Leveraging Intelligent Recommendations for Operational Transformation. AMS Partners click HERE | EMEA/APJ Partners click HERE |
11/30/2023 02:23 AM
Hi,
We have onboarded Azure AD as an application in Saviynt. As part of the requirements, we need to import the Azure AD accounts and entitlements.
For entitlement import, we need to import the following types of groups:
We have configured the connection and the job to import SKU & DirectoryRole groups. For SKU, we are getting all SKU groups as entitlements in Saviynt + their membership after running import jobs.
However, for DirectoryRole, although we are able to fetch all the roles into Saviynt but their membership is not getting imported.
We have verified that the client that we are using in Azure AD connection has the required permission to read DirectoryRole membership.
Please advise.
Solved! Go to Solution.
12/03/2023 10:10 PM
Hello @kunal_saxena,
Can you please share the importjson and the endpoint_filter.
Thanks.
12/04/2023 01:28 AM
Hi @sudeshjaiswal ,
We have created a connection of type AzureAD. Within the connection, we cannot find any field for importjson or endpoint_filter. We have configured account_attributes and entitlement_attribute.
ACCOUNT_ATTRIBUTES:
{
"acctLabels": {
"customproperty1":"Given Name",
"customproperty2":"Surname",
"customproperty3":"BusinessPhones",
"customproperty4":"Company Name",
"customproperty5":"MobilePhone",
"customproperty6":"OfficeLocation",
"customproperty7":"PreferredLanguage",
"customproperty8":"User Type",
"customproperty9":"Job Title",
"customproperty10":"Account Enabled",
"customproperty11":"DirSync Enabled",
"customproperty12":"Immutable ID",
"customproperty14":"Last DirSyncTime",
"customproperty15":"On-Premise Security Identifier",
"customproperty16":"City",
"customproperty17":"Country",
"customproperty18":"Department",
"customproperty19":"UsageLocation",
"customproperty20":"Employee ID"
},
"colsToPropsMap": {
"accountID":"id~#~char",
"Name":"userPrincipalName~#~char",
"displayName":"displayName~#~char",
"status":"accountEnabled~#~char",
"customproperty1":"givenName~#~char",
"customproperty2":"surName~#~char",
"customproperty3":"businessPhones~#~char",
"customproperty4":"mail~#~char",
"customproperty5":"mobilePhone~#~char",
"customproperty6":"officeLocation~#~char",
"customproperty7":"preferredLanguage~#~char",
"customproperty8":"userType~#~char",
"customproperty9":"jobtitle~#~char",
"customproperty10":"accountEnabled~#~char",
"customproperty11":"onPremisesSyncEnabled~#~char",
"customproperty12":"onPremisesImmutableId~#~char",
"customproperty14":"onPremisesLastSyncDateTime~#~char",
"customproperty15":"onPremisesSecurityIdentifier~#~char",
"customproperty16":"city~#~char",
"customproperty17":"country~#~char",
"customproperty18":"department~#~char",
"customproperty19":"usageLocation~#~char",
"customproperty20":"employeeId~#~char"
}
}
ENTITLEMENT_ATTRIBUTE:
{
"entitlementAttribute": {
"DirectoryRole": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"customproperty4": "description~#~char",
"customproperty6": "deletedDateTime~#~char",
"customproperty8": "roleTemplateId~#~char"
}
},
"SKU": {
"colsToPropsMap": {
"entitlementID": "skuId~#~char",
"entitlement_value": "skuPartNumber~#~char",
"customproperty1": "appliesTo~#~char",
"customproperty2": "capabilityStatus~#~char",
"customproperty5": "consumedUnits~#~char",
"customproperty7": "prepaidUnits~#~listAsString"
}
}
}
}
Thanks,
Kunal
12/04/2023 10:24 PM
Hello @kunal_saxena,
Thanks for the sharing the json, its look fine to me,
Can you please share the postman snapshot for the SKU and DirectotyRole and how their memberships are nested?
Thanks.
12/06/2023 01:50 AM
Hi @sudeshjaiswal , Thank you for reviewing the JSONs.
1st screenshot shows the request for fetching directory roles:
2nd screenshot shows the request to get directory role membership:
12/07/2023 09:36 PM
Please check service account have required permissions
https://learn.microsoft.com/en-us/graph/permissions-reference
12/07/2023 09:28 PM
Hello @kunal_saxena,
Can you please confirm if the access import job is failing, as directory role member dont get imported job will fail.
Also would recommnend to check the api permissions.
Thanks.
12/07/2023 11:21 PM
Hi @rushikeshvartak , @sudeshjaiswal ,
Service account has the required permissions, since we are using the same account through postman and are able to retrieve the Directory Role membership.
Also, access import job is successful.
Thanks,
Kunal
12/20/2023 12:58 AM
The issue got resolved by adding DirectoryRoleMember in the Entitlement Import job > Import Config section:
{
"importEntTypes": {
"DirectoryRole": {},
"DirectoryRoleMember": {},
"SKU": {}
},
"excludeEntTypes": {
"AADGroup": {},
"Team": {},
"Channel": {},
"MemberPermission": {},
"GuestPermission": {},
"ApplicationInstance": {},
"Subscription": {},
"Application": {},
"ServicePlans": {}
}
}
01/23/2024 02:29 PM
Did you have to make any changes to your connection config? Or was the job import config enough?
Does it show if the role is eligible or permanent?