Why it matters in practice
Tenant Misconfiguration and SCIM Drift matters because it shapes how an operator scopes the work, chooses validation steps, prioritizes evidence and explains risk. The point is not to accumulate trivia; it is to understand which control boundary is in play and how that boundary can fail under realistic pressure.
Primary coverage
- Review who can create, provision, assign and delete identities or app links.
- Check whether SCIM mappings or group sync can create role inflation or silent re-entry.
- Treat test tenants, dev tenants and mergers as high-value trust drift zones.
- Document administrative boundaries clearly: what is global, what is tenant-local and what is app-specific.
Selected public references
Write findings in terms of trust crossed, scope enlarged and business or operational effect reached. That keeps the note useful whether you are validating a lab, an internal research target or a live customer environment.
Selected public references
- SCIM RFC 7644Provisioning protocol behaviour.
- Microsoft Learn ยท Role assignmentsTenant role and administrative scope context.
- Okta Provisioning DocsProvisioning model and lifecycle trust.