SSO and user provisioning are completely discrete functions; Azure AD/Entra ID has them lumped under the same enterprise app as a convenience, because often you want your newly created users to also be able to log in via SSO, but these features can be used independently from each other. You can update SCIM authorization token without fear of impacting SSO operations, as that token is not used at all for SSO. The previous suggestion to update the token off hours is generally a good one, but more so as a best practice than having a practical impact.
------------------------------
Richard Schott
Genesys - Employees
------------------------------