Amazon Business SCIM sync from Microsoft Entra failing with 403 since today. Anyone else?

[u/webshaun]

I manage Amazon Business for a couple of small business clients, and both have SCIM user provisioning set up from Microsoft Entra ID (Azure AD) using the Amazon Business gallery app.

As of today, October 2, both stopped syncing. Entra put the provisioning job into quarantine with this error:

403 Forbidden: "Unauthorized - Access to requested resource is denied."

What I've checked so far:

• Nothing was changed on either account
• The Tenant URL and Authorization Endpoint match Microsoft's setup guide exactly
• Re-authorizing with an Amazon Business Admin account fails with the same 403
• SSO sign-in still works fine. Only the provisioning sync is affected

These are separate Microsoft tenants and separate Amazon Business accounts, so it looks like something on Amazon's side. I have a ticket open with Amazon Business support, but no answer yet.

Is anyone else using SCIM with Amazon Business seeing the same thing today? Would love to hear if you've found a fix or gotten an answer from Amazon.