This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Implementation guide · In review

Building Book 03’s HR Pipeline: Oracle Fusion Cloud HCM to Microsoft Entra ID

An implementation guide: reading Core HCM through HCM Extracts and Atom feeds, the middleware’s five duties, the /bulkUpload contract, the two landing zones, Lifecycle Workflows, and the evidence the pipeline has to leave

Research under review: an implementation guide for building Book 03’s HR-driven provisioning pipeline from Oracle Fusion Cloud HCM to Microsoft Entra ID and Active Directory with API-driven inbound provisioning. It covers what the Federal HR 2.0 solicitation says about identity, how Oracle publishes future-dated hires and separations, the Entra app setup, permissions, limits, logs and quarantine, the attribute mapping from Book 03’s canonical schema to SCIM and the directories, the joiner, mover, leaver, rehire and conversion sequences, build phases mapped to Book 03 and Gate G1, security and privacy, testing and cutover, risks and vendor asks, with illustrative Python and PowerShell that convert and validate an extract.

Status — In review

This page is under review and is not yet part of the workbook's production guidance. Its claims are sourced, but its analysis and any recommendation are the program's working view; they may change before review is complete, and they are not endorsed by any federal agency. Last reviewed 2026-11-09.

Book 03 — HR-Driven Identity sets the design: HR is the source of authority for the person, a middleware in the agency’s boundary does five duties for every event, Microsoft Graph /bulkUpload is the one door into the directory, users land in Active Directory or Entra ID depending on where they are in the migration, and Lifecycle Workflows act on the accounts that provisioning creates. Chapter 06 fixes the canonical schema, and Chapter 12 the phases. This guide shows how to build that pipeline from Oracle Fusion Cloud HCM, the Core HCM platform that Federal HR 2.0 awarded, to Microsoft Entra ID.

NoteAn example, not an endorsement

This guide names two vendors because Book 03’s principal example does. It isn’t an endorsement by any agency, and Book 03’s identity model doesn’t depend on either vendor. Every product, program and solicitation fact was checked against primary sources on October 25, 2026, and is footnoted. Statements marked (design guidance) are the program’s recommendations; statements marked (inference) are conclusions the sources support but don’t state.

The example code: examples/hcm-entra on GitHub. Equivalent Python and PowerShell clients convert an HCM Extract row into a SCIM bulk operation using Chapter 06’s mapping, validate it the way Appendix A asks, and only post to /bulkUpload when told to. They’re illustrative: unit-tested against fixtures, not proven against live tenants.

What it covers

Part	Content
Orientation	Book 03’s pipeline mapped to Oracle and Microsoft components; what the Federal HR 2.0 solicitation says about identity; the two decisions to make first
1. The Entra side	The two provisioning apps, setup, permissions, limits, provisioning logs, job quarantine, Lifecycle Workflows, Microsoft’s Oracle pattern, GCC availability
2. The Oracle side	HCM Extracts, Atom feeds, REST, how future-dated events are published, retention, the integration identity, FedRAMP status
3. The mapping	Book 03’s canonical schema through Oracle, the middleware and SCIM to AD and Entra ID; joiner, mover, leaver, emergency termination, rehire, conversion and cancellation
4. Build and secure	Build phases mapped to Chapter 12 and Gate G1; security and privacy per Appendix B; testing and cutover per Appendix C
Close	The example code, risks, vendor asks, what couldn’t be verified, and the source notes

What the research found

Ten findings change how the pipeline is planned:

• The Federal HR 2.0 solicitation anticipates an identity feed from Core HCM.
  • Its appendix of required integrations includes, in a sample interconnection table for a large department or agency, an “Identity Management Solution”: “Provision identity attributes using Core HCM is the authoritative source for user identity data.”¹
  • It also says the Core HCM Steering Committee “will review and approve any agency-specific integrations requirements.”²
  • The reverse direction appears in the solicitation only as a sample, with no protocol, product or directory named, and Book 03 Chapter 03 now records this. Submit the identity feed to the Steering Committee in Phase 0 (design guidance).
• OPM names its own Entra-based identity solution for the platform. The performance work statement asks the contractor to “Integrate and implement OPM approved identity management solution using OPM MS Entra-based solution.”³ That is the platform’s own sign-in and user provisioning, alongside the SCIM 2.0 requirement Book 03 records;⁴ it says nothing about how the platform feeds an agency’s directory.
• Persistent integrations with OPM-managed systems go through an OPM-hosted API gateway, with OAuth 2.0, rate limiting and IP filtering; exceptions need written approval.⁵ Whether an agency’s identity middleware reads Core HCM directly or through that gateway couldn’t be verified. It decides the middleware’s source authentication and egress, so ask before building it.
• Future-dated hires and separations are hidden from the Atom feed by default.
  • Oracle sets a future-dated entry’s updated date to the effective start date and returns no entries with an updated date past today, unless the client asks by published date.⁶⁷
  • Oracle’s polling guidance makes the client choose: process future-dated entries when they become effective, or immediately.⁸
  • Lifecycle Workflows’ scheduled trigger catches up only three days.⁹ A pipeline that polls by effective date delivers a hire on the start date, too late for any pre-hire workflow set further ahead (inference). Poll by published date and hold the effective dates in the middleware (design guidance).
• Atom feed entries are archived after 60 days and purged after 90 by default.¹⁰ Any feed outage needs a reconciliation by extract; past 90 days the changes are gone.
• Oracle’s integration identity is a named user with a signing key. For Fusion Applications REST paths, Oracle supports authorization code and JWT user assertion flows, says client credentials can be used “only for Spectra services,” and recommends client assertion over client secret.¹¹ Oracle also says not to use REST for change detection or bulk: use Atom feeds and HCM Extracts.¹²
• Microsoft’s two pages disagree on the permission to read provisioning logs. Entra’s guidance grants ProvisioningLog.Read.All;¹³ the Graph v1.0 reference for listing provisioning logs gives AuditLog.Read.All and Directory.Read.All as the least-privileged pair.¹⁴ Test the narrow one first, and keep the log reader a separate identity from the uploader.
• “Quarantine” means two things. Book 03’s quarantine contract holds failed records in the middleware. Microsoft’s quarantine is a state of the whole provisioning job: an empty notification email, invalid credentials, a tripped deletion threshold or a high failure rate puts the job there, cycles slow to daily, and after four weeks the job is disabled.¹⁵¹⁶¹⁷ Each needs its own runbook (design guidance).
• Lifecycle Workflows now writes account state in Active Directory too. The enable, disable and delete tasks can act on synchronized AD users through the provisioning agent.¹⁸¹⁹ So account state has two writers, the pipeline’s active value and the workflow; the pipeline must send active false no later than the leaver workflow’s first run, or a later re-send can undo the workflow’s disable (inference; design guidance).
• Custom security attributes are a new carrier for sensitive HR values. API-driven provisioning can set them on Entra ID users; their values are redacted in provisioning logs, and only attribute-assignment roles can read them.²⁰ They can’t drive dynamic membership,²¹ so access codes stay in extensionAttribute10–12 as Chapter 06 says, and custom security attributes suit sensitive values that no rule reads (design guidance).

The guide keeps Book 03’s architecture unchanged. Chapter 03 has absorbed the corrections in findings 1 and 2; findings 4 and 9 refine what Chapters 03 and 08 say, and the rest add build detail.

Orientation: Book 03’s pipeline on Oracle and Entra

Book 03 component (Chapter 05)	Oracle and Microsoft realization	Where it runs
Authoritative workforce source	Oracle Fusion Cloud HCM: HCM Extracts for bulk, Atom feeds for changes, workers REST for enrichment222324	Oracle’s SaaS (FedRAMP Moderate listing, below)
Boundary transformation and governed model	The middleware: validate, sequence, normalize to SCIM, write provenance, reconcile	Azure Functions or Logic Apps in the agency’s boundary
Provisioning service	Microsoft Graph /bulkUpload on an API-driven provisioning app25	Microsoft Entra provisioning service
Landing zone: Active Directory	API-driven provisioning to on-premises Active Directory, through the Microsoft Entra provisioning agent; then Connect Sync or Cloud Sync to the cloud26	Agent servers with line of sight to domain controllers
Landing zone: Entra ID	API-driven provisioning to Microsoft Entra ID, cloud-only users27	Entra ID
Lifecycle actions	Lifecycle Workflows from employeeHireDate and employeeLeaveDateTime28	Entra ID Governance
Evidence	Provenance store; provisioning logs; workflow history	Agency evidence store

What the solicitation says about identity

Book 03 Chapter 03 records the solicitation’s SCIM 2.0 requirement, the OPM Entra-based solution and the Steering Committee review. The final amendment’s text, read here against the guide’s own needs:

Where	What it says	What it means for the pipeline
Functional Requirements Matrix, Req. 5	SCIM 2.0 provisioning “from the Government’s identity provider (IdP) to the Contractor’s system,” near real time or within an SLA such as 15 minutes, with logging of provisioning events29	Into the platform, not out of it. As Book 03 says
Core implementation, §5.1.1	The platform in FedRAMP Moderate or higher environments; “OPM approved identity management solution using OPM MS Entra-based solution”30	Platform users sign in through OPM’s solution; the agency’s tenant is a separate concern
Strong authentication, §6.6.2	Integrate with OPM’s identity provider and accept a SAML assertion31	Same
Appendix B, integration layer	Persistent connections for OPM-owned integrations through an OPM-hosted API gateway with OAuth 2.0, rate limiting and IP filtering32	Ask whether the agency feed uses it
Appendix B, agency integrations	The Steering Committee approves agency-specific integrations; a sample large-agency interconnection lists an “Identity Management Solution” fed by Core HCM as “the authoritative source for user identity data”33	The identity feed is an expected interconnection; get it approved

The memo’s sample onboarding timeline puts “Interconnection(s) go-live and production setup complete” and “Data Migration for obfuscation” at month 5, UAT “Shadow Mode” in months 6 to 8, and data migration and cutover at month 8.³⁴ Two consequences follow (inference): - Core HCM data before month 8 is obfuscated, so correlation against real employeeId values can’t be proven in Core HCM until cutover unless person numbers survive obfuscation. Correlate against the legacy HR source in Phases 1 to 3. - The platform’s own shadow-mode UAT is the natural window for the pipeline’s shadow mode (Phase 3).

The two decisions to make first

1. How the middleware reads future-dated events. Polling by updated date is simple but delivers each hire and separation on its effective date. Polling by published date delivers it when HR enters it, and the middleware holds the effective date.³⁵³⁶ Book 03’s day-one readiness and pre-separation steps need the second (inference). Recommendation: published-date polling for newhire, termination and cancelworkrelship, with a daily changes-only extract as the reconciliation (design guidance).

2. Which path the middleware takes to Core HCM. Directly to Oracle’s endpoints with an Oracle integration user, or through OPM’s API gateway with whatever credential OPM issues.³⁷ This sets the credential type, the egress allow-list and the rate limits. Settle it with the HR 2.0 program before Phase 2.

Part 1: The Entra side

The provisioning apps

Two gallery applications expose the endpoint: API-driven provisioning to on-premises Active Directory for hybrid users, and API-driven provisioning to Microsoft Entra ID for cloud-only users. Each app has its own endpoint, so an agency creates one per source and per landing zone.³⁸³⁹

Setup step	What to know
Roles	Application Administrator; plus Hybrid Identity Administrator for the AD app40
AD app	Install the provisioning agent, select the domain and the default OU, test the connection41
Notification email	Mandatory. “If the Notification Email is left empty, then the provisioning goes into quarantine when you start the execution”42
Start	Start provisioning puts the job in listen mode; Restart provisioning purges payloads waiting to be processed; Provision on demand “is not supported for API-driven inbound provisioning”43
Endpoint	Copied from View technical information; the portal shows a beta URL, and the Graph reference documents POST /servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/bulkUpload in v1.04445
Custom attributes	Add SCIM extension URNs to the app’s attribute list, then map them; for 20 or more, Microsoft’s CSV2SCIM script has an UpdateSchema mode46
Matching	By default externalId matches employeeId; if no user matches, the job creates one47 48
Deletion	/bulkUpload doesn’t delete users; Microsoft points to the Lifecycle Workflows delete task. Microsoft also advises turning off the Delete target action; in AD a delete is a hard delete49
Clearing values	A preview; send the complete record every time, because an omitted mapped attribute can clear the target50 51

The contract

Property	Value
Request	SCIM BulkRequest, Content-Type: application/scim+json, at most 50 operations52
Response	202 Accepted, with a Location header pointing at the provisioning logs filtered on the job53
Manager	manager.value carries the manager’s externalId; the service resolves it54
Methods	POST only; an update is another POST of the same record55
Throttling	40 calls in any 5-second window per the concepts page; 40 requests per second per the Graph reference. Pace to the stricter5657
Daily cap	2,000 calls per 24 hours with Entra ID P1 or P2; 6,000 with Entra ID Governance58
Licensing	Entra ID P1 for API-driven provisioning;59 Entra ID Governance for Lifecycle Workflows

Permissions

Identity	Permission	Note
Uploader	SynchronizationData-User.Upload.OwnedBy (least privileged) or SynchronizationData-User.Upload	The Graph reference ranks .OwnedBy least privileged; there is no user-assignable directory role for the API, and a User Administrator can call it directly60
Log reader	ProvisioningLog.Read.All; or, per the Graph list page, AuditLog.Read.All and Directory.Read.All	The pages disagree; test the narrow one616263
Not for the middleware	Synchronization.ReadWrite.All, Application.ReadWrite.All	The pause switch belongs to an operator role (Appendix B)

Entra’s guidance frames .OwnedBy for an HR software vendor that creates its own provisioning app, together with Application.ReadWrite.OwnedBy.⁶⁴ Whether an in-house client made owner of a gallery-created app gets the same scoping is worth testing (inference). Microsoft’s CSV2SCIM script also asks for Application.Read.All and Synchronization.Read.All to look up the job;⁶⁵ configuring the endpoint directly avoids both (design guidance). Microsoft recommends certificate authentication or managed identities for production.⁶⁶

Provisioning logs: the reconcile duty

The client reads GET /auditLogs/provisioning, filtered on jobId, cycleId, changeId, sourceIdentity/id or activityDateTime; filters are case-sensitive. Each entry carries provisioningAction (create, update, delete, stageddelete, disable, other), provisioningStatusInfo with error details, the processing steps and the modified properties.⁶⁷⁶⁸ The list API is available in the global service and both US Government clouds.⁶⁹ Match each entry to the source event by externalId, retry transient failures with the complete record, and turn permanent ones into owned exceptions (Chapter 05).

Job quarantine and the deletion threshold

Trigger	What happens	Source
Empty notification email	Quarantine when execution starts	70
Invalid credentials or configuration	Quarantine; one notification email	71
Failure rate	Evaluated from 5,000 failures; quarantine above 40% failed or 40,000 failures (reference failures, such as manager updates, excluded); absolute limit 60,000 including reference failures	72
Disables and deletions over the threshold	Quarantine until an administrator allows or rejects them; held objects appear as StagedAction or StagedDelete	73
While quarantined	Incremental cycles slow to once a day; after more than four weeks the job is disabled	74

Set the deletion threshold on both apps, watch the notification mailbox, and poll the job’s status (design guidance).⁷⁵

Lifecycle Workflows

Topic	What Microsoft documents
Trigger attributes	employeeHireDate and employeeLeaveDateTime, both DateTimeOffset, supported by HR inbound provisioning, Cloud Sync and Connect Sync76
Formats	A custom import to an AD string attribute must use yyyyMMddHHmmss.fZ; Graph expects YYYY-MM-DDThh:mm:ssZ77
Time of day	Hire early in the day (1 AM or 5 AM), leave late (9 PM or 11 PM); the tenant schedule (default every 3 hours) can delay a run; a new hire’s Temporary Access Pass lifetime of 24 hours; know how the source gives time zones78
Triggers	Time based (0 to 180 days), attribute change, group membership change, sign-in inactivity, on-demand; a preview Time based attribute V2 allows 0 to 365 days but “doesn’t have a three-day catch-up window”79
Catch-up	Users whose trigger date passed no more than three days ago are still processed; each user is re-evaluated just before processing80
Synced AD users	Enable, disable and delete tasks act in AD when the task argument is set and the provisioning agent (1.1.1586.0 or later) is installed; deletes need the AD Recycle Bin818283
Temporary Access Pass task	The user must have no other authentication methods, sign-ins or Entra role assignments84

Microsoft’s Oracle pattern

Microsoft’s Oracle HCM guide is the starting point, and Book 03 follows it: an initial load by CSV from HCM Extracts, BI Publisher or Oracle Integration Cloud; deltas by Atom feeds (newhire, empassignment, empupdate, termination, cancelworkrelship, workrelshipupdate), by CSV extracts or by Oracle Integration Cloud; feeds turned on “immediately after your initial sync”; a custom module for validation, unique ID generation, sequencing, conversion and error handling; five to ten records first; hire date from EffectiveStartDate, leave date from EffectiveDate; optional writeback through the Oracle Fusion ERP gallery connector, Update only.⁸⁵

Treat it as a pattern, not a specification (design guidance): - Its introduction says the API can “create, update, and delete users”; the FAQ says /bulkUpload doesn’t delete.⁸⁶⁸⁷ - Its worksheets spell the leave-date URN ...COMPANYAME:1.0:User:TermDate, while the hire date uses COMPANYNAME.⁸⁸ Copy the namespace from one place. - Worksheet 2 maps Oracle Username to SCIM displayName and uses department and division names; its payload example uses DepartmentId and BusinessUnitId.⁸⁹ Chapter 06 decides: codes for access attributes, names for display. - Its writeback setup asks for an Oracle administrator’s username and password.⁹⁰ Writeback is optional in Book 03; defer it.

Microsoft’s samples are starting points too. The Logic Apps template reads the CSV from an Azure file share with an access key, converts it through a third-party function deployed from GitHub with CORS set to *, and leaves log scanning and retry unimplemented; the PowerShell script chunks to 50 records and supports certificate authentication.⁹¹⁹²

GCC

API-driven provisioning became generally available in the US Government cloud in June 2025,⁹³ and Microsoft’s feature table lists it, with provisioning-agent registration for US Government tenants; Entra ID Governance is available in GCC, GCC High and DoD.⁹⁴ Microsoft 365 GCC tenants use the worldwide graph.microsoft.com; GCC High uses graph.microsoft.us and DoD dod-graph.microsoft.us.⁹⁵

Part 2: The Oracle side

Surfaces

Surface	Use in the pipeline	What Oracle documents
HCM Extracts	Initial load; daily reconciliation; lookahead of future-dated records	“The main way to retrieve data in bulk”; CSV, XML and other formats through BI Publisher; output retrieved as a byte stream96
Changes-only extracts	Daily reconciliation	Compares the current data with the baseline from previous runs; needs threading database details set up97
Atom feeds, employee workspace	Changes	/hcmRestApi/atomservlet/employee/<collection>; newhire, empassignment, empupdate, payupdate, termination, cancelworkrelship, workrelshipupdate; triggered for employee, contingent worker and pending worker types98
workers REST	Enrichment only	All worker records as of a date (employee, contingent, pending); not for change detection or bulk99
publicWorkers REST	Public directory data	Active workers today, including nonworkers; addressed by PersonId100
SCIM (/hcmRestApi/scim/...)	Optional writeback of username or work email	Oracle: use it “only … to make necessary changes to HCM data including username or user email”101

Reading the feeds

• Parameters. updated-min/updated-max or published-min/published-max (lower bound exclusive, upper inclusive; ISO 8601 such as 2017-07-14T14:04:00.000Z), page-size, page, orderBy, and archive=yes for archived entries.¹⁰²¹⁰³
• Order and failure. Process entries chronologically, advance the last-processed timestamp only on success, and stop at the first failure.¹⁰⁴ Entries at the same timestamp can come back on the next poll, so processing must be idempotent (inference).
• Future-dated entries. Hidden until effective unless polled by published date (finding 4).¹⁰⁵
• Retention. 60 days to archive, 90 to purge, by default.¹⁰⁶
• Feed configuration. The empassignment feed must be configured to include PeriodOfServiceId in its context, or the context “does not provide enough information.”¹⁰⁷
• Keys. Use PersonNumber: “PersonID can vary across environments.”¹⁰⁸

Lifecycle signals

Event	What Oracle’s entitlement guide shows109	Pipeline action (design guidance)
Hire	newhire, then empassignment for the assignment; appears on the effective date unless polled by published date	Joiner; hold the hire date
Pending worker	newhire with PeriodType P, WorkerType PWK, created before the hire date	Out of scope unless the agency provisions from the pending record
Rehire	A new work relationship for an existing person; “check your data for an existing PersonNumber”	Same externalId: the existing account re-links
Promotion or transfer	empupdate and empassignment with ActionCode PROMOTION or TRANSFER and old and new BusinessUnitId, OrganizationId, PositionId, LocationId, JobId	Mover: re-send the complete record
Termination	termination with ActualTerminationDate	Leaver
Cancelled work relationship	cancelworkrelship with DMLOperation DELETE; “check if the employee has another active work relationship”; no work relationships means terminated	Cancellation or rescinded offer (Appendix A), never a blind leaver

Oracle’s REST pages give worker types as Employee (E), Contingent Worker (C), Pending Worker (P) and Nonworker (N); its feed samples use values such as EMP and PWK, and one sample shows E.¹¹⁰ Map both forms.

The integration identity

Oracle’s OAuth tokens come from the OCI IAM identity domain of the Fusion instance. For Fusion Applications REST paths the supported flows are authorization code, authorization code with PKCE and JWT user assertion; “The Client Credentials grant type can be used only for Spectra services.”¹¹¹ Oracle’s entitlement guide uses JWT for feeds and SCIM.¹¹² So the middleware asserts a dedicated integration user with a private key held in a vault (inference). Give that user a custom role limited to the employee feeds, worker reads and extracts it needs; the SCIM writeback privilege (ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV) only if writeback is in scope.¹¹³ The exact read privileges couldn’t be verified from Oracle’s public pages.

FedRAMP

The FedRAMP Marketplace lists Oracle’s “Fusion Cloud” (package F1603257882) as FedRAMP Certified at Class C, Moderate, on the agency path, certified January 13, 2020, with 9 authorizations as of November 9, 2026; it’s SaaS covering ERP, HCM, supply chain and CX, deployed as a Government Community Cloud.¹¹⁴ The solicitation asks for FedRAMP Moderate or higher.¹¹⁵ Whether OPM’s Core HCM instance runs under that package couldn’t be verified.

Part 3: The mapping

Canonical schema to directory

Canonical field (Chapter 06)	Oracle source	Middleware rule (design guidance)	SCIM attribute	AD	Entra ID
Person number	PersonNumber	Required; at most 16 characters (the employeeId limit);116 or the enterprise person key (Chapter 04)	externalId	employeeID	employeeId
Employment active	Assignment status; termination	Active and suspended statuses true; inactive false at the effective time; future hires false until day one	active	accountDisabled	accountEnabled
Names	workers.names, DisplayName	Display only; displayName at most 256 characters117	name.givenName, name.familyName, displayName	givenName, sn, cn	givenName, surname, displayName
Job title	JobName	Display only; at most 128 characters118	title	title	jobTitle
Department	Department name	At most 64 characters119	enterprise department	department	department
Division, cost center	Business unit, cost center	Name or code, chosen once	enterprise division, costCenter	division, —	employeeOrgData
Region code	Duty station, through the crosswalk	Code list; no native property fits	extension regionCode	extensionAttribute4	extensionAttribute4
Cost center code	Cost center	Code list; a mirror, because dynamic membership rules can’t read employeeOrgData	extension costCenterCode	extensionAttribute5	extensionAttribute5
Division code	Business unit	Code list; a mirror, because administrative-unit rules and the mover trigger can’t read employeeOrgData	extension divisionCode	extensionAttribute6	extensionAttribute6
Legal employer	Legal employer	At most 64 characters120	enterprise organization	company	companyName
Manager	Manager’s person number	Not self; unresolved never blocks a joiner; a separated manager is a finding	enterprise manager.value	manager (DN)121	manager
Worker type	WorkerType	Unknown refused; pending and nonworker scoped separately	extension workerType	employeeType	employeeType
Worker type code	same	EMP, CTR	extension workerTypeCode	extensionAttribute11	extensionAttribute11
Job code	Job code		extension JobCode	extensionAttribute1	extensionAttribute1
Hire date	EffectiveStartDate	Date, early local time and offset, as UTC	extension HireDate	extensionAttribute2, as yyyyMMddHHmmss.fZ	employeeHireDate
Leave date	ActualTerminationDate	Date, late local time and offset, as UTC	extension TermDate	extensionAttribute3, same	employeeLeaveDateTime
Work country	Work address country	ISO country code	addresses[type eq "work"].country	co	country
Organization code	Department ID	Code list	extension orgCode	extensionAttribute10	extensionAttribute10
Position category	Job family or position category	Code list	extension positionCategory	extensionAttribute12	extensionAttribute12
UPN, samAccountName	—	Generated in the app on create only, or by the middleware; the service doesn’t resolve UPN conflicts122	userName (optional)	userPrincipalName, sAMAccountName	userPrincipalName
Email	—	Not sent; the directory generates it	—	generated	mail

The slot assignments are Book 03’s program attribute map (Chapter 06); Microsoft’s Oracle worksheets supply slots 1 to 3.¹²³ Slots 4 to 6 mirror region, cost center and division as codes, because rules can read an extension attribute but not employeeOrgData; the SCIM names regionCode, costCenterCode and divisionCode are this guide’s proposal (design guidance). For AD-landed users, convert the ISO dates in the AD app’s mapping expression to the format Microsoft requires (inference: test the expression in the tenant).^{124 125}

The sequences

• Joiner. The hire arrives at entry (published-date polling). The middleware sends the complete record with HireDate and active false, so the account exists disabled before day one, as Appendix C’s first acceptance row requires (design guidance). On the hire date, one writer enables it: the middleware re-sends with active true, or the day-one workflow’s enable task does it (for synced users, through the agent).¹²⁶
• Mover. empassignment or empupdate arrives; the middleware re-sends the complete record; dynamic groups re-evaluate; an attribute-change workflow can start the residual-access review.
• Leaver. The termination arrives at entry. The middleware sends TermDate with active still true, so pre-separation workflows can run, then sends active false at the effective time, no later than the leaver workflow’s first run. The workflow runs Chapter 09’s sequence: disable, revoke refresh tokens, the custom task extension for the card system and Intune, removals; deletion later through the delete task, never /bulkUpload.¹²⁷
• Late separation. A termination whose effective date passed more than three days ago misses the scheduled trigger; run the leaver workflow on demand.¹²⁸
• Emergency termination. The on-demand workflow with the same sequence, and an immediate active false from the middleware. For AD-landed users the disable reaches Entra ID only after the next sync, so the session-revocation step is what closes the gap (inference).
• Rehire. newhire for an existing PersonNumber; the same externalId re-links the existing account if it still exists.¹²⁹¹³⁰
• Conversion. Oracle’s change-worker-type process keeps the person number (Chapter 04); the worker type and its code change and access re-derives.
• Cancellation. Check for another active work relationship before treating cancelworkrelship as a leaver;¹³¹ a rescinded pre-hire is disabled and disposed under Appendix A.

Part 4: Build and secure

Build phases mapped to Book 03

Book 03 phase	Work on this stack	Exit evidence
0 — Program alignment	Name the identity feed in the integration inventory; submit it to the Core HCM Steering Committee; settle the direct-or-gateway question; request a sandbox and the integration-user model	Inventory signed; Steering Committee request logged
1 — Attribute authority and schema	Fix the mapping above against a sandbox extract; decide published-date polling; code lists; confirm slots 1–6 and 10–12 free; populate employeeId on existing accounts; decide pending and contingent-worker scope	Signed schema; correlation threshold met
2 — Pipeline build and test	Middleware in the boundary; an AD app and an Entra app per source; uploader and log reader as separate identities; Oracle integration user with JWT assertion; notification mailbox; deletion threshold; workflows and custom task extensions; the example’s validation rules	Joiner, mover and leaver end to end in a test tenant with provenance; Microsoft’s five-to-ten-record trial
3 — Hybrid go-live (pilot)	Provisioning agents under a gMSA; the full extract first, feeds immediately after;132 shadow mode, aligned with the platform’s shadow-mode UAT	Every difference explained; zero unmatched creations
4 — Automation	Leavers first; the on-demand path for late separations; pre-hire workflows only after published-date polling is proven	Zero missed leavers across a pay period
5 — Cutover	Switch the source contract to Core HCM at the agency’s month-8 cutover; retarget populations from the AD app to the Entra app	Seven-day sole-source proof (Appendix C)
6 — Sustain	Daily changes-only reconciliation; alerts on feed lag and job quarantine	Metrics on the continuous-monitoring cadence

Gate G1. Book 00’s Foundation gate requires that “HR-to-cloud provisioning is operational for the foundation scope, and the attribute slots in use are confirmed free and single-writer” (Book 00, Chapter 09). On this stack the evidence is: the foundation population flowing through /bulkUpload from the current HR source, since Core HCM may not be live yet; provisioning-log reconciliation clean; slots 1–6 and 10–12 written only by the provisioning service; and the notification email and deletion threshold set on both apps. Produce the same evidence again when the source switches to Core HCM (design guidance).

Security and privacy

Concern	On this stack
Uploader	.OwnedBy upload permission; owner of its app; nothing else133
Log reader	A separate identity with the provisioning-log permission (finding 7)
Entra credential	Managed identity or certificate, as Microsoft recommends for production.134 A Microsoft 365 GCC tenant uses the worldwide Entra service;135 a managed identity in an Azure Government subscription belongs to a different tenant, so middleware hosted there needs a certificate credential (inference)
Oracle credential	JWT user assertion signed by a vault-held key for a dedicated integration user; no client secret136
Operational logs	Person key and payload hash only (Appendix B). In Logic Apps, Secure Inputs and Secure Outputs hide run-history data, but several built-in actions, including Parse JSON, Compose and For each, don’t support Secure Outputs.137 Prefer Azure Functions for record handling, or restrict run-history access (design guidance)
Sensitive values	Custom security attributes for values no rule reads; redacted in provisioning logs138
Write paths	One writer per attribute and per account state: the pipeline’s active and the workflow’s disable task coordinated (finding 9)
Guards	Deletion threshold on both apps;139 the middleware’s large-delta hold; the Delete target action off140
Interconnection terms	The memo’s month-1 interagency agreement141 and the solicitation’s integration security requirements (FISMA, the Privacy Act, FedRAMP, SP 800-53)142 are where the feed’s data-exchange terms belong (inference)

Testing and cutover

• Acceptance. Each Appendix C scenario becomes a fixture row and a tenant test: a hire two weeks out (account exists, disabled), a reassignment, a separation, leave without pay (kept), a cancelled separation, a conversion, a record that fails validation.
• Microsoft’s sequence. Start the job, send five to ten records, check matching in the logs, then send the full extract and turn on the feeds.¹⁴³
• Dry run. The example clients’ default mode computes every operation and refuses bad records without writing anything.
• Sole-source proof. Seven days of provisioning logs compared with the directory audit log (Appendix C).
• Rollback. Pause the job, which keeps its state, from an operator role. Don’t use Restart: it purges the staged payloads.¹⁴⁴

The example code

examples/hcm-entra has two equivalent clients, python/hcm_to_scim.py (standard library only) and powershell/HcmToScim.psm1 with Invoke-HcmToScim.ps1. Both read config/mapping.json, which holds the mapping above (the slot 4 to 6 rows for region, cost center and division codes are listed there, but the clients don’t emit them yet), the code lists and the validation rules. The folder also holds the correlation tool that Gate 2 depends on, in the same two forms (python/hcm_correlate.py; powershell/HcmCorrelation.psm1 with Invoke-HcmCorrelation.ps1): it checks that every enabled account matches exactly one worker record and that each matched record agrees with the directories, and its README describes it.

What it does	Book 03 rule
Builds the complete SCIM record: core, enterprise and one extension namespace; dates as UTC ISO 8601	Chapter 05, normalize; Chapter 06
Refuses missing columns, keys longer than 16 characters, unknown or pending worker types, unknown statuses, codes off the list, values over Graph’s limits, self-managers, and inactive records without a leave date	Fail closed; Appendix A quarantine contract
Keeps leave-without-pay active; sends future hires disabled; lets a separation win over a same-run mover; flags a separating manager and a separation older than the catch-up window	Appendix A; Appendix C
Orders leavers first and managers before reports; batches of at most 50	Block first; the /bulkUpload contract
Writes a report with person keys and payload hashes only, and a quarantine file with the unchanged record	Appendix B logging
Holds the run when disables exceed a threshold	Appendix B pause switch
With --apply only: posts with a bearer token from the environment, to an allow-listed Graph /bulkUpload URL, paced under the documented limit, honoring Retry-After, stopping at the first failure	Chapter 05

On the fixture extract (19 fictional rows) both clients produce 9 operations, 9 quarantined records and 1 superseded record, with identical payload hashes. The tests ran 70 pytest cases and 62 Pester 5 cases on November 8, 2026 (45 and 40 at first publication), all passing. They prove the code does what its README says against the fixtures, not that a tenant or an Oracle extract behaves the same way. The clients don’t read Atom feeds, hold future-dated events, write provenance or read the provisioning logs back; those are the rest of the middleware.

Control states, change safety and assessment mapping

The workbook’s conventions for implementation procedures are defined once in Book 00, Appendix D; this section applies them to the pipeline above without adding product claims.

Control states.

State	This page	Evidence
Designed	The two decisions; Part 3; phases 0 and 1 of the build phases	Signed schema; the polling and gateway decisions recorded; Steering Committee request
Configured	Part 1 and Part 2; phase 2	The provisioning apps’ exported mappings and scoping; config/mapping.json and its commit; uploader and log-reader permissions; deletion threshold and notification email set on both apps
Enforced	Phases 4 and 5: the pipeline is the only writer of account state for its population	Seven-day sole-source proof (Appendix C); the single-writer check on slots 1–6 and 10–12
Evidenced	Testing and cutover; the Gate G1 evidence	Acceptance test records with provisioning-log entries matched by externalId; zero missed leavers across a pay period
Operated	Phase 6	Named pipeline owner; daily changes-only reconciliation; alerts on feed lag and job quarantine; last reconciliation record

A finding this page addresses is ready for closure when every applicable state has evidence; the authorizing official or assessor decides.

How-template coverage.

Subsection	Where this guide covers it
Prerequisites	The provisioning apps (roles, licensing), Permissions, GCC, The integration identity
Pilot	Phase 3 (hybrid go-live in shadow mode); Microsoft’s five-to-ten-record trial in Testing and cutover
Report-only or audit phase	The example clients’ dry run, and phase 3’s shadow mode, where every difference is explained before the pipeline writes
Enforcement	Phases 4 (leavers first) and 5 (cutover to Core HCM); change safety below
Rollback	Testing and cutover: pause the job from an operator role; never Restart
Exclusions	Pending workers, nonworkers and contingent workers scoped by decision in phase 1; emergency access accounts outside the pipeline’s scope (below)
Telemetry	Provisioning logs; job quarantine notifications and job status
Evidence	The checklist below
Day-two ownership	Phase 6; help-desk and operating cadence in Book 15

Change safety

Ring	Scope	Exit criteria
0	Test tenant and fixture extract (phase 2)	Joiner, mover and leaver end to end with provenance; the dry run refuses every bad record
1	Five to ten records, then the foundation population in shadow mode (phase 3)	Every difference explained; zero unmatched creations
2	Leavers automated (phase 4)	Zero missed leavers across a pay period
3	Every in-scope worker, source switched to Core HCM (phase 5)	Seven-day sole-source proof

• Emergency access: emergency access accounts are cloud-only and have no HR record, so they stay outside every provisioning app’s scope and no workflow targets them (design guidance); confirm before ring 1 that no scoping rule or Lifecycle Workflow reaches them. Their design is Book 04, Chapter 04.
• Change window: each ring and the month-8 source switch run under an approved change, with the identity engineer and an operator who holds the pause switch on hand (design guidance).
• Backout triggers: the job enters quarantine; staged disables or deletions exceed the deletion threshold; the middleware’s large-delta hold fires; an unmatched creation appears in the provisioning log (program decision, settled as WD-150).
• Post-change validation: the provisioning-log reconciliation for the ring’s population, and the Appendix C acceptance rows re-run.

Evidence checklist

• Configuration: exported attribute mappings and scoping of both provisioning apps; config/mapping.json and its commit; deletion threshold and notification email settings
• Operational: provisioning-log reconciliation runs, quarantine notifications and feed-lag alerts, kept on the continuous-monitoring cadence
• Test: the Appendix C acceptance scenarios, expected and observed outcome, date, tester, with their provisioning-log entries
• Exception: the quarantine file of refused records, each with an owner; scope decisions for pending, contingent and nonworker records
• Assessor-ready artifact: the seven-day sole-source proof and the Gate G1 evidence, traceable to the four above

NoteAssessment mapping

• Microsoft Zero Trust pillar: Identity
• CISA ZTMM pillar: Identity
• Depends on: the HR source as authority (Book 03); access derived from the attributes (attribute-driven migration guide); SecOps for the quarantine and feed-lag alerts
• Attack chain interrupted: Persistence and Initial Access through accounts that outlive employment (leavers disabled on time); Privilege Escalation through access left behind by a move

Risks

Risk	Rating	Mitigation (design guidance)
Future-dated events polled by effective date miss pre-hire and pre-separation workflows	High	Published-date polling with middleware-held dates; a lookahead extract; a test hire ten days out
A feed outage longer than 60 or 90 days loses changes	High	Alert on poll lag; daily changes-only reconciliation; a full extract after any gap
The identity feed isn’t approved as an agency integration, or must move behind OPM’s gateway late	High	Phase 0 Steering Committee request; settle the gateway question before building source authentication
Obfuscated data hides correlation defects until month 8	Medium	Correlate against the legacy HR source in Phases 1 to 3; re-baseline at cutover
The provisioning-log permission is broader than planned	Medium	A separate reader identity; test the narrow permission first
Job quarantine stalls provisioning quietly	Medium	A monitored notification mailbox; job-status polling; a runbook separate from the middleware’s quarantine
The pipeline and Lifecycle Workflows both write account state	Medium	active false no later than the leaver workflow’s first run; the workflow as backstop
A URN typo or a name-versus-code mix-up breaks a mapping	Medium	One namespace constant; mapping tests like the example’s
Personal data in Logic Apps run history	Medium	Functions for record handling; restricted run-history access
Writeback stores an Oracle administrator password	Medium	Defer writeback; if needed, a least-privileged account and vault-managed rotation
The V2 time-based trigger has no catch-up	Low	The standard trigger for leavers, or the on-demand runbook

Vendor asks

1. HR 2.0 program: is the agency identity feed an approved agency-specific integration, and does it go through OPM’s API gateway? With what authentication, IP allow-listing and rate limits?
2. OPM and Oracle: which integration surfaces will agencies get on the shared platform (Atom feeds, HCM Extracts, REST), and with what integration-user model and privileges?
3. OPM and Oracle: do person numbers survive the month-5 obfuscated migration?
4. OPM and Oracle: under which FedRAMP package, and at what impact level, does the Core HCM instance run?
5. Oracle: the shared platform’s Atom archive and purge settings; whether a published-min query returns current and future entries together; the exact privileges a read-only integration role needs.
6. Oracle: will the agency’s Core HCM configuration record contingent workers (Book 03’s open item)?
7. Microsoft: reconcile ProvisioningLog.Read.All with the Graph page’s AuditLog.Read.All and Directory.Read.All; and the two throttling figures.
8. Microsoft: does SynchronizationData-User.Upload.OwnedBy scope correctly for an in-house client made owner of a gallery-created app?
9. Microsoft: correct the Oracle guide’s COMPANYAME URN and its delete statement; confirm whether custom security attributes of type Integer and Boolean are supported (the page lists them as supported, and its troubleshooting table says they aren’t set).¹⁴⁵

What couldn’t be verified

• Oracle’s US Government Cloud specifics for Fusion Applications. Oracle’s government pages on oracle.com refused automated access (HTTP 403); they weren’t retried another way.
• The read privileges for an Oracle integration role. Oracle’s public pages opened don’t name them.
• Which FedRAMP package covers OPM’s Core HCM instance, and whether agency integrations pass through OPM’s API gateway.
• Whether person numbers survive obfuscation at month 5.
• How Oracle sets published for a future-dated entry. Oracle’s example shows it equal to updated; no sentence states the rule. Also the Atom page-size limits.
• A national-cloud table for /bulkUpload. The API reference has none; availability rests on Microsoft’s feature table and announcement.
• Tenant behavior of everything above. The example code is tested against fixtures only.

Status and review

In review. Every claim was checked on October 25, 2026, against these sources: - Microsoft Learn: API-driven inbound provisioning, the Graph API references, provisioning quarantine and deletion prevention, custom security attributes, Lifecycle Workflows and Logic Apps security - Oracle’s Fusion Cloud HCM documentation: Atom feeds, REST resources, OAuth, HCM Extracts and the entitlement-integration guide - the December 2025 Federal HR 2.0 memo, OPM’s Core HCM page and the final amendment of the Core HCM solicitation on SAM.gov - FedRAMP Marketplace data

To move this guide to Proved: - Build the pipeline in a test tenant against an Oracle sandbox. - Run the example clients against a real extract and the provisioning logs. - Record the evidence on this page.

This page names two vendors to illustrate Book 03’s vendor-neutral design; it isn’t an endorsement by any agency. Comments and corrections are welcome as issues on GitHub.

Related: Book 03 — HR-Driven Identity, Book 02 — Identity & Directory, Book 00, Chapter 09, and the implementation guide Integrating ServiceNow and SailPoint, whose drift reconciliation reads the same HR extract.

Version and revision history

Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.

Versions of this guide, newest first

Version	Edition	Date	Changes
2.0	2026.11.5	2026-11-08	Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Guides A: fix confirmed crosswalk errors (book count, PS-7 row, Chapter 03 absorbed findings, slots 4-6, VK-ARC-01 and 04 descriptions) (#411); Figures, kit and config: Entra Domain Services diagram, CLM figure, Book 17 figures, hcm-entra slots 4-6, NPI apply hash and operator (#418); Guides A: fix 14 inconsistency findings (#441); Approve 116 gated pages (Nov 7); fix RMF map stale-review test (#457); Consistency read D: Books 15-19, guides, non-book pages (#483); Approve 15 gated pages (Nov 8, after the consistency read) (#490)
1.3	2026.11.4	2026-11-05	Deck and audio links point at edition 2026.11.4
1.2	2026.11.3	2026-11-05	Review gate: Mike’s approval of the 15 implementation guides gated on November 3 (#348)
1.1	2026.11.1	2026-11-01	Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282)
1.0	2026.11	2026-11-01	Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269)

Footnotes

1. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

2. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

3. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.1.1, Core HCM Platform Readiness (p. 26: environments FedRAMP Moderate or higher; “Integrate and implement OPM approved identity management solution using OPM MS Entra-based solution”; a single OPM ATO), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

4. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement Appendix A, Functional Requirements Matrix, Req. 5 (p. 59: SCIM 2.0; create, update and deactivate from the Government’s identity provider; near real time or within an SLA, for example 15 minutes; logging and audit), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view; attachment list https://sam.gov/api/prod/opps/v3/opportunities/ed2202dc51c34f6c9941aa5f9e99d4a2/resources, accessed October 25, 2026.

5. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

6. Oracle, REST API for Oracle Fusion Cloud HCM, “Manage Date Effective Entries” (“future-dated events have the updated date attribute set to the effective start date”; “By default, no entries with updated date past the current date are returned”; when entries appear), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Handling_Date_Effective_Entry.html, accessed October 25, 2026.

7. Oracle, REST API for Oracle Fusion Cloud HCM, “Read a Feed” (updated-min, updated-max, published-min, published-max; lower bound exclusive, upper inclusive; ISO 8601; archive=yes), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Reading_a_Feed.html, accessed October 25, 2026.

8. Oracle, REST API for Oracle Fusion Cloud HCM, “Poll a Feed” (process future-dated events when effective, using updated, or immediately, using published; chronological processing; stop on failure), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Polling_a_Feed.html, accessed October 25, 2026.

9. Microsoft Learn, “Lifecycle workflow execution conditions and scheduling” (trigger types; 0–180 days; V2 preview 0–365 days without the catch-up window; three-day catch-up; schedule every three hours by default; re-evaluation before processing), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-execution-conditions, accessed October 25, 2026.

10. Oracle, REST API for Oracle Fusion Cloud HCM, “Manage Archive and Purge Settings” (“60 days for archive and 90 days for purge”), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Manage_Archive_and_Purge_Settings.html, accessed October 25, 2026.

11. Oracle, REST API for Oracle Fusion Cloud HCM, “Configure OAuth” (tokens from the OCI IAM identity domain; authorization code, PKCE and JWT user assertion for Fusion Applications paths; client credentials only for Spectra services; client assertion recommended over client secret), https://docs.oracle.com/en/cloud/saas/human-resources/farws/configure_oauth.html, accessed October 25, 2026.

12. Oracle, REST API for Oracle Fusion Cloud HCM, “Workers REST Endpoints” (records as of a date; employee, contingent and pending workers; HCM Data Loader and HCM Extracts for bulk; Atom feeds, not REST, for detecting changes), https://docs.oracle.com/en/cloud/saas/human-resources/farws/api-workers.html, accessed October 25, 2026.

13. Microsoft Learn, “Grant access to the inbound provisioning API” (service principal or managed identity; ProvisioningLog.Read.All and SynchronizationData-User.Upload; Application.ReadWrite.OwnedBy and SynchronizationData-User.Upload.OwnedBy for HR software vendors; certificate authentication or managed identities for production), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-grant-access, accessed October 25, 2026.

14. Microsoft Learn, “List provisioningObjectSummary,” Microsoft Graph v1.0 (GET /auditLogs/provisioning; application least privilege AuditLog.Read.All and Directory.Read.All; $filter, $orderby, $top, $skiptoken, case-sensitive; global, US Government L4 and L5), https://learn.microsoft.com/en-us/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0, accessed October 25, 2026.

15. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

16. Microsoft Learn, “Application provisioning in quarantine status” (causes; cycles reduced to daily; disabled after four weeks; escrow evaluation from 5,000 failures, 40% or 40,000, absolute 60,000; retries at 6, 12 and 24 hours), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-quarantine-status, accessed October 25, 2026.

17. Microsoft Learn, “Enable accidental deletions prevention in the Microsoft Entra provisioning service” (threshold counts disables and deletions, evaluated per cycle; quarantine; Allow deletes; StagedAction and StagedDelete), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/accidental-deletions, accessed October 25, 2026.

18. Microsoft Learn, “Lifecycle Workflows tasks and definitions” (Enable, Disable and Delete user with enableOnPremisesAccount, disableOnPremisesAccount and deleteOnPremisesAccount; users with Entra role assignments not supported; Temporary Access Pass task requirements), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-tasks, accessed October 25, 2026.

19. Microsoft Learn, “Managing Users synchronized from Active Directory Domain Services to Microsoft Entra ID with Lifecycle Workflows” (user account tasks need the provisioning agent, at least 1.1.1586.0, with the HR-driven provisioning extension; gMSA permissions; AD Recycle Bin for deletes), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-on-premises, accessed October 25, 2026.

20. Microsoft Learn, “Provision custom security attributes from HR sources” (API-driven provisioning to Entra ID; String, Integer and Boolean in prerequisites, Boolean and Integer not set per troubleshooting; single-valued; values redacted in provisioning logs; viewing needs Attribute Assignment roles), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-custom-security-attributes, accessed October 25, 2026.

21. Microsoft Learn, “Assign, update, list, or remove custom security attributes for a user,” FAQ (“custom security attributes assigned to users aren’t supported for configuring rules for dynamic membership groups”), https://learn.microsoft.com/en-us/entra/identity/users/users-custom-security-attributes, accessed October 25, 2026.

22. Oracle, Oracle Fusion Cloud HCM: HCM Extracts, “Introduction to HCM Extracts” (the main bulk retrieval tool; BI Publisher formats including CSV; Extract Actions and BI ScheduleService output as a byte stream), https://docs.oracle.com/en/cloud/saas/human-resources/fahex/introduction-to-hcm-extracts.html, accessed October 25, 2026.

23. Oracle, REST API for Oracle Fusion Cloud HCM, “Employee Feeds” (URL format; collections and triggers; “Feeds are triggered only for employee, contingent worker, and pending worker types”), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Employee_Atom_Feeds.html; and “Working with Atom,” https://docs.oracle.com/en/cloud/saas/human-resources/farws/Working_with_Atom.html, accessed October 25, 2026.

24. Oracle, REST API for Oracle Fusion Cloud HCM, “Workers REST Endpoints” (records as of a date; employee, contingent and pending workers; HCM Data Loader and HCM Extracts for bulk; Atom feeds, not REST, for detecting changes), https://docs.oracle.com/en/cloud/saas/human-resources/farws/api-workers.html, accessed October 25, 2026.

25. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

26. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

27. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

28. Microsoft Learn, “API-driven inbound provisioning concepts” (end-to-end flow; complete record in every request; clearing values preview; 40 calls in any 5-second window; 2,000 or 6,000 calls per 24 hours; up to 50 operations per call; provisioning logs API; Lifecycle Workflows from employeeHireDate and employeeLeaveDateTime), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts, accessed October 25, 2026.

29. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement Appendix A, Functional Requirements Matrix, Req. 5 (p. 59: SCIM 2.0; create, update and deactivate from the Government’s identity provider; near real time or within an SLA, for example 15 minutes; logging and audit), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view; attachment list https://sam.gov/api/prod/opps/v3/opportunities/ed2202dc51c34f6c9941aa5f9e99d4a2/resources, accessed October 25, 2026.

30. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.1.1, Core HCM Platform Readiness (p. 26: environments FedRAMP Moderate or higher; “Integrate and implement OPM approved identity management solution using OPM MS Entra-based solution”; a single OPM ATO), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

31. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §6.6.1 and §6.6.2 (p. 48: event logs to OPM’s SIEM in real time; integration with OPM’s identity provider and SSO, accepting a SAML assertion), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

32. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

33. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

34. Office of Management and Budget and Office of Personnel Management, Creating “Federal HR 2.0” by Consolidating Core Human Capital Management Across the Federal Government, December 10, 2025, Appendix B, sample timeline (month 1 interagency agreement; month 5 “Interconnection(s) go-live and production setup complete” and “Data Migration for obfuscation”; months 6–8 “UAT Testing (Shadow Mode)”; month 8 data migration and cutover), https://www.opm.gov/chcoc/latest-memos/creating-federal-hr-20-by-consolidating-core-human-capital-management-across-the-federal-government.pdf, accessed October 25, 2026.

35. Oracle, REST API for Oracle Fusion Cloud HCM, “Poll a Feed” (process future-dated events when effective, using updated, or immediately, using published; chronological processing; stop on failure), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Polling_a_Feed.html, accessed October 25, 2026.

36. Oracle, REST API for Oracle Fusion Cloud HCM, “Manage Date Effective Entries” (“future-dated events have the updated date attribute set to the effective start date”; “By default, no entries with updated date past the current date are returned”; when entries appear), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Handling_Date_Effective_Entry.html, accessed October 25, 2026.

37. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

38. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

39. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

40. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

41. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

42. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

43. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

44. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

45. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

46. Microsoft Learn, “Extend API-driven provisioning to sync custom attributes” (SCIM extension URNs in the app’s attribute list; UpdateSchema for 20 or more attributes), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-custom-attributes, accessed October 25, 2026.

47. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

48. Microsoft Learn, “Index the employeeId attribute in Active Directory to improve provisioning performance” (employeeId is the default matching property for inbound provisioning to AD, including API-driven provisioning; it isn’t indexed by default), https://learn.microsoft.com/entra/identity/app-provisioning/index-employeeid-attribute-entra-id-to-active-directory, accessed November 9, 2026.

49. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

50. Microsoft Learn, “API-driven inbound provisioning concepts” (end-to-end flow; complete record in every request; clearing values preview; 40 calls in any 5-second window; 2,000 or 6,000 calls per 24 hours; up to 50 operations per call; provisioning logs API; Lifecycle Workflows from employeeHireDate and employeeLeaveDateTime), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts, accessed October 25, 2026.

51. Microsoft Learn, “Clear attribute values” (preview for API-driven inbound provisioning; with Flow null values on, an omitted attribute clears the mapped target value; include the complete source record in every bulk request), https://learn.microsoft.com/entra/identity/app-provisioning/clear-attribute-values, accessed November 9, 2026.

52. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

53. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

54. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

55. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

56. Microsoft Learn, “API-driven inbound provisioning concepts” (end-to-end flow; complete record in every request; clearing values preview; 40 calls in any 5-second window; 2,000 or 6,000 calls per 24 hours; up to 50 operations per call; provisioning logs API; Lifecycle Workflows from employeeHireDate and employeeLeaveDateTime), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts, accessed October 25, 2026.

57. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

58. Microsoft Learn, “API-driven inbound provisioning concepts” (end-to-end flow; complete record in every request; clearing values preview; 40 calls in any 5-second window; 2,000 or 6,000 calls per 24 hours; up to 50 operations per call; provisioning logs API; Lifecycle Workflows from employeeHireDate and employeeLeaveDateTime), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts, accessed October 25, 2026.

59. Microsoft Learn, “Microsoft Entra licensing” (API-driven provisioning with Entra ID P1, P2, Governance and Suite), https://learn.microsoft.com/en-us/entra/fundamentals/licensing, accessed October 25, 2026.

60. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

61. Microsoft Learn, “Grant access to the inbound provisioning API” (service principal or managed identity; ProvisioningLog.Read.All and SynchronizationData-User.Upload; Application.ReadWrite.OwnedBy and SynchronizationData-User.Upload.OwnedBy for HR software vendors; certificate authentication or managed identities for production), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-grant-access, accessed October 25, 2026.

62. Microsoft Learn, “List provisioningObjectSummary,” Microsoft Graph v1.0 (GET /auditLogs/provisioning; application least privilege AuditLog.Read.All and Directory.Read.All; $filter, $orderby, $top, $skiptoken, case-sensitive; global, US Government L4 and L5), https://learn.microsoft.com/en-us/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0, accessed October 25, 2026.

63. Microsoft Learn, “Microsoft Graph permissions reference” (ProvisioningLog.Read.All: “Read all provisioning log data”), https://learn.microsoft.com/en-us/graph/permissions-reference, accessed October 25, 2026.

64. Microsoft Learn, “Grant access to the inbound provisioning API” (service principal or managed identity; ProvisioningLog.Read.All and SynchronizationData-User.Upload; Application.ReadWrite.OwnedBy and SynchronizationData-User.Upload.OwnedBy for HR software vendors; certificate authentication or managed identities for production), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-grant-access, accessed October 25, 2026.

65. Microsoft Learn, “API-driven inbound provisioning with PowerShell script” (CSV2SCIM; chunks of 50; certificate authentication; Application.Read.All and Synchronization.Read.All to look up the job; previous-cycle logs; -RestartService only for testing), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-powershell, accessed October 25, 2026.

66. Microsoft Learn, “Grant access to the inbound provisioning API” (service principal or managed identity; ProvisioningLog.Read.All and SynchronizationData-User.Upload; Application.ReadWrite.OwnedBy and SynchronizationData-User.Upload.OwnedBy for HR software vendors; certificate authentication or managed identities for production), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-grant-access, accessed October 25, 2026.

67. Microsoft Learn, “List provisioningObjectSummary,” Microsoft Graph v1.0 (GET /auditLogs/provisioning; application least privilege AuditLog.Read.All and Directory.Read.All; $filter, $orderby, $top, $skiptoken, case-sensitive; global, US Government L4 and L5), https://learn.microsoft.com/en-us/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0, accessed October 25, 2026.

68. Microsoft Learn, “provisioningObjectSummary resource type,” Microsoft Graph v1.0 (properties and filters; provisioningAction values), https://learn.microsoft.com/en-us/graph/api/resources/provisioningobjectsummary?view=graph-rest-1.0, accessed October 25, 2026.

69. Microsoft Learn, “List provisioningObjectSummary,” Microsoft Graph v1.0 (GET /auditLogs/provisioning; application least privilege AuditLog.Read.All and Directory.Read.All; $filter, $orderby, $top, $skiptoken, case-sensitive; global, US Government L4 and L5), https://learn.microsoft.com/en-us/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0, accessed October 25, 2026.

70. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

71. Microsoft Learn, “Application provisioning in quarantine status” (causes; cycles reduced to daily; disabled after four weeks; escrow evaluation from 5,000 failures, 40% or 40,000, absolute 60,000; retries at 6, 12 and 24 hours), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-quarantine-status, accessed October 25, 2026.

72. Microsoft Learn, “Application provisioning in quarantine status” (causes; cycles reduced to daily; disabled after four weeks; escrow evaluation from 5,000 failures, 40% or 40,000, absolute 60,000; retries at 6, 12 and 24 hours), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-quarantine-status, accessed October 25, 2026.

73. Microsoft Learn, “Enable accidental deletions prevention in the Microsoft Entra provisioning service” (threshold counts disables and deletions, evaluated per cycle; quarantine; Allow deletes; StagedAction and StagedDelete), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/accidental-deletions, accessed October 25, 2026.

74. Microsoft Learn, “Application provisioning in quarantine status” (causes; cycles reduced to daily; disabled after four weeks; escrow evaluation from 5,000 failures, 40% or 40,000, absolute 60,000; retries at 6, 12 and 24 hours), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-quarantine-status, accessed October 25, 2026.

75. Microsoft Learn, “Configure provisioning using Microsoft Graph APIs,” Step 5, “Monitor provisioning” (each synchronization job returned by GET /servicePrincipals/{id}/synchronization/jobs carries the status of the current cycle; provisioning logs for events), https://learn.microsoft.com/entra/identity/app-provisioning/application-provisioning-configuration-api, accessed November 9, 2026.

76. Microsoft Learn, “How to synchronize attributes for Lifecycle workflows” (DateTimeOffset attributes supported by HR inbound provisioning, Cloud Sync and Connect Sync; AD string format yyyyMMddHHmmss.fZ; Graph format; time of day; tenant schedule; Temporary Access Pass lifetime; time zones), https://learn.microsoft.com/en-us/entra/id-governance/how-to-lifecycle-workflow-sync-attributes, accessed October 25, 2026.

77. Microsoft Learn, “How to synchronize attributes for Lifecycle workflows” (DateTimeOffset attributes supported by HR inbound provisioning, Cloud Sync and Connect Sync; AD string format yyyyMMddHHmmss.fZ; Graph format; time of day; tenant schedule; Temporary Access Pass lifetime; time zones), https://learn.microsoft.com/en-us/entra/id-governance/how-to-lifecycle-workflow-sync-attributes, accessed October 25, 2026.

78. Microsoft Learn, “How to synchronize attributes for Lifecycle workflows” (DateTimeOffset attributes supported by HR inbound provisioning, Cloud Sync and Connect Sync; AD string format yyyyMMddHHmmss.fZ; Graph format; time of day; tenant schedule; Temporary Access Pass lifetime; time zones), https://learn.microsoft.com/en-us/entra/id-governance/how-to-lifecycle-workflow-sync-attributes, accessed October 25, 2026.

79. Microsoft Learn, “Lifecycle workflow execution conditions and scheduling” (trigger types; 0–180 days; V2 preview 0–365 days without the catch-up window; three-day catch-up; schedule every three hours by default; re-evaluation before processing), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-execution-conditions, accessed October 25, 2026.

80. Microsoft Learn, “Lifecycle workflow execution conditions and scheduling” (trigger types; 0–180 days; V2 preview 0–365 days without the catch-up window; three-day catch-up; schedule every three hours by default; re-evaluation before processing), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-execution-conditions, accessed October 25, 2026.

81. Microsoft Learn, “Lifecycle Workflows tasks and definitions” (Enable, Disable and Delete user with enableOnPremisesAccount, disableOnPremisesAccount and deleteOnPremisesAccount; users with Entra role assignments not supported; Temporary Access Pass task requirements), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-tasks, accessed October 25, 2026.

82. Microsoft Learn, “Managing Users synchronized from Active Directory Domain Services to Microsoft Entra ID with Lifecycle Workflows” (user account tasks need the provisioning agent, at least 1.1.1586.0, with the HR-driven provisioning extension; gMSA permissions; AD Recycle Bin for deletes), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-on-premises, accessed October 25, 2026.

83. Microsoft Learn, “Microsoft Entra Connect Provisioning Agent: Version release history” (1.1.1586.0, released May 13, 2024), https://learn.microsoft.com/entra/identity/app-provisioning/provisioning-agent-release-version-history, accessed November 9, 2026.

84. Microsoft Learn, “Lifecycle Workflows tasks and definitions” (Enable, Disable and Delete user with enableOnPremisesAccount, disableOnPremisesAccount and deleteOnPremisesAccount; users with Entra role assignments not supported; Temporary Access Pass task requirements), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-tasks, accessed October 25, 2026.

85. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

86. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

87. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

88. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

89. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

90. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

91. Microsoft Learn, “API-driven inbound provisioning with Azure Logic Apps” (CSV from an Azure file share with an access key; the CSVtoJSONcore function deployed from GitHub with CORS set to *; managed identity; log scanning and retry not implemented in the sample), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-logic-apps, accessed October 25, 2026.

92. Microsoft Learn, “API-driven inbound provisioning with PowerShell script” (CSV2SCIM; chunks of 50; certificate authentication; Application.Read.All and Synchronization.Read.All to look up the job; previous-cycle logs; -RestartService only for testing), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-powershell, accessed October 25, 2026.

93. Microsoft Learn, “Archive for Microsoft Entra releases and announcements,” June 2025 (“API-driven provisioning is now generally available in US Gov cloud”; custom security attributes from HR sources generally available), https://learn.microsoft.com/en-us/entra/fundamentals/whats-new-archive, accessed October 25, 2026.

94. Microsoft Learn, “Microsoft Entra feature availability” (HR provisioning apps: API-driven inbound provisioning; provisioning agent registration for US Government tenants; Entra ID Governance in GCC, GCC High and DoD), https://learn.microsoft.com/en-us/entra/identity/authentication/feature-availability, accessed October 25, 2026.

95. Microsoft Learn, “Microsoft Graph national cloud deployments” (Microsoft 365 GCC uses the worldwide endpoints; GCC High graph.microsoft.us; DoD dod-graph.microsoft.us; US Government token endpoint login.microsoftonline.us), https://learn.microsoft.com/en-us/graph/deployments, accessed October 25, 2026.

96. Oracle, Oracle Fusion Cloud HCM: HCM Extracts, “Introduction to HCM Extracts” (the main bulk retrieval tool; BI Publisher formats including CSV; Extract Actions and BI ScheduleService output as a byte stream), https://docs.oracle.com/en/cloud/saas/human-resources/fahex/introduction-to-hcm-extracts.html, accessed October 25, 2026.

97. Oracle, Oracle Fusion Cloud HCM: HCM Extracts, “How can I create a changes only extract?” (comparison with baseline data from previous runs; threading database details), https://docs.oracle.com/en/cloud/saas/human-resources/fahex/how-can-i-create-a-changes-only-extract.html, accessed October 25, 2026.

98. Oracle, REST API for Oracle Fusion Cloud HCM, “Employee Feeds” (URL format; collections and triggers; “Feeds are triggered only for employee, contingent worker, and pending worker types”), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Employee_Atom_Feeds.html; and “Working with Atom,” https://docs.oracle.com/en/cloud/saas/human-resources/farws/Working_with_Atom.html, accessed October 25, 2026.

99. Oracle, REST API for Oracle Fusion Cloud HCM, “Workers REST Endpoints” (records as of a date; employee, contingent and pending workers; HCM Data Loader and HCM Extracts for bulk; Atom feeds, not REST, for detecting changes), https://docs.oracle.com/en/cloud/saas/human-resources/farws/api-workers.html, accessed October 25, 2026.

100. Oracle, REST API for Oracle Fusion Cloud HCM, “Public Workers REST Endpoints” (active workers as of today, public information, including nonworkers; addressed by PersonId), https://docs.oracle.com/en/cloud/saas/human-resources/farws/api-public-workers.html, accessed October 25, 2026.

101. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

102. Oracle, REST API for Oracle Fusion Cloud HCM, “Read a Feed” (updated-min, updated-max, published-min, published-max; lower bound exclusive, upper inclusive; ISO 8601; archive=yes), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Reading_a_Feed.html, accessed October 25, 2026.

103. Oracle, REST API for Oracle Fusion Cloud HCM, “Poll a Feed” (process future-dated events when effective, using updated, or immediately, using published; chronological processing; stop on failure), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Polling_a_Feed.html, accessed October 25, 2026.

104. Oracle, REST API for Oracle Fusion Cloud HCM, “Poll a Feed” (process future-dated events when effective, using updated, or immediately, using published; chronological processing; stop on failure), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Polling_a_Feed.html, accessed October 25, 2026.

105. Oracle, REST API for Oracle Fusion Cloud HCM, “Manage Date Effective Entries” (“future-dated events have the updated date attribute set to the effective start date”; “By default, no entries with updated date past the current date are returned”; when entries appear), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Handling_Date_Effective_Entry.html, accessed October 25, 2026.

106. Oracle, REST API for Oracle Fusion Cloud HCM, “Manage Archive and Purge Settings” (“60 days for archive and 90 days for purge”), https://docs.oracle.com/en/cloud/saas/human-resources/farws/Manage_Archive_and_Purge_Settings.html, accessed October 25, 2026.

107. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

108. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

109. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

110. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

111. Oracle, REST API for Oracle Fusion Cloud HCM, “Configure OAuth” (tokens from the OCI IAM identity domain; authorization code, PKCE and JWT user assertion for Fusion Applications paths; client credentials only for Spectra services; client assertion recommended over client secret), https://docs.oracle.com/en/cloud/saas/human-resources/farws/configure_oauth.html, accessed October 25, 2026.

112. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

113. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

114. General Services Administration, FedRAMP Marketplace data, products.json (package F1603257882, Oracle, “Fusion Cloud”: FedRAMP Certified, Class C, Moderate, agency path, certified January 13, 2020, SaaS, Government Community Cloud; 10 authorizations on October 25, 2026, 9 on November 9, 2026, when the data reported the impact level as Unknown for every listing), https://www.fedramp.gov/marketplace/products.json, data as of October 25, 2026, accessed October 25, 2026; re-read November 9, 2026.

115. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.1.1, Core HCM Platform Readiness (p. 26: environments FedRAMP Moderate or higher; “Integrate and implement OPM approved identity management solution using OPM MS Entra-based solution”; a single OPM ATO), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

116. Microsoft Learn, “user resource type,” Microsoft Graph v1.0 (employeeId at most 16 characters; department and companyName 64; jobTitle 128; displayName 256; extension attributes up to 1,024 characters, read-only in the cloud for synced users), https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0, accessed October 25, 2026.

117. Microsoft Learn, “user resource type,” Microsoft Graph v1.0 (employeeId at most 16 characters; department and companyName 64; jobTitle 128; displayName 256; extension attributes up to 1,024 characters, read-only in the cloud for synced users), https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0, accessed October 25, 2026.

118. Microsoft Learn, “user resource type,” Microsoft Graph v1.0 (employeeId at most 16 characters; department and companyName 64; jobTitle 128; displayName 256; extension attributes up to 1,024 characters, read-only in the cloud for synced users), https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0, accessed October 25, 2026.

119. Microsoft Learn, “user resource type,” Microsoft Graph v1.0 (employeeId at most 16 characters; department and companyName 64; jobTitle 128; displayName 256; extension attributes up to 1,024 characters, read-only in the cloud for synced users), https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0, accessed October 25, 2026.

120. Microsoft Learn, “user resource type,” Microsoft Graph v1.0 (employeeId at most 16 characters; department and companyName 64; jobTitle 128; displayName 256; extension attributes up to 1,024 characters, read-only in the cloud for synced users), https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0, accessed October 25, 2026.

121. Microsoft Learn, “Troubleshoot HR manager update issues with HR user provisioning” (in on-premises AD the manager attribute stores the manager’s distinguished name; the page is written for the Workday and SAP SuccessFactors apps), https://learn.microsoft.com/entra/identity/app-provisioning/hr-manager-update-issues, accessed November 9, 2026.

122. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

123. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

124. Microsoft Learn, “How to synchronize attributes for Lifecycle workflows” (DateTimeOffset attributes supported by HR inbound provisioning, Cloud Sync and Connect Sync; AD string format yyyyMMddHHmmss.fZ; Graph format; time of day; tenant schedule; Temporary Access Pass lifetime; time zones), https://learn.microsoft.com/en-us/entra/id-governance/how-to-lifecycle-workflow-sync-attributes, accessed October 25, 2026.

125. Microsoft Learn, “Reference for writing expressions for attribute mappings in Microsoft Entra ID,” FormatDateTime (converts a date string from one format to another, with an example using yyyyMMddHHmmss.fZ), https://learn.microsoft.com/entra/identity/app-provisioning/functions-for-customizing-application-data, accessed November 9, 2026.

126. Microsoft Learn, “Lifecycle Workflows tasks and definitions” (Enable, Disable and Delete user with enableOnPremisesAccount, disableOnPremisesAccount and deleteOnPremisesAccount; users with Entra role assignments not supported; Temporary Access Pass task requirements), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-tasks, accessed October 25, 2026.

127. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

128. Microsoft Learn, “Lifecycle workflow execution conditions and scheduling” (trigger types; 0–180 days; V2 preview 0–365 days without the catch-up window; three-day catch-up; schedule every three hours by default; re-evaluation before processing), https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-execution-conditions, accessed October 25, 2026.

129. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

130. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

131. Oracle, Oracle Fusion Cloud HCM Integration with External Entitlement Management Systems (PersonNumber over PersonID; empassignment configured with PeriodOfServiceId; joiner, mover and leaver feed samples; pending workers; rehire by existing PersonNumber; work relationship cancellation; “Do not use REST API to sync data from HCM”; JWT for feeds and SCIM; SCIM privilege ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV; SCIM only for username or email), https://docs.oracle.com/en/applications/fusion-apps/fusion-human-capital-management/hcmintegration/index.html, accessed October 25, 2026.

132. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

133. Microsoft Learn, “Perform bulkUpload,” Microsoft Graph v1.0 (40 requests per second; 50 operations; application least privilege SynchronizationData-User.Upload.OwnedBy, higher SynchronizationData-User.Upload; no user-assignable directory role, User Administrator can invoke; application/scim+json; 202 Accepted with Location; manager.value is the manager’s externalId), https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-post-bulkupload?view=graph-rest-1.0, accessed October 25, 2026.

134. Microsoft Learn, “Grant access to the inbound provisioning API” (service principal or managed identity; ProvisioningLog.Read.All and SynchronizationData-User.Upload; Application.ReadWrite.OwnedBy and SynchronizationData-User.Upload.OwnedBy for HR software vendors; certificate authentication or managed identities for production), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-grant-access, accessed October 25, 2026.

135. Microsoft Learn, “Microsoft Graph national cloud deployments” (Microsoft 365 GCC uses the worldwide endpoints; GCC High graph.microsoft.us; DoD dod-graph.microsoft.us; US Government token endpoint login.microsoftonline.us), https://learn.microsoft.com/en-us/graph/deployments, accessed October 25, 2026.

136. Oracle, REST API for Oracle Fusion Cloud HCM, “Configure OAuth” (tokens from the OCI IAM identity domain; authorization code, PKCE and JWT user assertion for Fusion Applications paths; client credentials only for Spectra services; client assertion recommended over client secret), https://docs.oracle.com/en/cloud/saas/human-resources/farws/configure_oauth.html, accessed October 25, 2026.

137. Microsoft Learn, “Secure access and data for workflows in Azure Logic Apps” (Secure Inputs and Secure Outputs; built-in operations that don’t support them, including Parse JSON, Compose and For each; IP restriction on run-history content), https://learn.microsoft.com/en-us/azure/logic-apps/set-up-security-permissions, accessed October 25, 2026.

138. Microsoft Learn, “Provision custom security attributes from HR sources” (API-driven provisioning to Entra ID; String, Integer and Boolean in prerequisites, Boolean and Integer not set per troubleshooting; single-valued; values redacted in provisioning logs; viewing needs Attribute Assignment roles), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-custom-security-attributes, accessed October 25, 2026.

139. Microsoft Learn, “Enable accidental deletions prevention in the Microsoft Entra provisioning service” (threshold counts disables and deletions, evaluated per cycle; quarantine; Allow deletes; StagedAction and StagedDelete), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/accidental-deletions, accessed October 25, 2026.

140. Microsoft Learn, “Frequently asked questions about API-driven inbound provisioning” (endpoint format; matching on externalId and employeeId; UPN conflicts not handled; one app per source; no deletion through /bulkUpload; disable the Delete target action; AD deletes are hard deletes; POST only; writeback options), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-faqs, accessed October 25, 2026.

141. Office of Management and Budget and Office of Personnel Management, Creating “Federal HR 2.0” by Consolidating Core Human Capital Management Across the Federal Government, December 10, 2025, Appendix B, sample timeline (month 1 interagency agreement; month 5 “Interconnection(s) go-live and production setup complete” and “Data Migration for obfuscation”; months 6–8 “UAT Testing (Shadow Mode)”; month 8 data migration and cutover), https://www.opm.gov/chcoc/latest-memos/creating-federal-hr-20-by-consolidating-core-human-capital-management-across-the-federal-government.pdf, accessed October 25, 2026.

142. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B, Required Data Migration and System Integrations (pp. 82–83: integration security and privacy requirements; OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering, exceptions approved by the CO and COR; p. 88: the Core HCM Steering Committee reviews and approves agency-specific integrations; p. 95: Sample Interconnection for Large Department/Agency, “Identity Management Solution: Provision identity attributes using Core HCM is the authoritative source for user identity data”), SAM.gov, https://sam.gov/workspace/contract/opp/8cfe1844758c4fb2b10f5ef192b62f89/view, accessed October 25, 2026.

143. Microsoft Learn, “Configure Oracle Human Capital Management (HCM) for automatic user provisioning” (initial sync by CSV; deltas by Atom feeds, CSV extracts or Oracle Integration Cloud; the six feed collections; feeds on immediately after the initial sync; custom module duties; EffectiveStartDate and EffectiveDate; five to ten records first; worksheets 1–6; writeback through the Oracle Fusion ERP connector with an admin username and password), https://learn.microsoft.com/en-us/entra/identity/saas-apps/oracle-hcm-provisioning-tutorial, accessed October 25, 2026.

144. Microsoft Learn, “Configure API-driven inbound provisioning app” (the two gallery apps; roles; agent and default OU for AD; mandatory notification email or quarantine; Start, Stop, Restart and Edit provisioning; Provision on demand not supported), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-configure-app, accessed October 25, 2026.

145. Microsoft Learn, “Provision custom security attributes from HR sources” (API-driven provisioning to Entra ID; String, Integer and Boolean in prerequisites, Boolean and Integer not set per troubleshooting; single-valued; values redacted in provisioning logs; viewing needs Attribute Assignment roles), https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-custom-security-attributes, accessed October 25, 2026.