Azure AD Account Import Issue with signInActivity Attirbute

[ShubhamBabbar]

We are facing issue with the Azure AD Account full import.

While doing the import we see that MS Graph API does not support filter for ‘signInActivity’ with the below error:

ecm-worker,2023-08-11T07:17:33.213+00:00,"{log"":""java.lang.Exception: ResponseStatusCode-400", Failed url-https://graph.microsoft.com/v1.0/users/delta?$select=id,userPrincipalName,displayName,usageLocation,accountEnabled,assignedLicenses,mail,createdDateTime,userType,employeeId,signInActivity\u0026$deltaToken=latest," Error Message - {\""error\"":{\""code\"":\""BadRequest\""","\""message\"":\""Invalid request for delta query: for this entity set"," $expand/$select is not supported for the following properties: signInActivity\""","\""innerError\"":{\""date\"":\""2023-08-11T07:17:32\""","\""request-id\"":\""5ab6d419-0c78-431e-a245-5a4e2c0a5081\""","\""client-request-id\"":\""6d2756e6-24b9-4424-b334-a78dc9e30acb\""}}}\n""","stream:""stdout""","time:""2023-08-11T07:17:32.820096073Z""}"""

Also attaching entire logs.

We are performing a full import but seems like Saviynt makes a delta call, and delta call does not support signInActivity as a selection attribute, we need to import the "lastSignInDateTime" under signInActivity resource type.

The import works fine if we remove signInActivity from ‘ACCOUNT_IMPORT_FIELDS’.
Any possible solutions or workarounds would be very helpful.

[armaanzahir]

Hi @ShubhamBabbar ,

The Microsoft Graph API does not support retrieving SignInActivity information in the DeltaToken API which the OOTB Azure AD connector invokes as a first call while Account import. Hence, it is failing to get the delta token with the error.

Based on the below forum answers, it seems that the same delta token api is invoked both during full as well as incremental imports. 

Right now, you will be able to import only those attributes that are supported in the DeltaToken API while using the OOTB connector.

Error importing by incremental import - Saviynt Forums - 38217

You could try utilizing the Rest connector to achieve your use case of importing this attribute.

[rushikeshvartak]

The Microsoft Graph API does not support retrieving SignInActivity information in the DeltaToken API which Azure AD connector invokes as a first call while Account import. Hence, It is failing to get the delta token with the below error.
And, Azure AD connector uses this delta token while incremental account import to get changes from the last account import.

Invalid request for delta query: for this entity set, $expand/$select is not supported for the following properties: signInActivity

You need to remove the signInActivity attribute from the Account_Import_Fields for import to work.

[ShubhamBabbar · Accepted solution]

Solution implemented:
Either use REST connection to import SignInActivity to accounts field (Note: REST Connector has increased complexities for importing different entitlement types and also does not support AAD Group Management)
OR
Use REST connector for User Import and populate SignInActivity under a user's customproperty. (Preferred solution)