# Add Entitlement for SCIM2 Application does not work

**URL:** <https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059>\
**Category:** Implement & Extend\
**Tags:** compliance, identityiq-8.2\
**Created:** [August 1, 2022, 12:53pm UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059 "2022-08-01T12:53:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pasha](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/pasha/32/16799_2.png) [@pasha](https://community.sailpoint.com/discuss/u/pasha)\
**Post date:** [August 1, 2022, 12:53pm UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059/1 "2022-08-01T12:53:04Z")

</div>

Hi All

I am trying to create an entitlement for my SCIM2 applicaton. But I am not seeing anything happening. My Before Provisioning rule is not being called. The only thing I see is ManagedAttributes are added. But no provisioning/creation of the groups.

Below is the plan I see from my “Entitlement Update” trace. Could this be the reason for no provisioning?

\<ObjectRequest application=“Invicti” nativeIdentity=“PashaTest1” op=“Create” type=“group”\>  
\<Attributes\>  
\<Map\>  
\<entry key=“noProvisioning”\>  
\<value\>  
\<Boolean\>true\</Boolean\>  
\</value\>  
\</entry\>  
\</Map\>

Below is the full project and plan.

\<?xml version=‘1.0’ encoding=‘UTF-8’?\>  
\<!DOCTYPE ProvisioningProject PUBLIC “sailpoint.dtd” “sailpoint.dtd”\>  
\<ProvisioningProject\>  
\<Attributes\>  
\<Map\>  
\<entry key=“requester” value=“pasha”/\>  
\<entry key=“source” value=“GroupManagement”/\>  
\</Map\>  
\</Attributes\>  
\<MasterPlan\>  
\<ProvisioningPlan\>  
\<Attributes\>  
\<Map\>  
\<entry key=“requester” value=“pasha”/\>  
\<entry key=“source” value=“GroupManagement”/\>  
\</Map\>  
\</Attributes\>  
\<ObjectRequest application=“Invicti” nativeIdentity=“PashaTest1” op=“Create” type=“group”\>  
\<Attributes\>  
\<Map\>  
\<entry key=“noProvisioning”\>  
\<value\>  
\<Boolean\>true\</Boolean\>  
\</value\>  
\</entry\>  
\</Map\>  
\</Attributes\>  
\<AttributeRequest name=“sysAttribute” op=“Set” value=“groups”/\>  
\<AttributeRequest name=“sysDisplayName” op=“Set” value=“PashaTest1”/\>  
\<AttributeRequest name=“sysDescriptions” op=“Set”\>  
\<Value\>  
\<Map\>  
\<entry key=“en\_US”/\>  
\</Map\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“sysOwner” op=“Set” value=“”/\>  
\<AttributeRequest name=“sysScope” op=“Set”/\>  
\<AttributeRequest name=“sysRequestable” op=“Set”\>  
\<Value\>  
\<Boolean\>\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“sysManagedAttributeType” op=“Set” value=“group”/\>  
\<AttributeRequest name=“sysClassifications” op=“Set”/\>  
\<AttributeRequest name=“managerRequired” op=“Set”\>  
\<Value\>  
\<Boolean\>true\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“ownerRequired” op=“Set”\>  
\<Value\>  
\<Boolean\>\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“commentsRequired” op=“Set”\>  
\<Value\>  
\<Boolean\>\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“secondaryowner” op=“Set”/\>  
\</ObjectRequest\>  
\<Requesters\>  
\<Reference class=“sailpoint.object.Identity” id=“8a86cac8689ffee201689ffff051022c” name=“pasha”/\>  
\</Requesters\>  
\</ProvisioningPlan\>  
\</MasterPlan\>  
\<ProvisioningPlan trackingId=“e9cd1b8cedf8436b8e1199515f2492c2”\>  
\<Attributes\>  
\<Map\>  
\<entry key=“requester” value=“pasha”/\>  
\<entry key=“source” value=“GroupManagement”/\>  
\</Map\>  
\</Attributes\>  
\<ObjectRequest application=“Invicti” nativeIdentity=“PashaTest1” op=“Create” type=“group”\>  
\<Attributes\>  
\<Map\>  
\<entry key=“noProvisioning”\>  
\<value\>  
\<Boolean\>true\</Boolean\>  
\</value\>  
\</entry\>  
\</Map\>  
\</Attributes\>  
\<AttributeRequest name=“sysAttribute” op=“Set” value=“groups”/\>  
\<AttributeRequest name=“sysDisplayName” op=“Set” value=“PashaTest1”/\>  
\<AttributeRequest name=“sysDescriptions” op=“Set”\>  
\<Value\>  
\<Map\>  
\<entry key=“en\_US”/\>  
\</Map\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“sysOwner” op=“Set” value=“”/\>  
\<AttributeRequest name=“sysRequestable” op=“Set”\>  
\<Value\>  
\<Boolean\>\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“sysManagedAttributeType” op=“Set” value=“group”/\>  
\<AttributeRequest name=“sysClassifications” op=“Set”/\>  
\<AttributeRequest name=“managerRequired” op=“Set”\>  
\<Value\>  
\<Boolean\>true\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“ownerRequired” op=“Set”\>  
\<Value\>  
\<Boolean\>\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\<AttributeRequest name=“commentsRequired” op=“Set”\>  
\<Value\>  
\<Boolean\>\</Boolean\>  
\</Value\>  
\</AttributeRequest\>  
\</ObjectRequest\>  
\<Requesters\>  
\<Reference class=“sailpoint.object.Identity” id=“8a86cac8689ffee201689ffff051022c” name=“pasha”/\>  
\</Requesters\>  
\</ProvisioningPlan\>  
\</ProvisioningProject\>

\</Attributes\>

---

<div class="post-metadata">

**Author:** ![paulo\_urcid](https://avatars.discourse-cdn.com/v4/letter/p/848f3c/32.png) [@paulo\_urcid](https://community.sailpoint.com/discuss/u/paulo_urcid)\
**Post date:** [August 2, 2022, 8:17pm UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059/2 "2022-08-02T20:17:57Z")

</div>

Make sure you have the checkbox enabled for “Enable Account Group Management” in Gear Icon \> Lifecycle Manager \> Configure tab. Also make sure your SCIM Application has the appropriate Group “Create” Provisioning Policy

---

<div class="post-metadata">

**Author:** ![pasha](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/pasha/32/16799_2.png) [@pasha](https://community.sailpoint.com/discuss/u/pasha)\
**Post date:** [August 2, 2022, 11:09pm UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059/3 "2022-08-02T23:09:07Z")

</div>

Hi&nbsp; @paulo_urcid &nbsp; I have that configuration set.&nbsp; Do you have an example of what the create group provisioning policy for SCIM2 should look like?

I put&nbsp; featuresString=“PROVISIONING” in my group schema and now I see I can add displayName which is the only thing needed to create a group. But am getting the below error. Any hint is greatly appreciated.

 ![image.png](https://cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/sailpointsbx2/original/2X/1/14c0eca50c27a5ec7c0cf130cffb08744cec78c8.png)

---

<div class="post-metadata">

**Author:** ![pasha](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/pasha/32/16799_2.png) [@pasha](https://community.sailpoint.com/discuss/u/pasha)\
**Post date:** [August 3, 2022, 12:25am UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059/4 "2022-08-03T00:25:33Z")

</div>

Wow. Believe it or not, it is working. All I had to do was:

1- Put&nbsp;featuresString=“PROVISIONING”&nbsp;in the group schema for the application.

2-&nbsp; And put a dummy group schema customization rule. I swear it’s just a dummy rule to print out object.toXmlI();

I take it. It is working 🙂

Thanks.

Pasha

---

<div class="post-metadata">

**Author:** ![rmitukulla07](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@rmitukulla07](https://community.sailpoint.com/discuss/u/rmitukulla07)\
**Post date:** [January 30, 2024, 12:59pm UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059/5 "2024-01-30T12:59:37Z")

</div>

Dear&nbsp; @pasha

we have the same requirement to create groups in the Zscaler application which is the SCIM2.0 connector application. Could you please provide help on this to create groups in the target application?

thanks in advance.

---

<div class="post-metadata">

**Author:** ![pasha](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/pasha/32/16799_2.png) [@pasha](https://community.sailpoint.com/discuss/u/pasha)\
**Post date:** [January 30, 2024, 1:26pm UTC](https://community.sailpoint.com/discuss/t/add-entitlement-for-scim2-application-does-not-work/27059/6 "2024-01-30T13:26:51Z")

</div>

Hi&nbsp; @rmitukulla07 &nbsp; Is zscalar a “Non-compliant Server” ? You can check/uncheck that in your scim settings.

Don’t know what else to add. I added featureset and gave a customization rule for groups.