Error importing by incremental import

[JPMac]

Hi Teams,

The issue is occurs when using Incremental Import to import a user's account.

We have connections for Azure AD, but when we try to import a new user account on Azure AD by using Incremental Import, the user accounts are imported with a status of "Inactive."

For Full Import, they are registered with a status of "Active."

In the case of full import, it is retrieved as Active, so I think the problem is with Incremental Import.

Have any similar issues occurred?

===Account Attribute===

{
"acctLabels": {
"customproperty1": "FirstName",
"customproperty2": "LastName",
"customproperty3": "OfficePhone",
"customproperty4": "Email",
"customproperty5": "MobilePhone",
"customproperty6": "OfficeLocation",
"customproperty7": "PreferredLanguage",
"customproperty8": "UserType",
"customproperty9": "JobTitle",
"customproperty10": "AccountStatus",
"customproperty11": "OnPremisesSyncEnabled",
"customproperty12": "OnPremisesImmutableId",
"customproperty13": "HireDate",
"customproperty14": "OnPremisesLastSyncDateTime",
"customproperty15": "OnPremisesSecurityIdentifier",
"customproperty31": "STORE#ACC#ENT#MAPPINGINFO",
"customproperty16": "City",
"customproperty17": "Country",
"customproperty18": "Department",
"customproperty19": "UsageLocation",
"customproperty20": "ExternalUserState",
"customproperty21": "StreetAddress",
"customproperty22": "State",
"customproperty23": "Office",
"customproperty24": "PostalCode",
"customproperty25": "OfficePhone",
"customproperty26": "EmployeeID"
},
"colsToPropsMap": {
"accountID": "id~#~char",
"name": "userPrincipalName~#~char",
"displayName": "displayName~#~char",
"lastlogondate": "signInActivity.lastSignInDateTime~#~date",
"customproperty1": "givenName~#~char",
"customproperty2": "surname~#~char",
"customproperty3": "businessPhones~#~char",
"customproperty4": "mail~#~char",
"customproperty5": "mobilePhone~#~char",
"customproperty6": "officeLocation~#~char",
"customproperty7": "preferredLanguage~#~char",
"customproperty8": "userType~#~char",
"customproperty9": "jobtitle~#~char",
"customproperty10": "accountEnabled~#~char",
"customproperty11": "onPremisesSyncEnabled~#~char",
"customproperty12": "onPremisesImmutableId~#~char",
"customproperty13": "hireDate~#~char",
"customproperty14": "onPremisesLastSyncDateTime~#~char",
"customproperty15": "onPremisesSecurityIdentifier~#~char",
"customproperty31": "STORE#ACC#ENT#MAPPINGINFO~#~char",
"customproperty16": "city~#~char",
"customproperty17": "country~#~char",
"customproperty18": "department~#~char",
"customproperty19": "usageLocation~#~char",
"customproperty20": "externalUserState~#~char",
"customproperty21": "streetAddress~#~char",
"customproperty22": "state~#~char",
"customproperty23": "physicalDeliveryOfficeName~#~char",
"customproperty24": "postalCode~#~char",
"customproperty25": "telephoneNumber~#~char",
"customproperty26": "employeeId~#~char",
"customproperty27": "signInActivity.lastSignInDateTime~#~char"
}
}

===STATUS_THRESHOLD_CONFIG===

{
"statusAndThresholdConfig": {
"accountThresholdValue": 0,
"appAccountThresholdValue": 50,
"correlateInactiveAccounts": true,
"statusColumn": "customproperty10",
"activeStatus": ["true"],
"deleteLinks": true
}
}

[RakeshMG]

Please check if ""activeStatus": ["true"]," is having any other value in the target.

For more details please refer to following document : https://docs.saviyntcloud.com/bundle/AzureAD-v2022x/page/Content/Configuring-the-Integration-for-Acc...

[khalidakhter]

@JPMac 

Please check if there is any invalid attribute present if you are using the Account_Import_Fields parameter of Azure AD Connection. Also, make sure that you have included the accountEnabled property in Account_Import_Fields.

I checked the mapping provided above too and found that the below mapping fields seem invalid.
hireDate,signInActivity.lastSignInDateTime,physicalDeliveryOfficeName,telephoneNumber

I will recommend checking this as well.

[JPMac]

Hi Team, thanks for your response.

Share the contents of the account attribute field.

======
accountEnabled,city,country,department,onPremisesSyncEnabled,displayName,onPremisesLastSyncDateTime,mobilePhone,id,businessPhones,usagelocation,userPrincipalName,userType,givenName,surname,mail,officeLocation,preferredLanguage,onPremisesImmutableId,onPremisesSecurityIdentifier,externalUserState,streetAddress,state,physicalDeliveryOfficeName,postalCode,telephoneNumber,employeeId,signInActivity

======

Something like signInactivity gets the user's last login time and is needed to detective the Dormant Account.

As above, "accountEnabled" is already in.

Regards,

[khalidakhter]

@JPMac 

The Microsoft Graph API does not support retrieving SignInActivity information in the DeltaToken API which Azure AD connector invokes as a first call while Account import. Hence, It is failing to get the delta token with the below error.
And, Azure AD connector uses this delta token while incremental account import to get changes from the last account import.

Invalid request for delta query: for this entity set, $expand/$select is not supported for the following properties: signInActivity

You need to remove the signInActivity attribute from the Account_Import_Fields for incremental import to work.

[JPMac]

Hi Team,

This error occurred even before adding SignInActivity to Account Fields. So even if you delete SignInActivity, the issue still occurs.

Regards,

[khalidakhter]

Hi @JPMac 

Please try the below steps.
1. Remove these attributes (hireDate,signInActivity,physicalDeliveryOfficeName,telephoneNumber) from the Account_Attribute Field and mappings as well.
2. Run Full account import.
3. Run Incremental account import.

Share the log if the issue still persists.

[shibinvpkvr]

@khalidakhter @ We have a requirement to bring physicalDeliveryOfficeName,telephoneNumber

How will we bring this in? We are getting error while running full import with these two fields in it. When we checked the job logs, it seems the api being called is delta. (https://graph.microsoft.com/v1.0/users/delta) is this a standard behavior with Saviynt? 

[khalidakhter]

@shibinvpkvr 

For this, you can use the REST connector to import the above attributes in Saviynt. The OOTB Azure AD connector won't be able to import any attributes which are not supported in Delta API.

[shibinvpkvr]

@khalidakhter could you please clarify if OOTB connector is using delta API for full import? if yes, what is the difference between full import and incremental import? 

[khalidakhter]

@shibinvpkvr Azure AD connector gets the latest Delta token while full account import and stores it in the database and uses it while Incremental import to get the changes from the last import job.

[shibinvpkvr]

@khalidakhter ok. so even in full account import, Delta token API being called which does not support physicalDeliveryOfficeName, telephoneNumber attributes. So we cannot include these in import in anyway if we are using OOTB Azure AD connector correct?

[khalidakhter]

Yes, @shibinvpkvr . Right now, you will be able to import only those attributes that are supported in the DeltaToken API.
You can use the REST connector for account import if you want to import the above attribute information.