Service Account configuration in Azure

[rahul_p]

Hello,

We are configuring the service account in Azure , we have request form(DA) with following attributes :

1. Firstname
2. Lastname
3. AccountType (Service/TESTService)
4. AccountName(account name generated based upon firstname and lastname)

We are using following Create Account JSON which is not working :

Spoiler

{
"accountIdPath": "call1.message.id",
"dateFormat": "yyyy-MM-dd'T'HH:mm:ssXXX",
"responseColsToPropsMap": {
"displayName": "call1.message.displayName~#~char",
"name": "call1.message.userPrincipalName~#~char"
},
"call": [
{
"name": "call1",
"connection": "${connectionName}",
"url": "https://graph.microsoft.com/v1.0/users",
"httpMethod": "POST",
"httpParams": "{\"accountEnabled\":true,\"displayName\":\"${lastname}\",\"mailNickname\":\"${firstname}\",\"userPrincipalName\":\"${task.accountName}\",\"employeeType\":\"${ServiceAccountType}\",\"passwordProfile\":{\"forceChangePasswordNextSignIn\":true,\"password\":\"${password}\"}}",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/json",
"successResponses": {
"statusCode": [
200,
201,
204,
205
]
}
}
]
}

When we are using hard coded values then its working :

Spoiler

{
"accountIdPath": "call1.message.id",
"dateFormat": "yyyy-MM-dd'T'HH:mm:ssXXX",
"responseColsToPropsMap": {
"displayName": "call1.message.displayName~#~char",
"name": "call1.message.userPrincipalName~#~char"
},
"call": [
{
"name": "call1",
"connection": "${connectionName}",
"url": "https://graph.microsoft.com/v1.0/users",
"httpMethod": "POST",
"httpParams": "{\"accountEnabled\":true,\"displayName\":\"<hardcodedvalue>\",\"mailNickname\":\"<hardcodedvalue>\",\"userPrincipalName\":\"<hardcodedvalue>\",\"employeeType\":\"<hardcodedvalue>\",\"passwordProfile\":{\"forceChangePasswordNextSignIn\":true,\"password\":\"${password}\"}}",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/json",
"successResponses": {
"statusCode": [
200,
201,
204,
205
]
}
}
]
}

Any suggestion here?

Regards,

Rahul

[NM]

@rahul_p are you using service account tile?

[rahul_p]

Hello @NM ,

Yes, using manage service account tile.

Thanks!

[NM]

@rahul_p , share existing DA values screenshot from endpoint.

[rushikeshvartak]

Access dynamic attribute using below synatx 

${requestAccessAttributes?.get('firstname')}

[rahul_p]

Hello @rushikeshvartak ,

I tried with below 2 JSONs but it still failing with same error :

1st

Spoiler

{
"accountIdPath": "call1.message.id",
"dateFormat": "yyyy-MM-dd'T'HH:mm:ssXXX",
"responseColsToPropsMap": {
"displayName": "call1.message.displayName~#~char",
"name": "call1.message.userPrincipalName~#~char"
},
"call": [
{
"name": "call1",
"connection": "${connectionName}",
"url": "https://graph.microsoft.com/v1.0/users",
"httpMethod": "POST",
"httpParams": "{\"accountEnabled\":true,\"displayName\":\"${requestAccessAttributes?.get('lastname')}\",\"mailNickname\":\"${requestAccessAttributes?.get('firstname')}\",\"userPrincipalName\":\"${requestAccessAttributes?.get('task.accountName')}\",\"employeeType\":\"${requestAccessAttributes?.get('serviceAccountType')}\",\"passwordProfile\":{\"forceChangePasswordNextSignIn\":true,\"password\":\"${password}\"}}",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/json",
"successResponses": {
"statusCode": [
200,
201,
204,
205
]
}
}
]
}

2nd

Spoiler

{
"accountIdPath": "call1.message.id",
"dateFormat": "yyyy-MM-dd'T'HH:mm:ssXXX",
"responseColsToPropsMap": {
"displayName": "call1.message.displayName~#~char",
"name": "call1.message.userPrincipalName~#~char"
},
"call": [
{
"name": "call1",
"connection": "${connectionName}",
"url": "https://graph.microsoft.com/v1.0/users",
"httpMethod": "POST",
"httpParams": "{\"accountEnabled\":true,\"displayName\":\"${requestAccessAttributes?.get('lastname')}\",\"mailNickname\":\"${requestAccessAttributes?.get('firstname')}\",\"userPrincipalName\":\"${requestAccessAttributes?.get('accountName')}\",\"employeeType\":\"${requestAccessAttributes?.get('serviceAccountType')}\",\"passwordProfile\":{\"forceChangePasswordNextSignIn\":true,\"password\":\"${password}\"}}",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/json",
"successResponses": {
"statusCode": [
200,
201,
204,
205
]
}
}
]
}

Error :

Spoiler

{"auditDetails":{"call1":[{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","details":[{"code":"InvalidValue","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","target":"userPrincipalName"}],"innerError":{"date":"2024-10-09T07:38:57","request-id":"<id>","client-request-id":"e<cid>"}}},"statusCode":400,"description":null,"status":"Failed"},{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","details":[{"code":"InvalidValue","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","target":"userPrincipalName"}],"innerError":{"date":"2024-10-09T07:40:58","request-id":"<id>","client-request-id":"3<cid>"}}},"statusCode":400,"description":null,"status":"Failed"},{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","details":[{"code":"InvalidValue","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","target":"userPrincipalName"}],"innerError":{"date":"2024-10-09T07:45:03","request-id":"<id>","client-request-id":"<cid>"}}},"statusCode":400,"description":null,"status":"Failed"},{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","details":[{"code":"InvalidValue","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","target":"userPrincipalName"}],"innerError":{"date":"2024-10-09T07:47:24","request-id":"<id>","client-request-id":"1<cid>"}}},"statusCode":400,"description":null,"status":"Failed"}]},"call1":{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","details":[{"code":"InvalidValue","message":"The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization.","target":"userPrincipalName"}],"innerError":{"date":"2024-10-09T07:50:52","request-id":"<id>","client-request-id":"<cid>"}}},"statusCode":400,"description":null,"status":"Failed"}}

Hello @NM ,

PFB screenshot :

Regards,

Rahul

[rushikeshvartak]

Does Your UPN is abcd@pqr.com ?

[rahul_p · Accepted solution]

Hello Everyone,

Removed requestAccessAttributes from accountName :

Working JSON :

Spoiler

{
"accountIdPath": "call1.message.id",
"dateFormat": "yyyy-MM-dd'T'HH:mm:ssXXX",
"responseColsToPropsMap": {
"displayName": "call1.message.displayName~#~char",
"name": "call1.message.userPrincipalName~#~char"
},
"call": [
{
"name": "call1",
"connection": "${connectionName}",
"url": "https://graph.microsoft.com/v1.0/users",
"httpMethod": "POST",
"httpParams": "{\"accountEnabled\":true,\"displayName\":\"${requestAccessAttributes?.get('lastname')}\",\"mailNickname\":\"${requestAccessAttributes?.get('firstname')}\",\"userPrincipalName\":\"${accountName}\",\"employeeType\":\"${requestAccessAttributes?.get('serviceAccountType')}\",\"companyName\":\"${requestAccessAttributes?.get('serviceAccountType')}\",\"passwordProfile\":{\"forceChangePasswordNextSignIn\":true,\"password\":\"${password}\"}}",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/json",
"successResponses": {
"statusCode": [
200,
201,
204,
205
]
}
}
]
}

Regards,

Rahul