Hi Team,

We are trying to use SCIM Provisioning with a third party application and running into an issue where updating the app username (set to Email) is unassigning the application and then reassigning the application. This is causing issues with the third party vender as the appuser profile loses the external id provided by the third party application.

This then causes Okta to send a create new user call to the 3rd party application rather than a user update call, the third party application is then creating a new duplicate user rather than updating the actual user.

The vendor to their credit is investigating a solution that involves checking the okta user id sent through SCIM on a create user call to see if it should be a user update instead but they are worried this goes against SCIM workflows.

Steps to recreate:

1.) Configure application to use SCIM Provisioning (create and update users - no import)

1.1) App username is set to `Email` and `Create and Update`

2.) Assign application to user

3.) Appuser profile is created, create new user call is sent to 3rd party - handled as expected

4.) Appuser profile is update with External Id from 3rd party

5.) User's email changes

6.) Appuser profile is updated

7.) User is unassigned from application

8.) User is assigned to application

9.) Appuser profile no longer has External Id

10.) Okta sends create new user call instead of update user call

11.) 3rd party application creates duplicate user account

Is this expected behaviour or have we misconfigured something?