AzureAD Connector: Filtering out guest account

[pivitale]

Hi all,

do you know if it is possible to apply a filter on the OOTB AAD connector to exclude the guest accounts from the import?

Regards

[rushikeshvartak · Accepted solution]

You can add your condition in ACCOUNTS_FILTER under connection

Your requirement condition should be 

NotIn(userPrincipalName,'azuretest')

https://saviynt.freshdesk.com/support/solutions/articles/43000463699-azure-ad-connector-guide

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters...

ACCOUNTS_FILTER

Specify this parameter to filter accounts during full and incremental account import from Azure AD. Sample value: startswith(userPrincipalName,'azuretest')

[pivitale]

Great @rushikeshvartak ! it worked, but now what we observe is that the connector does not import the newly created "guest" accounts, but it doesn't suspend the accounts already present in Saviynt. Any idea?

Thank you very much for your help!

[sahajranajee]

@pivitale ,

Azure often takes a few minutes to replicate objects across and be available in Graph API responses. Have you tried running the import later and seen them getting fetched?

[JustSalva]

Hi,

Yes, we tried to run the import after some time but the problem is not a data alignment one. Imported guests accounts that now are filtered out in the connector should be marked as "removed from import service" cause they should be filtered out from the import stream

[rushikeshvartak]

what are distinct account status for that endpoint

[JustSalva]

In saviynt: active, inactive, suspended from import service, and then the "ones managed directly by saviynt", e.g. manually provisioned

In AAD we have the accountEnabled standard field so:

• if true the account in savyint is enabled
• if false disabled
• for all accounts not in the import stream (either filtered out using the ACCOUNTS_FILTER "NotIn(userType,'Guest')" of not present anymore in the target system) I expect to obtain "SUSPENDED FROM IMPORT SERVICE"; this does not happen for accounts filtered out, they all remain active

N.B. in STATUS_THRESHOLD_CONFIG  "inactivateAccountsNotInFile" is set to false

[rushikeshvartak]

can you share STATUS_THRESHOLD_CONFIG

[JustSalva]

here you go:

{
"statusAndThresholdConfig": {
"accountThresholdValue": 200,
"appAccountThresholdValue": 50,
"correlateInactiveAccounts": true,
"statusColumn": "customproperty14",
"activeStatus": [
"true"
],
"deleteLinks": true,
"inactivateAccountsNotInFile": false
}
}

[rushikeshvartak]

Any error in logs does accountThresholdValue exceeding ?

[sahajranajee]

@JustSalva ,

Its quite possible that your threshold value is being met once the filter is put. Could you look at the logs and confirm? 

[JustSalva]

Hi all,

no, we didn't observe any issue related to the threshold, the import job is scheduled and executes correctly. 

[sahajranajee]

@JustSalva 

The job is successful even when the threshold is met. Have you checked logs to confirm this behavior?

[JustSalva]

Hi,

Yes, I've double checked but there are no errors. The threshold is not even supposed to be met, in our test environment we have 6 AAD guest accounts.

[rushikeshvartak]

Please try below statusAndThresholdConfig

{
  "statusAndThresholdConfig": {
    "accountThresholdValue": 1000,
    "appAccountThresholdValue": 100,
    "correlateInactiveAccounts":true,
    "statusColumn": "customproperty14",
    "activeStatus": [
      "true"
    ],
    "deleteLinks": true
     }
}

[sahajranajee]

@JustSalva ,

If all of this checks out, could you also share logs from a successful import run?

[JustSalva]

here you can find the requested logs(for ecm and ecm-worker services), obtained executing the job with the suggested configuration:

[sahajranajee]

@JustSalva 

I can see a few types of errors in the logs. Also with respect to decryption for the same thread as the import. I would request you to raise this with Saviynt Support to get the logs and the error validated :