Separate identifiers from contact details
SCIM distinguishes the service provider’s id from a client-supplied externalId. For a local mapping, specify the source system and tenant beside the source identity. Email can change or be reused, so use it as a contact/matching clue only under an explicit policy.
| Source scope | Source ID | Current email | Target |
|---|---|---|---|
| Tenant A | U-15 | new-address@example.invalid | Existing account T-51 |
| Tenant A | U-16 | old-address@example.invalid | Different account; no email-based takeover |
| Tenant B | U-15 | another@example.invalid | Separate scoped identity |
Review collisions without merging silently
Store the target identifier after creation. If the same source scope/ID points to two targets, hold writes and inspect mapping history. If a contact changes, update the existing target under the fixed identity rather than creating a new account.
A new employee receives a former employee’s mailbox. Should old access follow the email?
Show the worked answer
No. Resolve the new source identity and provision approved access separately. Preserve the former identity’s lifecycle history; mailbox reuse is not authorisation.