Error Encountered when assigning access to privileged group in Entra from Saviynt

[Gaurav09]

when I request access to any normal group from saviynt to Entra, there is no issue, and the access is granted. However, when I try to access to a privileged group, I encounter an error message saying.

Error message: {"auditDetails":{"AADGroup":[{"headers":null,"message":{"error":{"code":"Request_ResourceNotFound","message":"Resource '55d22167-43b6-4a6e-a765-f1bbd0ec63ca' does not exist or one of its queried reference-property objects are not present.","innerError":{"date":"2024-09-18T14:10:03","request-id":"891bb9a2-4d99-4fb4-8b48-57fc39da5a03","client-request-id":"891bb9a2-4d99-4fb4-8b48-57fc39da5a03"}}},"statusCode":404,"description":null,"status":"Failed"},

Help me resolve this error.

[rushikeshvartak]

Root Cause

• Group Does Not Exist: The group ID (55d22167-43b6-4a6e-a765-f1bbd0ec63ca) might not exist in Azure AD. Double-check if the group was deleted or renamed.
• Incorrect Group ID: There might be a misconfiguration in Saviynt where the wrong group ID is being used for privileged groups.
• Insufficient Permissions: Privileged groups might require elevated permissions that are not correctly configured for the user or service account making the request.
• Privileged Group Management: Azure AD often has specific rules or configurations around managing privileged groups (e.g., needing Privileged Identity Management or specific admin roles to make changes).

• Verify Group in Azure AD:

  • Check Azure AD (Entra) to ensure the group with ID 55d22167-43b6-4a6e-a765-f1bbd0ec63ca exists.
  • If it doesn’t exist, verify whether it has been renamed or deleted.

• Check Group Permissions:

  • Ensure that the service account or user making the request in Saviynt has the necessary permissions to access privileged groups.
  • Privileged groups may require specific roles (e.g., Global Administrator or Privileged Role Administrator) to manage them.

[Gaurav09]

@rushikeshvartak 

I tried with the same group but made a change on Entra side. When I added the access to the privileged group, it didn't work. so, we removed it from privileged status and ran the access import job again to reflect the change's on Saviynt side as well and it worked fine, granting access.

What could be the issue in this case?

[Amit_Malik]

when you say privileged group ? what do you mean ? Group managed thru PIM?

For PIM managed groups, we need to manage it via assignments

https://learn.microsoft.com/en-us/graph/api/rbacapplication-post-roleeligibilityschedulerequests?vie...

[Gaurav09]

yeah. I want to give the access of PIM group from Saviynt. can u explain it more how I can do that

[rushikeshvartak]

• Removed it from privileged status  - this has no relation with it.
• It seems group parameters - entitlement id / name must be updated which caused probelm and now resolved

[Gaurav09]

no. It's a PIM group and I want to give the access of that group to user account.