The Problem
Adobe licensing and entitlements are provisioned through a SCIM bridge from Entra, with identity data flowing from on-premises AD into Entra first. The helpdesk already had a native command to force the AD-to-Entra delta sync, but the second leg, Entra provisioning out to Adobe, ran on its own scheduled interval with no equivalent quick trigger available to them. For routine onboarding that timing was fine, but when access was needed immediately, that final hop became the blocker, costing up to an hour depending on where the schedule landed.
What I Built
A PowerShell utility, requested by a helpdesk supervisor, that completes the picture by triggering the Entra-to-Adobe SCIM provisioning job on demand, giving the helpdesk the same immediacy on the second leg that they already had on the first.
How It Works
- Certificate-based app-only Graph authentication, with no interactive sign-in or stored secrets
- Resolves the Adobe enterprise application by service principal display name
- Retrieves the associated synchronization job and surfaces its status code and last successful execution time, so the operator can see the current state before acting
- Starts the provisioning job immediately
- Manually triggering a SCIM bridge sync is only possible through Microsoft Graph, so this packages that call into a repeatable, operator-friendly tool rather than a one-off API request
- Built as an on-demand utility rather than a scheduled task, since its purpose is handling exceptions rather than routine provisioning
- Documented assumption: the script selects the first synchronization job on the service principal, which assumes a single provisioning job. Environments with multiple jobs would need to select deliberately.
Impact
- Eliminates up to an hour of waiting on scheduled provisioning windows for time-sensitive access requests, depending on where the sync cycle falls
- Gives the helpdesk a direct trigger for a sync that previously required a manual Graph call
- Improves onboarding turnaround for urgent cases