Manage Azure AD Groups Screens not Loading Properly

[vermilyacd1]

When trying to Create an Azure AD Group, the screen does not match the documentation. What settings need to be in place to show the Azure AD specific Create Group screen?

I'm expecting this (from the documentation (https://saviynt.freshdesk.com/support/solutions/articles/43000582534-managing-azure-ad-groups#Managi...😞 

But instead, only see this (the generic role creation screen)

I have set an approval workflow on the AADGroup Entitlement Type screen.

This is in v2020.

[Nikitaj]

Hi,

Please navigate to ARS->Create AAD Group

You will be able to see the desired screen. 

Thanks

Nikita

[vermilyacd1]

Hi @Nikitaj, this is the root of the problem... When I click Create AAD Group, I don't get the Create AAD Group Screen, I get the generic Create Role screen (see screenshots in the original post). The system is not recognizing that I'm trying to create an AAD Group.

[Nikitaj]

Hi,

Could you please add this to your SAV Role, it would be missing from there.

Please navigate to Admin->SAV Roles->choose the SAV Role-> Create Request Home Option->Select Group To Create and add AAD Group. 

Thanks

Nikita

[vermilyacd1]

Yep, I saw this in another post and I already have that in place but still no luck.

[Nikitaj]

Hi,

In that case please check the JSON where you have defined the Azure AD Group, something is missing there .

Thanks

Nikita

[vermilyacd1]

Would the reconciliation settings affect how the Create AAD Group screen is showing? I don't see any errors in the JSON, please see below. Am I missing anything? This is from the documentation.

{
"entitlementAttribute": {
"AADGroup": {
"colsToPropsMap": {
"entitlementID": "id~#~char",
"entitlement_value": "displayName~#~char",
"customproperty1": "deletionTimestamp~#~char",
"customproperty2": "description~#~char",
"customproperty5": "dirSyncEnabled~#~char",
"customproperty7": "mail~#~char",
"customproperty8": "mailEnabled~#~char",
"customproperty9": "onPremisesSecurityIdentifier~#~char",
"customproperty10": "securityEnabled~#~char",
"customproperty11": "groupTypes~#~listAsString",
"customproperty12": "membershipRule~#~char",
"customproperty13": "membershipRuleProcessingState~#~char",
"customproperty16": "resourceProvisioningOptions~#~char"
}
}
}
}

[avinashchhetri]

Something does not look right here. When the pre-requisites are not set for the Group  Management, on clicking the tile, it basically loads the same page again.Here you are getting a different page altogether. This might require looking into the logs and troubleshooting further. I'd think a support tiket would be apt for this issue.

Regards,

Avinash Chhetri

[vermilyacd1]

Still waiting on Saviynt operations to respond to the ticket but in the meantime, the reconciliation is also not working. It seems the AzureAD Connector completely ignores the entitlement mapping. The recon is failing because the data in custompropert14 is too long (it is being truncated). I'm not even mapping customproperty 14 (see my JSON above)!

Any ideas? This has turned into a major blocker.

[sahajranajee]

Hello,

AzureAD connector is an OOTB connector and if its OOTB mappings are facing truncation issue, please raise the severity of the freshdesk ticket and work with Support on getting a fix from engineering for the issue.

[vermilyacd1]

Any tips @sahajranajee  to prompt a response on the ticket? It's been open for a week and has not been touched. The CSM for this client is pushing as well but we never get any movement.

[jasonb]

Was this issue ever resolved?  I am facing the same issue, except I can't seem to add Azure AAD Groups to my Manage Roles : Create Roles permissions:

[avinashchhetri]

@jasonb 

Have you added a workflow to the entitlementType you are trying to manage ?

If not, Please follow the steps below and give it a try.

Go to Security System > Endpoints > Entitlement Type

Click on the icon for Entitlement Type

On the details page, add a workflow as shown

This should populate the entitlement type you are trying to manage in the SAV Role

(Note: The screenshots shared above are for AD but you can follow the same for your AAD Groups as well)

@vermilyacd1 

Could you share the ticket number so that we can take a look ?

The Saviynt Support is a different Team altogether but would like to take a look at what's going on.

[jasonb]

[Edited: I did get the role to in the SAV Roles settings, but issue below remains]

@avinashchhetri

The documentation (link here) states:

1. Log in to EIC.

2. Go to ARS > Create New Role.

3. Click the Ellipsis icon … to view the available options.

4. Select Create Azure AD Group  and click Create.  

However, that description does not match the UI as it appears on my screen - There is no Ellipsis icon, and no Create Azure AD Group option under actions. For reference, we are on the latest cloud version.

[avinashchhetri]

@jasonb

If you are on the latest version, you should be able to see a separate tile for Creating and Managing AzureAD Groups as shown below.

[jasonb]

I seem to be missing a number of options on the Home screen tiles:

I am in the Role_Admin SAV role.

[avinashchhetri]

Could you share the Saviynt version that you are on ?

Here's the url that will give you the version page if youre on the latest (v2021) release.

https://<applicaton-url>/ECMv6/versionpage

Also please share the screenshot of the "Create Request Home Option" for the Admin SAV Role

[jasonb]

Version Info:

Create Request Home Option:

[avinashchhetri]

I'm assuming you are using the OOB Admin Role and also have the access to Create and Modify Roles under Feature Access.

[jasonb]

That is correct - the out-of-the-box Role_Admin SAV role, with permissions to create and modify roles:

[vermilyacd1]

Haha... yes and no. It's a bug in v2020 that does not have a timeline for a fix. Saviynt's response was upgrade to v2021. We did that, and it's broken there too. It's still being worked on, has been escalated several times. We're currently with the product team.

[vermilyacd1]

@avinashchhetri #1422119