Microsoft Is Ending Basic Authentication for SAP SuccessFactors Provisioning — November 2026 Deadline

What Microsoft Changed in June 2026

Microsoft's June 2026 Entra release notes direct organizations using basic authentication for SAP SuccessFactors provisioning integrations to move to workload identity-based authentication before November 2026.

Basic authentication, in this context, means the provisioning connector authenticates to SuccessFactors using a stored username and password.

The distinction matters operationally. Basic credentials can be shared, copied, and forgotten in configuration files. The November 2026 cutoff turns that authentication design into a current business-continuity decision.

Confirmed and What Requires Verification

Microsoft confirms the authentication change and deadline. Each organization still needs to verify which connectors, tenant variants, middleware components, and stored credentials are in scope before changing production.

The Operational Risk If You Miss This

The Microsoft Entra provisioning service integrates with SAP SuccessFactors Employee Central to manage the full identity lifecycle: new hire onboarding, attribute mapping, and write-back to SuccessFactors. That integration is what breaks when basic authentication stops working.

A new employee starts on a Monday. HR creates the record in SuccessFactors. The provisioning connector — the automated bridge between SuccessFactors and Entra ID — is supposed to create or update the user account and synchronize the mapped identity attributes. If that connector is still using basic credentials after November 2026, it stops authenticating. The account is never created. The employee has no access to email, systems, or applications on day one.

The same failure mode applies to every joiner-mover-leaver event: role changes that should update access, terminations that should revoke it, attribute synchronization that feeds Conditional Access policy decisions. These are not manual fallbacks — they are automated dependencies. When the authentication layer breaks, the entire HR-to-IT provisioning handoff breaks with it.

This is a scheduled service cutoff with a published date, not a theoretical risk.

The Migration Decision: In-House or Engage a Partner

The migration involves four distinct work areas:

1. 1. Authentication reconfiguration. Replace the basic credential on each SuccessFactors provisioning connector with a service principal registered in Microsoft Entra ID. This requires creating the service principal, assigning the correct API permissions, and updating the connector configuration.

1. 2. Provisioning behavior testing. Behavior at the SCIM endpoint should be tested in a non-production tenant before any production change. Attribute mappings, write-back fields, and provisioning scope rules need to be verified against the new authentication method.

1. 3. Conditional Access policy review. Workload identity service principals are governed differently than user accounts. Existing Conditional Access policies may not cover the new service principals correctly. Review and update policies to ensure the migrated connectors are governed, not inadvertently excluded.

1. 4. Credential storage cleanup. After migration, stored basic credentials — in configuration files, middleware layers, API gateway settings, or third-party connector configurations — should be identified and removed. Leaving stale credentials in place creates a security exposure even after the provisioning connector has been updated.

For a small IT team without a dedicated IAM engineer, steps two through four are where scope uncertainty tends to accumulate. Document the full integration architecture before scoping the work.

The in-house versus partner decision comes down to two questions: Does your team have hands-on experience with Entra service principal configuration and SCIM endpoint testing? And can you complete the work — including non-production testing and production cutover — before November 2026 with your current capacity? If the answer to either question is uncertain, begin scoping with an integration partner now.

What to Audit Now

The following audit steps are Metrotechs recommendations based on the cited Microsoft Entra architecture and the confirmed November 2026 deadline.

• Enumerate all SuccessFactors provisioning integrations in Microsoft Entra and confirm which authenticate via basic credentials versus workload identity. Check the Enterprise Applications blade in the Entra admin center and review provisioning connector configurations for each SuccessFactors app.

• Document the full integration architecture. Map every layer: the Entra provisioning connector, any middleware or iPaaS platform sitting between Entra and SuccessFactors, API gateway endpoints, and every location where SuccessFactors credentials are stored. Third-party connectors may hold credentials independently of the Entra configuration. Verify at Microsoft Learn and the SAP Help Portal before finalizing migration scope.

• Review Conditional Access policies to ensure workload identity service principals will be governed correctly after migration.

• Identify who owns the migration — internal IT, a systems integrator, or SAP/Microsoft support — and confirm timeline feasibility against the November 2026 cutoff. If ownership is unclear, resolve it this week.

• Test SCIM 2.0 endpoint behavior in a non-production tenant before executing any production migration. Validate attribute mappings, write-back fields, and provisioning scope under workload identity authentication before touching production connectors.

What to Watch Before November

Watch the Microsoft Entra What's New page and the Microsoft Tech Community SAP on Azure blog for any updates to the November deadline, tenant-type scope clarifications, or tooling changes that affect the migration path. If Microsoft publishes a migration assistant or updated connector tooling before the cutoff, it will appear in those channels first.

The deadline is fixed. The work is scoped. The only variable is when you start.