Entra SCIM validator: userName filter fails when our service derives userName from first email

Hi,

We’re validating our SCIM /Users endpoints against the Entra SCIM validator. Our system only supports one email per user and derives userName from email. We currently ignore the incoming userName in POST /Users.

Where the list of emails comes from:

The Entra validator sends a multi-valued emails array during Create User.

What we do:

• Pick the first email from emails[] 
• Set both email and userName to this chosen email.
• Ignore any userName provided in the request.

Example – Request from Entra:

POST /scim/v2/Users
Content-Type: application/scim+json
{
  "active": true,
  "emails": [
  			{ 	
				"type": "other",
	 			"display": "OAVDHVYNEPFU", 
				"value": "******@ullrichlemke.ca" 
			},
    		{ 
				"type": "work",  
				"display": "WCBXPVGTPGTN", 
				"value": "******@bogisich.ca" 
			},
	
    		{ 
				"type": "home",  
				"display": "XXXYWHCWHXVX", 
				"value": "******@koss.info" 
			}
  			],
  "name": { "familyName": "Jesus", "givenName": "Rigoberto" },
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "******@schmidtwelch.uk"
}

What we store (after our processing):

{
  "id": "12345",
  "userName": "******@ullrichlemke.ca",   // derived from first email
  "email": "******@ullrichlemke.ca",
  "active": true,
  "name": { "familyName": "Jesus", "givenName": "Rigoberto" }
}

Our Create response (201)

HTTP/1.1 201 Created
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "12345",
  "userName": "******@ullrichlemke.ca",
  "active": true,
  "name": { "familyName": "Jesus", "givenName": "Rigoberto" },
  "emails": [
    { "value": "******@ullrichlemke.ca", "type": "other", "primary": true }
  ]
}

What Entra does next (filter call):

GET /scim/v2/Users?filter=userName%20eq%20%22gage_ernser%40schmidtwelch.uk%22

Our search response

HTTP/1.1 200 OK
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 0
}

Problem

The validator expects to find the user by the original userName it sent ("******@schmidtwelch.uk"), but our system overwrote it to match the first email ("******@ullrichlemke.ca"). This is by design — in our product, userName is always the user’s email.

Questions for the Entra team/community

1. Is there a way to configure the Entra SCIM validator so that:
   • userName is omitted on create, letting us derive it from email, or
   • follow-up filters use the returned userName from our 201 response instead of the originally sent one?
2. If not, does that mean the only way to pass validation would be to store the provided userName exactly as sent, even when it’s different from the chosen email, which would go against our single-email, userName == email design?
3. Are there best practices for SCIM targets that enforce userName == email while still integrating with Entra provisioning?

We’re trying to keep our single-email, userName == email rule while passing the validator.

Thanks! Happy to provide more request/response logs if needed.