Already a NinjaOne customer? Log in to view more guides and the latest updates.

Converting a SCIM-Managed Technician Account to an End User While SCIM Is Active

  • Last Updated November 4, 2026

Issue

A SCIM-managed technician account needs to be converted to an End User because the identity provider (for example, Microsoft Entra ID) now sends userType=endUser for that user. Provisioning fails with HTTP 400: 'UserType for existing user cannot be changed.' The technician account cannot be deleted or edited within NinjaOne, even by a System Administrator, while SCIM provisioning is active.

Environment

NinjaOne SCIM

Cause

SCIM-managed users cannot be edited or deleted directly within NinjaOne while SCIM provisioning is enabled. The user type of an existing SCIM-managed account cannot be changed through the SCIM protocol; the account must be removed and recreated with the correct user type.

Resolution

  1. Temporarily deactivate SCIM provisioning in NinjaOne. Navigate to Administration → Accounts → Identity Providers, select the relevant identity provider, navigate to the SCIM section, click Edit, and deactivate Enable SCIM Provisioning.
  2. Delete the technician account in NinjaOne. With SCIM provisioning deactivated, a System Administrator can delete the account.
  3. Re-enable SCIM provisioning. The identity provider will then provision the user as an End User on its next sync cycle.

Additional Resources

For additional information about SCIM, refer to System for Cross-domain Identity Management (SCIM) Frequently Asked Questions (FAQ).

FAQ

Next Steps