Support declared SCIM authentication methods

.gitattributes

@@ -3,6 +3,10 @@
 ###############################################################################
 * text=auto
 
+Microsoft.SCIM.LogicAppValidationTemplate/StandardLogicApp/VERSION text eol=lf
+Microsoft.SCIM.LogicAppValidationTemplate/StandardLogicApp/*_Workflow.json text eol=lf
+Microsoft.SCIM.LogicAppValidationTemplate/StandardLogicApp/Orchestrator_Parameters.json text eol=lf
+
 ###############################################################################
 # Set default behavior for command prompt diff.
 #

.gitignore

@@ -9,6 +9,9 @@
 *.userosscache
 *.sln.docstates
 
+# Local SCIM onboarding run evidence and deployment overlays
+scimrun-v*/
+
 # User-specific files (MonoDevelop/Xamarin Studio)
 *.userprefs
 

Microsoft.SCIM.LogicAppValidationTemplate/README.md

@@ -6,6 +6,29 @@ This document explains:
 1. Input parameters and what values are expected.
 2. Each test: what it does, key steps, wait times, and how success/failure is determined.
 
+## Standard Logic App agent: authentication-aware validation
+
+Use the canonical [SCIM onboarding agent](StandardLogicApp/scim-onboarding.agent.md) and its complete, same-revision bundle. The Standard implementation deploys **seven workflows**: Orchestrator, Initialization, UserTests, GroupTests, SCIMTests, Authentication, and the shared SCIMToken provider. There are still **25 reportable tests**. [VERSION](StandardLogicApp/VERSION) is the sole overall and agent version; bump it for every bundle change and synchronize `LogicAppVersion`.
+
+At startup, declare the authentication methods actually supported by the endpoint and available in the validation environment:
+
+| Environment | `supportedAuthenticationMethods` | `scimAuthenticationMethod` |
+|-------------|----------------------------------|----------------------------|
+| OAuth only | `["OAuth2ClientCredentials"]` | `OAuth2ClientCredentials` |
+| Federation only | `["WorkloadIdentityFederation"]` | `WorkloadIdentityFederation` |
+| Both | Both gallery method values | Choose which authenticates core SCIM requests |
+| Static token only | `["Bearer"]` | `Bearer` |
+
+The agent accepts initial parameters or asks a specific multiple-choice question, then collects only applicable credentials. Undeclared authentication tests are **Not applicable** and make no token requests. A declared method with missing credentials is blocked/failed, not silently excluded.
+
+The authentication readiness policy is **AND across selected methods**: every declared method must pass its test. An undeclared method is Not applicable; a selected failure cannot be hidden by another success. `Authentication_Workflow` isolates these checks to keep SCIMTests below the 500-action limit. `SCIMTests_Workflow` explicitly forwards `authenticationModelResult`; a missing result fails closed in the Orchestrator. Other mandatory functional failures still block readiness. Static-token-only functional testing produces `NOT_GALLERY_READY`.
+
+For OAuth-only or federation-only runs, set `scimBearerToken` to `""`. The shared token workflow acquires access tokens, and each test suite refreshes its cache before expiry. There is no static-token fallback. Sending an OAuth access token in an HTTP Bearer header does not mean the endpoint supports caller-supplied static tokens. Entra provisioning connectivity is configured and validated separately with the supported method.
+
+See the [Standard setup walkthrough](StandardLogicApp/SetupLogicApp-Standard-Agent.md) and [test overview](StandardLogicApp/SCIM-Validation-Test-Overview.md) for the current behavior. The generic legacy test descriptions below do not override the Standard authentication contract.
+
+The [authentication change guide](StandardLogicApp/Authentication-Changes.md) explains capability selection, token transport, workflow limits, and verification boundaries. Portable reporting is a separate follow-up change.
+
 ---
 
 ## 1. Input Parameters

Microsoft.SCIM.LogicAppValidationTemplate/StandardLogicApp/Authentication-Changes.md

@@ -0,0 +1,98 @@
+# Authentication-aware SCIM validation
+
+## Executive summary
+
+This authentication-first change lets an independent software vendor (ISV)
+declare the authentication methods available in its validation environment.
+Every selected method must pass. An undeclared method is Not applicable and
+does not issue authentication requests.
+
+This change advances [VERSION](VERSION) from 13.0 to 14.0 and synchronizes
+`LogicAppVersion`. Portable JSON/Markdown/ZIP reporting, report collection,
+and agent lifecycle instrumentation are a separate dependent change.
+
+## Scope and behavior
+
+| Concern | Authentication-first behavior |
+|---|---|
+| Capability selection | Accept explicit `supportedAuthenticationMethods`, or ask a specific choice. |
+| Credentials | Collect only credentials for declared methods. Missing selected credentials block readiness. |
+| Readiness | AND across all selected methods; a selected failed, skipped, or missing result cannot be waived. |
+| Undeclared method | Not applicable, with no token acquisition or federation requests. |
+| Direct SCIM transport | Select one declared method using `scimAuthenticationMethod`; this does not deselect the other authentication tests. |
+| Token lifetime | Acquire and refresh OAuth/federation tokens; no static-token fallback. |
+| Static bearer | Connectivity/functional validation only; not gallery-ready without a selected passing gallery method. |
+| Functional tests | Mandatory provisioning failures remain independent blockers. |
+
+For OAuth-only or federation-only runs, set `scimBearerToken` to an empty
+string. Receiving an OAuth access token in an HTTP bearer header does not
+mean that caller-supplied static bearer authentication is supported.
+
+## Workflow architecture
+
+```mermaid
+flowchart TD
+    Agent[Canonical onboarding agent] --> Selection[Declared methods and applicable credentials]
+    Selection --> Provisioning[Entra provisioning connectivity]
+    Selection --> Orchestrator
+    Orchestrator --> Initialization
+    Initialization --> UserTests
+    Initialization --> GroupTests
+    Initialization --> SCIMTests
+    SCIMTests --> Authentication[Authentication child: every selected method must pass]
+    UserTests --> Token[Shared SCIMToken provider]
+    GroupTests --> Token
+    SCIMTests --> Token
+    Token --> Endpoint[Selected token service and SCIM endpoint]
+```
+
+There are seven workflows and 25 reportable tests. Extracting authentication
+keeps the SCIM suite below the platform's 500-action limit. The shared token
+provider supports long-running functional suites without requiring a static
+token. Neither child adds a new gallery test.
+
+| Workflow | Nested actions |
+|---|---:|
+| Authentication | 42 |
+| SCIMTests | 465 |
+| UserTests | 465 |
+| GroupTests | 404 |
+| Initialization | 99 |
+| Orchestrator | 29 |
+| SCIMToken | 27 |
+
+## Worked example
+
+```json
+{
+  "supportedAuthenticationMethods": [
+    "OAuth2ClientCredentials",
+    "WorkloadIdentityFederation"
+  ],
+  "scimAuthenticationMethod": "OAuth2ClientCredentials"
+}
+```
+
+Core SCIM requests use OAuth, but both authentication tests must pass.
+Choosing OAuth transport does not make federation Not applicable. A
+federation-only environment instead declares only federation and needs no
+invented OAuth endpoint.
+
+## Verification and boundaries
+
+Run [Test-Authentication.ps1](Test-Authentication.ps1). It evaluates actual
+workflow expressions, policy combinations, token refresh, protected token
+handling, platform limits, and all 99 direct SCIM request guards.
+
+Use the same-revision [canonical agent](scim-onboarding.agent.md),
+[setup walkthrough](SetupLogicApp-Standard-Agent.md), and
+[test overview](SCIM-Validation-Test-Overview.md). Keep production Graph
+URLs in source; authorized development routing belongs in a private
+deployment overlay.
+
+The earlier combined change set exercised OAuth and exposed group member
+schema incompatibilities and a secondary diagnostic-expression defect.
+That historical run is not certification of this newly separated branch.
+A fresh auth-only validation is required. Live federation success still
+requires a federation-capable endpoint. Do not change unrelated functional
+tests or endpoint policy merely to obtain a passing demonstration.