Directory (tenant) GUID. Required to authenticate against a live tenant; not needed for ENTRA_SCIM_DRY_RUN or ENTRA_SCIM_STATIC_TOKEN, which supply their own placeholder.
ENTRA_CLIENT_ID
No
App registration (client) GUID. Required to authenticate against a live tenant; not needed for ENTRA_SCIM_DRY_RUN or ENTRA_SCIM_STATIC_TOKEN.
ENTRA_CLIENT_SECRET
No
Client secret value. For a live tenant set exactly one of ENTRA_CLIENT_SECRET or ENTRA_CLIENT_CERT_PATH; a certificate is preferred for anything long-lived. Secret.
ENTRA_CLIENT_CERT_PATH
No
Path to a PEM holding the certificate and its private key. Set exactly one of ENTRA_CLIENT_SECRET or ENTRA_CLIENT_CERT_PATH.
ENTRA_CLIENT_CERT_PASSWORD
No
Password for the PEM, if it is encrypted. Secret.
ENTRA_SCIM_BASE_URL
No
Override the SCIM base URL (default https://graph.microsoft.com/rp/scim). Point it at the bundled mock to try the tools without a tenant.
ENTRA_SCIM_STATIC_TOKEN
No
Use a fixed bearer token instead of Azure AD. Refuses any microsoft.com/microsoft.us host and requires ENTRA_SCIM_BASE_URL; intended for the local mock only. Secret.
ENTRA_SCIM_DRY_RUN
No
Set to 1 to run every client-side validation and return the request that would have been sent, without sending it or acquiring a token.