Creation of logical application in AzureAD connector

[anjali_5]

I want to create an endpoint for an AzureAD based logical application which will fetch users and roles in to Saviynt through AzureAD connection. The connection type is AzureAD. Can we create an endpoint for this logical application  through Endpoint filter parameter in Saviynt ? Also, can provisioning/deprovisioning of access be done for this endpoint ?

[rushikeshvartak]

• Yes endpoint filter will create logical applications 
• and provisioning will be done for logical and technical applications using same azuread connector

[anjali_5]

Thanks Rushikesh.

Do the groups under AzureAD logical application need to be present in AzureAD before we perform groups import process in Saviynt?

[rushikeshvartak]

Not mandatory. whenever its created after recon it will be filtered

[anjali_5]

We have AzureAD connector for add/remove access. Now we are seeing the below error. Is this error throwing from Azure AD application? or is there any issue at our connector configuration?

{"auditDetails":{"AADGroup":[{"headers":null,"message":{"error":{"code":"Request_ResourceNotFound","message":"Resource '255a0d0d-4369-43ea-838c-960d5a6c5143' does not exist or one of its queried reference-property objects are not present.","innerError":{"date":"2024-09-05T07:10:03","request-id":"559f192f-670e-4e25-b58a-ff5ff369c8a7","client-request-id":"559f192f-670e-4e25-b58a-ff5ff369c8a7"}}},"statusCode":404,"description":null,"status":"Failed"}]},"AADGroup":{"headers":null,"message":{"error":{"code":"Request_ResourceNotFound","message":"Resource '255a0d0d-4369-43ea-838c-960d5a6c5143' does not exist or one of its queried reference-property objects are not present.","innerError":{"date":"2024-09-05T07:11:00","request-id":"74eef95a-c94c-42a2-97e4-32554fd8abd7","client-request-id":"74eef95a-c94c-42a2-97e4-32554fd8abd7"}}},"statusCode":404,"description":null,"status":"Failed"}}

[rushikeshvartak]

• Azure Security groups is deleted from azure ad 

[anjali_5]

Another issue : User is having an existing AzureAD account . Now I am requesting for an Azurebased logical application to be assigned to that same user. After request is approved, new account task and add access task are created for that logical endpoint . But running provisioning jo, the tasks are still in pending task  and new account task has an provisioning comment provided below

ERROR:

{"call1":{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"Another object with the same value for property userPrincipalName already exists.","details":[{"code":"ObjectConflict","message":"Another object with the same value for property userPrincipalName already exists.","target":"userPrincipalName"}],"innerError":{"date":"2024-09-06T05:23:48","request-id":"xxxxxxxxxxxxxxxx","client-request-id":"xxxxxxxxxxxxxxxxxxxxxxxxx"}}},"statusCode":400,"description":null,"status":"Failed"}}

What does this error mean and how to resolve it ?

[rushikeshvartak]

Use entitlementsOnly under secuirty system

[anjali_5]

Can you please elaborate ?

[rushikeshvartak]

[anjali_5]

Add access task has been created for one endpoint and got completed also. User got the access of AzureAD endpoint . But add access task for other endpoint under AzureAD is still in pending task without any provisioning comment .

[rushikeshvartak]

Run WsRETRY for specific task and share logs