REST connector to recon AzureAD accounts and entitlements

[Community_User]

Originally posted on May 28 2020 at 09:06 UTC

Hi - Seeking help with JSON for ImportAccountEntJSON block in the REST connector for AzureAD. I absolutely understand Saviynt has an OOTB connector to recon AzureAD accounts and entitlements. But my challenge with the OOTB AzureAD connector, it does not support filters. And I need to use filters since we have just one AzureAD tenant with production data. Hence exploring the REST connector to import just the test accounts and entitlements with help of filters. I managed to build the JSON for ImportUser block with filters and it works just fine. But having a tough time constructing the JSON for ImportAccountEntJSON block. Any help is appreciated.

[Community_User]

Originally posted on June 2 2020 at 16:29 UTC

Hi Leslie,

Filter is supported for azure ad accounts from v5.5SP2 release. Since building JSONs to fetch entitlements, account_entitlements, entitlement2 mapping for all the entitlements that we support will be very complex and also we can't support below use cases using REST connector.

• Fetching both owners and members of azure ad groups and differentiating them as privileges.
• Fetching role assignments for users, groups, service principals to service principals and oauth2permissiongrants between client and resource applications.
• Support for incremental account and access import for group entitlement.
• Capability to handle deleted users, group membership/ownership, deleted groups use cases.
• Support for Lifecycle management of Azure AD Groups.
• Fetching teams, channels, member permissions and guest permissions.

So we aren't supporting importing Azure AD using REST Connector as we already have a dedicated connector built for it

[Community_User]

Originally posted on June 2 2020 at 16:32 UTC

Hi Leslie,

Filter is supported for azure ad accounts from v5.5SP2 release. Building JSONs to fetch entitlements, account_entitlements, entitlement2 mapping for all the entitlements that we support will be very complex and also we can't support below use cases using REST connector.

• Fetching both owners and members of azure ad groups and differentiating them as privileges.
• Fetching role assignments for users, groups, service principals to service principals and oauth2permissiongrants between client and resource applications.
• Support for incremental account and access import for group entitlement.
• Capability to handle deleted users, group membership/ownership, deleted groups use cases.
• Support for Lifecycle management of Azure AD Groups.
• Fetching teams, channels, member permissions and guest permissions.

So we aren't supporting importing Azure AD using REST Connector as we already have a dedicated connector built for it

[Community_User · Accepted solution]

Originally posted on June 3 2020 at 06:33 UTC

Hi Lokesh,

I so appreciate the time taken to respond. I'm happy to know AzureAD connector will support Filters from 5.5PS2 onwards. As you know AzureAD does not have have an OU like structure as we see in MS AD to pull only those data that we need, its key to have Filters in the connector to substitute the same.

Also, thanks for sharing the limitations of the REST connector with respect to AzureAD

Regards,

Leslie

[Community_User]

Originally posted on November 2 2020 at 13:03 UTC

Hello

What is the exact format we can use to apply filter in Azure AD connector for accounts?

[Community_User]

Originally posted on March 9 2021 at 10:32 UTC

Hi,

Can someone please share the sample account entitlement import json for Azure AD with the syntax for filters.

Appreciate your help.

Thanks

[Community_User]

Originally posted on March 9 2021 at 10:47 UTC

There is an option to apply filter in the connection itself (Accounts filter option)

Try using the normal filter strings it works