AzureAD group custom properties does not sync to Saviynt on group creation

[hirenp]

Hello experts,

When an AzureAD group (security or M365) is created there are customproperties that I expect to sync back into entitlement values table but they do not. Displayname and owner information does sync.

Here is the create JSON I am using

{
"connection": "userAuth",
"url": "https://graph.microsoft.com/v1.0/groups",
"httpMethod": "Post",
"httpParams": "{\"description\": \"${roles.description==null || roles.description==''? roles.displayname : roles.description}\", \"displayName\": \"${roles.displayname==null || roles.displayname==''? roles.role_name : roles.displayname}\", \"groupTypes\": [\"${roles.customproperty21=='Office365'? 'Unified' : ''}\"], \"mailEnabled\": \"${roles.customproperty22 == '1' ? true : false}\", \"mailNickname\": \"${roles.displayname==null || roles.displayname==''? roles.role_name : roles.displayname}\", \"securityEnabled\": \"${roles.customproperty23 == '1' ? true : false}\",\"owners@odata.bind\": [\"${allOwner}\"],
"httpHeaders": {
"Authorization": "${access_token}",
"Content-Type": "application/json"
},
"httpContentType": "application/json"
}

Entitlement_Attribute

{
"entitlementAttribute": {
"AADGroup": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"description": "description~#~char",
"customproperty1": "deletedDateTime~#~char",
"customproperty2": "description~#~char",
"customproperty3": "membershipRule~#~char",
"customproperty5": "onPremisesSyncEnabled~#~char",
"customproperty6": "onPremisesLastSyncDateTime~#~char",
"customproperty7": "mail~#~char",
"customproperty8": "mailEnabled~#~char",
"customproperty9": "onPremisesSecurityIdentifier~#~char",
"customproperty10": "securityEnabled~#~char",
"customproperty11": "groupTypes~#~listAsString",
"customproperty13": "membershipRuleProcessingState~#~char",
"customproperty16": "resourceProvisioningOptions~#~char",
"customproperty17" : "onPremisesSyncEnabled~#~char",
"customproperty18" : "createdDateTime~#~char"
}
},
"Team": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"description": "description~#~char",
"customproperty1": "internalId~#~char",
"customproperty2": "webUrl~#~char",
"customproperty3": "discoverySettings~#~char",
"customproperty6": "isArchived~#~char"
}
},
"Channel": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"description": "description~#~char",
"customproperty1": "email~#~char",
"customproperty2": "webUrl~#~char"
}
},
"DirectoryRole": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"description": "description~#~char",
"customproperty4": "description~#~char",
"customproperty6": "deletedDateTime~#~char",
"customproperty8": "roleTemplateId~#~char"
}
},
"Subscription": {
"colsToPropsMap": {
"entitlementID": "subscriptionId~#~char",
"entitlement_value": "displayName~#~char",
"displayname": "displayName~#~char",
"description": "description~#~char",
"customproperty1": "state~#~char",
"customproperty2": "subscriptionPolicies.locationPlacementId~#~char",
"customproperty4": "subscriptionPolicies.quotaId~#~char",
"customproperty6": "subscriptionPolicies.spendingLimit~#~char",
"customproperty7": "authorizationSource~#~char"
}
},
"Application": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"customproperty1": "id~#~bool",
"customproperty2": "resourceAppId~#~bool",
"customproperty4": "orgRestrictions~#~boolListInverse",
"customproperty5": "oauth2AllowImplicitFlow~#~bool",
"customproperty6": "allowPublicClient~#~bool",
"customproperty7": "createdDateTime~#~char"
}
},
"ApplicationInstance": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"displayname": "appDisplayName~#~char",
"customproperty1": "appId~#~char",
"customproperty2": "servicePrincipalNames~#~char",
"customproperty4": "appOwnerOrganizationId~#~char",
"customproperty5": "appRoleAssignmentRequired~#~char",
"customproperty7": "accountEnabled~#~bool",
"customproperty9": "publisherName~#~char"
}
},
"SKU": {
"colsToPropsMap": {
"entitlementID": "skuId~#~char",
"entitlement_value": "skuPartNumber~#~char",
"customproperty1": "appliesTo~#~char",
"customproperty2": "capabilityStatus~#~char",
"customproperty5": "consumedUnits~#~char",
"customproperty7": "prepaidUnits~#~listAsString"
}
},
"AppRole": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"customproperty1": "isEnabled~#~char",
"customproperty2": "value~#~char",
"customproperty4": "id~#~char",
"customproperty5": "allowedMemberTypes~#~char"
}
},
"Oauth2Permission": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "userConsentDisplayName~#~char",
"description": "userConsentDescription~#~char",
"customproperty1": "isEnabled~#~char",
"customproperty2": "adminConsentDisplayName~#~char",
"customproperty3": "adminConsentDescription~#~char",
"customproperty4": "id~#~char",
"customproperty5": "type~#~char",
"customproperty8": "value~#~char"
}
},
"ApplicationInstanceAppRole": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"customproperty1": "isEnabled~#~char",
"customproperty2": "value~#~char",
"customproperty4": "id~#~char",
"customproperty5": "allowedMemberTypes~#~char"
}
},
"SKUServicePlans": {
"colsToPropsMap": {
"entitlementID": "servicePlanId~#~char",
"entitlement_value": "servicePlanName~#~char",
"customproperty1": "provisioningStatus~#~char",
"customproperty2": "appliesTo~#~char",
"customproperty4": "servicePlanId~#~char"
}
}
}
}

[prashantChauhan]

Hi @hirenp 

Are you running the Data Access Import Job to get the sync or expect the data to be synced just after the Create Group is done via Saviynt? 

Also, what custom properties-Group Fileds are you expecting to be synced? The ones mentioned in Entitlement_Attribute? 

An Import will be required for these attributes to be synced.

[hirenp]

@prashantChauhan 

I am expecting entitlement attribute to be updated as part of create group operation. we have instant provisioning turned on.  

For e.g. if i am creating security group respective custom property should be updated on group creation

[rushikeshvartak]

Please try below 

{

  "entitlementAttribute": {

   "AADGroup": {

      "colsToPropsMap": {

        "entitlementID": "id~#~char",

        "entitlement_value": "displayName~#~char",

        "description": "description~#~emchar",

        "customproperty1": "deletionTimestamp~#~char",

        "customproperty3": "membershipRule~#~char",

"customproperty5": "dirSyncEnabled~#~char",     

        "customproperty6": "lastDirSyncTime~#~char",

"customproperty7": "mail~#~char",

        "customproperty8": "mailEnabled~#~char",

        "customproperty9": "onPremisesSecurityIdentifier~#~char",

        "customproperty10": "securityEnabled~#~char",

        "customproperty11": "groupTypes~#~listAsString",

        "customproperty13": "membershipRuleProcessingState~#~char",

        "customproperty16": "resourceProvisioningOptions~#~char",

        "customproperty17": "onPremisesSyncEnabled~#~char",

"customproperty30": "visibility~#~char"

      }

    },

    "AADGroupOwners": {

      "colsToPropsMap": {

        "entitlementID": "id~#~char",

        "entitlement_value": "displayName~#~char"

      }

    }

 }

}

[prashantChauhan]

The Entitlement_Attribute mapping comes into the picture during the Import Job. This won't help in populating the fields during Create Group operation. 

There will be a limit on what all attributes can be synced to the Entitlement Fields during the Create Group Operation as it depends on the Create Group API call and its response and what the connector is mapping as part of the Create operation.

Let me check and get back to you if this can be achieved by modifying the CreateGroupJSON in case responseColsToPropsMap is exposed for it.

[hirenp]

@prashantChauhan Any luck with this?

[prashantChauhan]

Hi @hirenp 

I checked this and currently only basic attributes like GroupID, Group Name/DisplayName, and Description are passed to the Entitlement Fields as part of the Create Group Operation. A recon is needed to store the extended attributes in the Entitlement.
Please raise an enhancement request in the Ideas Portal with all the details to get this implemented.

Thanks.