Problem

After a user's email changes, Freshservice has two profiles for the same person, or provisioning fails for that user with UpdateForUnconnectedEntry.

Cause

When a user is first provisioned, Microsoft Entra ID stores the user's Freshservice ID. If the email changes later, Entra ID uses that ID and updates the email on the same profile. This works only while Entra ID still holds the ID. If the app was removed in Microsoft Entra ID, or the user was unassigned and assigned again before the change, Entra ID has lost the ID. It then tries to create a new user, and the old profile stays.

Steps

  1. In Freshservice, find the old profile (check both Agents and Requesters).
  2. Use Forget User on the old profile, or merge it into the profile that SCIM created.
  3. Run Provision on demand for the user in Microsoft Entra ID (see How to Test One User with Provision on Demand).
  4. Repeat for each affected user, one at a time, and check the result in Freshservice.

How to avoid it

  • Do not remove the app in Microsoft Entra ID, and do not unassign and reassign users. Use Provision on demand to test.
  • Keep userPrincipalName mapped to userName, with userName as the only matching attribute. Keep the externalId mapping.
  • When a UPN or email changes, update it consistently in Microsoft Entra ID, then run Provision on demand for a few users first.

Sources

  • KB: Duplicate Value and 409 Conflict Errors: How to Fix
  • KB: How to Test One User with Provision on Demand