Incident Overview

On July 10, 2026, customers using SCIM public preview with Active Directory integration experienced degraded connector performance. Impact was limited to tenants with an AD group containing a very large membership (thousands of users) that underwent a membership change during the incident window. Affected connectors saw CPU and memory utilization rise to critical levels, impairing their ability to process other requests, including logins. 

• Start: July 9, 2026, approximately 11:00 PM Central (July 10, 4:00 AM UTC) 

• End: July 13, 2026, approximately 8:00 PM Central (July 14, 1:00 AM UTC) 

Root Cause and Remediation

SCIM functionality, previously available through private preview, was promoted to public preview on June 24, 2026. To satisfy the SCIM protocol, the SCIM service maintains a partial copy of Active Directory's user and group data, built from change notifications streamed from AD. When SCIM received a membership-change notification for a group it had not yet fully populated, it queried AD for the group's entire membership rather than the specific change. For customers with very large AD groups, this generated a high volume of queries through the customer's connector, overwhelming it. Tenants with public preview enabled received the SCIM feature automatically, so environments not actively using SCIM were also exposed. 

To remediate, SCIM was disabled for affected customers after confirming they were not actively using it, and SCIM public preview was disabled on July 13 as a precaution while a permanent fix was validated. The service was updated so that a single membership-change notification triggers a query for only that change, not the group's full membership. The fix was deployed by end of day July 13, and SCIM public preview was re-enabled on July 14, 2026 at 8:00 AM Central. No action was required from customers. 

Preventative Actions

• Expand testing to include large-scale AD group scenarios before future preview promotions. 

• Add monitoring for abnormal connector-directed API call volume, so similar issues are detected before customer impact. 

We sincerely apologize for the disruption this caused and the inconvenience to your operations. We are committed to preventing recurrence through the above actions.