find where to actually whitelist an IP address. Could you let me know where exactly that can be done?

Also, my application is not hosted on Azure but externally. Does the SCIM Validator tool still work in this case, or is it only intended for apps hosted on Azure?

Best regards, Jurij

Share via

SCIM Validator "Invalid credentials!" when testing SCIM schema

1 answer

Your answer