vCenter SCIM Authentication Returns HTTP 401 or Missing Group Memberships due to Expired Bearer Tokens

Products

VMware vCenter Server

Issue/Introduction

Users are unable to authenticate or manage tasks within the vCenter Server even when configured through Entra ID (formerly Azure AD) via SCIM. Specific symptoms include:

Users failing to log in to the vSphere Client.
Users logging in successfully but having no permissions to perform administrative tasks (e.g., vMotion).
Changes in Entra ID (new users or group membership updates) not reflecting in the vCenter identity database.

Log Messages

The following logs in /var/log/vmware/vc-ws1a-broker/usergroup-service.log indicate a token expiration: YYYY-MM-DDTHH:MM:SS WARN RequestContextResolutionHandler — Token validation [Id: <TOKEN_ID>, isValid: false, isExpired: true]

Logs indicating a desynchronization where group updates are not processed: YYYY-MM-DDTHH:MM:SS INFO GroupServiceImpl — Updating Group with id: <GROUP_UUID> and members using patch call. Group updated? false

Environment

Product: VMware vCenter Server 8.0.x
Identity Provider: Microsoft Entra ID (Azure AD)
Protocol: SCIM 2.0 (System for Cross-domain Identity Management)

Cause

Expired SCIM Secret Token: The bearer token used by the Entra provisioning connector has expired. While the token is expired, all SCIM operations (Create, Update, Delete) return HTTP 401 Unauthorized, leaving the vCenter user list in a "frozen" state.
Desynchronized Provisioning State: Failed setup attempts can lead to a state where Entra ID sends "no-op" PATCH calls, believing the vCenter group memberships are already correct when they are actually empty. This results in users being provisioned but having zero assigned roles/groups.
Invalid Attributes: Special characters (such as &) in user attributes (e.g., Department) can cause HTTP 400 Bad Request errors, blocking the entire synchronization cycle.

Resolution

Follow these steps in the exact order listed. Steps 1 and 2 must be completed first before any other synchronization task will work.

Step 1: Regenerate the SCIM Token in vCenter

Log into the vCenter Server Management Interface (VIDB admin console).
Navigate to Identity & Access Management > SCIM Provisioning.
Click Generate New Bearer Token. Note the new token.

Step 2: Update the Token in the Entra ID Portal

Log into the Entra ID Portal as an Administrator.
Navigate to the Enterprise Application configured for vCenter provisioning.
Go to Provisioning > Edit Provisioning > Admin Credentials.
Paste the new token into the Secret Token field.
Click Test Connection to confirm a 200 OK response, then click Save.

Step 3: Sanitize User Attributes

In the Entra ID Portal, filter users by the affected attribute (e.g., Department containing &).
Rename the attribute to remove special characters (e.g., change "R&D" to "R and D").

Step 4: Force a Full Re-Sync

In the Entra ID Provisioning tab, click Restart Provisioning.
This clears the internal "sync watermark" and forces Entra ID to re-read all group memberships from scratch and send fresh ADD operations to vCenter.

Step 5: Verify Group Membership Confirm the groups are now populated by running a SCIM search query from the vCenter command line: curl -k -X POST -H "Authorization: Bearer <NEW_TOKEN>" -H "Content-Type: application/json" -d '{"filter":"displayName co \"<GROUP_PREFIX>\""}' https://<VCENTER_FQDN>/usergroup/t/CUSTOMER/scim/v2/Groups/.search

Step 6: Validate On-Demand

Select a specific affected user in the Entra Portal under On-demand provisioning.
Verify the user is successfully provisioned and assigned to the correct admin groups.

Additional Information

Provisioning Logs: Always check the "Provisioning Logs" in the Entra portal after a restart. Successful membership updates should show PATCH /Groups operations with explicit ADD member entries.
Attribute Errors: If the sync stops immediately after restarting, check for HTTP 400 errors in the logs, which usually indicate an unsupported character in a user’s metadata.