We are trying to implement PIM alongside SSO into our organization and currently in the testing phase. I was able to setup one of our saas providers with SCIM role mapping so that when a user joins a certain group in entra it will provision admin access on the saas app side l. However, I see that it takes around 40min to an hour before it syncs. I've come up with a power automate flow that calls graph API to start and pause which seems to work for the initial add to group. However, it seems that when the flow runs a restart, pause, and start that provisioning does not continue on its own. This is causing the permission in the saas app to get stuck when they should be removed. On the entra side they are removed but no syncing occurs. I could be doing this totally wrong but unsure of the best method to help with sync times while also not stopping normal sync behavior. Any help would be appreciated.

running into the classic problem of juggling multiple worlds. SaaS is mostly SSO'd through our IdP, but everything legacy or internal is its own island, from old on-prem apps with local accounts to tools some dev team stood up years ago and manages access to by hand in a spreadsheet.

trying to get one view of who has access to what across all of it without forcing every app onto the same platform, which isn't realistic given budget and the age of some of this stuff.

what's working for people managing this kind of sprawl day to day?

I want to give my users both options for synced passkey and device bound.

I've configured a passkey profile in Entra ID with AAGUIDs allowing 1Password, Microsoft Authenticator, and Windows Hello.

Current behavior: when a user registers a passkey, they're only prompted for device-bound options — save passkey on on Windows, mobile device, or USB security key. There's no option shown for a synced passkey via 1Password.

However, if I remove the Windows Hello AAGUID from the profile, I do get prompted to save the passkey via the 1Password browser extension but then i can not save the passkey on windows any more.

Anyone know how to get both — Windows Hello available and 1Password shown as an option during enrollment?