# SailPoint Microsoft Entra ID SaaS Connector Documentation

> Microsoft Entra ID SaaS Connector Documentation

# Documentation

# Azure Provisioning Policies

## Azure PIM Provisioning Policy

### Azure /Microsoft Entra ID Eligible/Active Roles

There is no requirement of addition/removal of the existing Create Profile (Provisioning Policy). However, while assigning/removing Azure /Microsoft Entra ID Eligible/Active Role assignment, additional request details can be provided through additional attributes such as the following:

<table> <thead> <tr> <th>Attribute</th> <th>Type</th> <th>Description</th> <th>Default</th> </tr> </thead> <tbody> <tr> <td>duration</td> <td>String (ISO 8601 duration)</td> <td>Specifies the duration for which the role needs to be assigned to the user from the current time.<br>For example, if a role needs to be assigned for six months, the duration should be provided as P180D.<br>ISO 8601 duration format must be used. For example:<br><ul><li>6 months: P180D</li><li>1 week: P7D</li><li>8 hours: PT8H</li><li>Permanent: permanent</li></ul></td> <td>For Eligible Role: P365D<br>For Active Role: P180D</td> </tr> <tr> <td>startDateTime</td> <td>Timestamp (ISO 8601, UTC)</td> <td>It specifies the start date and time from which the role needs to be assigned to the user. It is optional when duration is provided, but required when endDateTime is provided.<br>The timestamp type represents date and time information using ISO 8601 format and is always in UTC time.<br>For example, 2021-11-19T09:40:27.91Z</td> <td>-</td> </tr> <tr> <td>endDateTime</td> <td>Timestamp (ISO 8601, UTC)</td> <td>It specifies the end date and time for role assignment of the user. startDateTime must be provided along with this attribute.<br>The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2022-11-19T09:40:27.91Z.</td> <td>-</td> </tr> <tr> <td>justification</td> <td>String</td> <td>It specifies the reason for the role assignment/removal operation.</td> <td>Admin Action for &lt;user id&gt;</td> </tr> </tbody> </table>

### Azure PIM Active and Eligible Groups

The connector supports adding and removing PIM Active and Eligible group memberships. Additional request details can be provided through additional attributes such as the following:

| Attribute | Type | Description | Default |
| --- | --- | --- | --- |
| duration | String (ISO 8601) | Schedule duration for the membership. For example: P30D (30 days).<br>If the request includes `endDateTime`, the connector uses that end date and does not apply `duration`. Set `duration` to permanent for a membership that does not expire.<br>`permanent` sends no expiration. Any other duration sends an ISO 8601 duration. An `endDateTime` sends that end time. | P365D (eligible) / P180D (active)<br>If `eligibleGroupExpiresAfter` or `activeGroupExpiresAfter` is set, that value is used instead. A `duration` or `endDateTime` on the request overrides both. |
| startDateTime | Timestamp (ISO 8601, UTC) | The date and time when the group membership starts. If you omit this value, the membership starts at the current UTC time. For example, 2026-10-01T00:00:00.000Z. | Current UTC time |
| endDateTime | Timestamp (ISO 8601, UTC) | The date and time when the group membership ends. If you set this attribute, the connector uses it instead of `duration`. `startDateTime` is optional. For example, 2026-12-31T00:00:00.000Z. | \- |
| justification | String | Business justification for the request. | Admin Action for PIM group membership |
| accessId | String (member or owner) | Whether the principal is assigned as a member or owner of the group. | member |

### Sample Provisioning Requests

```text
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">

<ProvisioningPlan nativeIdentity="8cb133a4-0cea-XXXX-8c02-XXXXXXXX">

  <AccountRequest application="Azure PIM" nativeIdentity="8cb133a4-0cea-XXXX-8c02-XXXXXXXX" op="Modify">

    <AttributeRequest name="azureActiveRoles" op="Add">

        <Value>

            <List>

                <String>/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:c2f4ef07-c644-48eb-af81-4b1b4947fb11</String>

                <String>/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:a2138dac-4907-4679-a376-736901ed8ad8</String>

            </List>

           </Value>

        <Attributes>

            <Map>

                <entry key="duration" value="P10D"/>

                <entry key="justification" value="Role Required to Manage Subscription"/>

            </Map>

        </Attributes>

    </AttributeRequest>

    <AttributeRequest name="azureEligibleRoles" op="Add">

        <Value>

            <List>

                <String>/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:5e467623-bb1f-42f4-a55d-6e525e11384b</String>

                <String>/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:4f8fab4f-1852-4a58-a46a-8eaf358af14a</String>

                <entry key="justification" value="Role Required to Manage Dev Resource Group"/>

            </List>

        </Value>

        <Attributes>

            <Map>

                <entry key="startDateTime" value="2021-11-19T09:40:27.91Z"/>

                <entry key="endDateTime" value="2021-12-19T09:40:27.91Z"/>

            </Map>

        </Attributes>

    </AttributeRequest>

  </AccountRequest>

</ProvisioningPlan>
```

### Sample PIM Group Provisioning Request

The following request assigns an eligible PIM group through an end date. To assign by duration instead, omit `endDateTime` and set duration. Use `azureADActiveGroups` for an active PIM group membership.

```text
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">

<ProvisioningPlan nativeIdentity="8cb133a4-0cea-XXXX-8c02-XXXXXXXX">

  <AccountRequest application="Azure PIM" nativeIdentity="8cb133a4-0cea-XXXX-8c02-XXXXXXXX" op="Modify">

    <AttributeRequest name="azureADEligibleGroups" op="Add">

      <Value>

        <String>group-object-id</String>

      </Value>

      <Attributes>

        <Map>

          <entry key="startDateTime" value="2026-10-01T00:00:00.000Z"/>

          <entry key="endDateTime" value="2026-12-31T00:00:00.000Z"/>

          <entry key="justification" value="Time-bound group membership"/>

          <entry key="accessId" value="member"/>

        </Map>

      </Attributes>

    </AttributeRequest>

  </AccountRequest>

</ProvisioningPlan>
```

## Account Profile for Service Principal

The following lists the create service principal profile attributes:

> [!NOTE]
>
> Attributes with *app* in the name are Application object properties and all others are Service Principal object properties.
>
> For example,
>
> - spn\_app\_owners is for directory objects that are owners of the *application*.
> - spn\_owners is for directory objects that are owners of this *service principal*.

| Attribute Name | Description |
| --- | --- |
| spn\_appDisplayName | The display name for the application. |
| spn\_homepage | This is the home page or landing page of the application. |
| spn\_loginUrl | Displays the URL where the service provider redirects the user to Microsoft Entra ID to authenticate. |
| spn\_logoutUrl | Displays the URL that will be used by Microsoft's authorization service to log out a user. |
| description | The description that is displayed in the address book for the user or service principal. |
| spn\_appRoles | The roles exposed by the application that this service principal represents. |
| spn\_app\_keyCredentials | The collection of password credentials associated with the application. |
| spn\_tags | The custom strings that can be used to categorize and identify the service principal. |
| spn\_passwordCredentials | The collection of password credentials associated with the application. |
| spn\_app\_owners | Directory objects that are owners of the application. |
| spn\_owners | Directory objects that are owners of this servicePrincipal. |
| spn\_app\_passwordCredentials | The collection of password credentials associated with the application. |
| spn\_appTemplateName | The name of the template that is used to create the application and service principal. |
| spn\_appTemplateId | The ID of the template that is used to create the application and service principal. |
| spn\_appId | The app ID of the multi-tenant application for which the service principal needs to be created. |

> [!NOTE]
>
> - When a create Service Principal request is executed, the connector creates the application object first and then the corresponding service principal object is created.
> - To create the applications from gallery templates, either **spn\_appTemplateName** or **spn\_appTemplateId** needs to be provided in the create request along with **spn\_appDisplayName**. For more information, refer to sample request [example 3](<#account-profile-for-service-principal>) and [example 4](<#account-profile-for-service-principal>).
> - To create the service principal for a multi-tenant application, **spn\_appId** needs to provided in the create request, For more information, refer to sample request [example 5](<#account-profile-for-service-principal>).

### Sample Create Service Principal Requests

> [!NOTE]
>
> For more information on the key credentials and password credentials, refer to Update Policy for Service Accounts.

#### Example 1

The following create request will create an Application object with the displayName as APAC Sales and its corresponding Service Principal object will also be created:

```text
 <ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Sales"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

The following create request will create an Application object with the displayName as APAC Production and its corresponding Service Principal object will also be requested, as well as adding group and appRole membership:

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Production"/>
        <AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 3

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template named Adobe Identity Management (SAML).

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateName" op="Add" value="Adobe Identity Management (SAML)" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 4

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template whose ID is 7ae7dbe9-8351-44c6-a0f0-e4642aa58b19 (The template ID can be retrieved using MS Graph api endpoints).

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateId" op="Add" value="7ae7dbe9-8351-44c6-a0f0-e4642aa58b19" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 5

The following create request will create service principal object corresponding to already existing application object who’s appId is 9c41360b-3dcb-4a9e-9bf4-095151f835b1.

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appId" value="9c41360b-3dcb-4a9e-9bf4-095151f835b1" />
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

For information on additional configuration attributes, refer to [Additional Configuration Parameters](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#additional-configuration-parameters>).

## Update Policy for Service Principals

### For Key Credentials

For the already generated X.509 certificate, you need to generate the certificate key using PowerShell so that this key can be used for uploading the certificate on the Azure system.

Generate the Certificate Key Using PowerShell

1. Read the certificate's key using the following PowerShell command:

   `[convert]::ToBase64String((Get-Content C:\Users\admin\Desktop\YourCerFile.cer -Encoding byte)) | Out-File -FilePath "C:\Users\admin\Desktop\YourCerFile.key.txt" ##`
2. Replace the file path with the location of your certificate.
3. provide this generated key against `spn_app_keyCredentials` as highlighted in Example 1.

### For Password Credentials

For generating a new client secret for the service principal/application, you need to provide `displayName` as highlighted in Example 1.

Generate Client Secret Values

The provisioning request to add `spn_passwordCredentials` and `spn_app_passwordCredentials` generates the client ID and client secret for the Service Principal and corresponding Application. The secret an only be viewed once and is available as an API response. The added secrets are available as part the `ResourceObject` attributes that are returned after the provisioning request is returned successfully.

Client secrets added for Service Principals are added under the key `spnPasswordCreated`, while client secrets added for Applications are under the key `appPasswordsCreated` in the returned `ResourceObject`. Multiple passwords can be added as part of a single `AccountRequest`. The data type used to store the generated client ID and client secret in the `ResourceObject` is *Map*.

The format is as follows:

```text
<entry key="appPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>

<entry key="spnPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>
```

1. To fetch the generated client secret, the result of the corresponding `AccountRequest` needs to be analyzed to get the `ResourceObject` and perform the required operation to store and secure the secret information.

   For example, a the following is a snippet to view the `ResourceObject` from the provisioning result:

   `plan.getAccountRequests().get(0).getResult().getObject().toxml()`

The following are sample update service principal requests:

#### Example 1

The following modify request will add/update basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

```text
 <ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="displayName" op="Set" value="EMEA Sales"/>
        <AttributeRequest name="spn_homepage" op="Set" value="http://example.com"/>
        <AttributeRequest name="spn_loginUrl" op="Set" value="http://example.com/login"/>
        <AttributeRequest name="spn_logoutUrl" op="Set" value="http://example.com/logout"/>
        <AttributeRequest name="description" op="Set" value="This is a test application"/>
        <AttributeRequest name="spn_appRoles" op="Add" value="{"allowedMemberTypes":["User"],"description":"Just a test role","displayName":"Test Role","id":"f1c8de3d-1fea-4d7c-a8b0-29f63cac3454","isEnabled":true,"origin":"Application","value":"TestRole"}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMT...."}"/>
        <AttributeRequest name="spn_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMTA1MDg1..."}"/>
        <AttributeRequest name="spn_tags" op="Set" value="Test Applications"/>
        <AttributeRequest name="spn_passwordCredentials" op="Add" value="{displayName="Test SPN Password"}"/>
        <AttributeRequest name="spn_app_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Add" value="{displayName="Test APP Password 2"}"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

The following modify request will remove basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

```text
<ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="spn_appRoles" op="Remove" value="{id&quot;:&quot;f1c3de3d-1fea-4d7c-a8b0-29f63cac3454&quot;,&quot;isEnabled&quot;:true,&quot;origin&quot;:&quot;Application&quot;,&quot;value&quot;:&quot;TestRole&quot;}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;keyId&quot;:&quot;1beaebc0-83be-4cb3-b33a-0b2f03231638&quot;}"/>
        <AttributeRequest name="spn_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;key&quot;:&quot;82cf0d7c-457a-4592-b6a6-62889b526a3e&quot;}"/>
        <AttributeRequest name="spn_tags" op="Remove" value="Unit Test Description"/>
        <AttributeRequest name="spn_passwordCredentials" op="Remove" value="{&quot;keyId&quot;: &quot;8624a905-2e95-4906-b83e-ef9306531601&quot;}"/>
        <AttributeRequest name="spn_app_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Remove">
            <Value>
                <List>
                    <String>{&quot;keyId&quot;: &quot;5b76b745-3edf-4ce7-925e-114926ab8ec9&quot;}</String>
                    <String>{&quot;keyId&quot;: &quot;be899d38-e390-414d-aa9d-b9078b5615cb&quot;}</String>
                </List>
            </Value>
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```

# Configuring Microsoft Entra ID SaaS for Integration

This section describes the various configurations to be performed to support the following features:

## Microsoft Graph API

Microsoft recommends the use of Microsoft Graph API instead of the Azure Active Directory Graph API. Microsoft has stopped addition of new feature in the Azure Active Directory API. The Microsoft Entra ID SaaS connector has been enhanced to use the Microsoft Graph API completely.

- To enable using the latest attributes and features supported by Microsoft Graph API, set the value of `useMSGraphAPI` attribute to `true`.
- The default Microsoft Graph API version is "v1.0". To use another version, specify the version in the in `msgraph-api-version` attribute in the connector configuration. For example, you can set the API version by adding `msgraph-api-version` with a value of `"v1.0"`.

For more information, refer to Additional Configuration Parameters.

## Generating a Refresh Token

Perform the following steps to generate the Refresh Token:

1. Obtain the authorization code using the following request. This process involves user consent.

   ```text
   client_id=<clinetId>
   &response_type=code
   &redirect_uri=<redirect_uri>
   &response_mode=query
   &scope=offline_access%20https://graph.microsoft.com/.default
   &state=<randomnumber>
   ```

   Parameters details:

   | Parameter | Description |
   | --- | --- |
   | client\_id | Client ID of the registered application. |
   | response\_type | For authorization code the value must be code. |
   | redirect\_uri | This should be redirect uri configured while registering the application. This should be pointed to localhost and any unused port. |
   | response\_mode | To get the code to in string parameter on your redirect URI, it should be query. |
   | scope | Here multiple scopes can be added for defining the required API. |

   The default added scope is [https://graph.microsoft.com/.default](<https://graph.microsoft.com/.default>).

   The refreshToken parameter is also required for configuration. The **offline\_access** scope must be added.

   | Parameter | Description |
   | --- | --- |
   | state | This can be any random number. Same value will be returned along with authorization code. |

   The Response in browser address bar would be displayed as follows:

   `https://localhost:44320/?code=OAQABAAIAAAAm-06blBE1TpVMil8KPQ41U9-...&state=1234566&session_state=9557b1f1-0fd8-4e12-a39f-213cfcd12153`

   Copy the code present between **code=** and &amp;state.

   > **Note**
   >
   > The received Authorization Code can be used only once and is valid for a short duration.
2. Obtain the Refresh Token as follows using the Auth Code obtained in the above step:

   The Auth Code received from the previous steps must be passed in the following request along with other parameters in following request:

   ```text
       POST https://login.microsoftonline.com/{{Your Domain name}}/oauth2/v2.0/token
        Content-Type: application/x-www-form-urlencoded
   client_id=<clinet id >
   &scope=offline_access%20https://graph.microsoft.com/.default
       &code=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr...
       &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
       &grant_type=authorization_code
       &client_secret=JqQX2PNo9bpM0uEihUPzyrh
   ```

   Following are the newly added parameters:

   | Parameter | Description |
   | --- | --- |
   | code | Authorization code obtained in previous steps. |
   | grant\_type | As you intend to redeem the Auth Code it should be **authorization\_code**. |
   | client\_secret | Client Secret of the registered application. |

   **Response**:

   ```text
   {
       "token_type": "Bearer",
       "scope": "https://graph.windows.net/Directory.Read.All
       https://graph.windows.net/User.Read https://graph.windows.net/.default",
       "expires_in": 7199,
       "ext_expires_in": 7199,
       "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlNzWnNCT
       mhaY0YzUTlTNHRycFFCVEJ5TlJSSSIsImtpZCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlJSSSJ9
       .eyJhdWQiOiJodHRwczovL2dyYXBoLndpbmRvd3MubmV0Iiwia...",
       "refresh_token": "OAQABAAAAAAAm-06blBE1TpVMil8KPQ410LOG6EPVxGfgH8rHUXApUs5fPFtel9FsKTXo2oN8Rw
       _ngEOpKNt1hfufYyJJnG39XxfscpcW...."
   }
   ```

   Copy the **Refresh Token** received in the response.

## Service Plan Management (managing Licenses)

The Microsoft Entra ID SaaS connector supports assigning different Azure services licenses to the users. The connector uses individual plan to assign licenses.

> [!NOTE]
>
> To provision the licenses or plans to user, set the user’s `usageLocation` property correctly.

- **Assigning license plan**: Office 365 license pack consist of licenses for individual services. For example, Exchange Online or SharePoint Online.
- The connector models the `assignedPlans` attribute from account schema as an entitlement. It can be requested as an entitlement during Create or Update operations for Identities.

  > **Important**
  >
  > - If you use group-based licensing, licenses are assigned or removed based on group membership. To avoid concurrency errors, do not mark the `assignedPlans` attribute in the account schema as an entitlement.
  > - When `assignedPlans` are managed by a group, do not use `assignedPlans` as entitlements in the account schema.

Service Plan now has separate group schema attributes. For a detailed list of the attributes, refer to [Service Plan](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/index.html#service-plan>).

The following operations are supported for the Service Plan object type:

- Aggregation
- View details of Service Plan (like object properties, members, and so on)
- Assign and Revoke access request for Service Plan (entitlement attribute: `assignedPlans`)

## Support for Provisioning Operations of `manager` Attribute

The Microsoft Entra ID SaaS connector supports the `manager` attribute for the following:

- **Account Aggregation** (Full and Delta): On Account Aggregation, the `manager` attribute for a user populates for a non-null (blank) value on the Microsoft Entra managed system. Add the `manager` attribute in the account schema with the string type. For more information on adding attributes to the account schema, refer to [Editing an Account Schema](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>).
- **Provisioning**: The `manager` attribute is supported for the Add, Remove, and Set operations where the value of the manager can be set as either `objectId` or the `userPrincipalName`. Add the `manager` attribute in the Provisioning policy. The blank value in the **Set** operation is applicable to remove the `manager` value at the Microsoft Entra managed system.

## Azure Resource Filtering: Subscriptions and Management Groups

The Microsoft Entra ID SaaS connector supports filtering Azure resource providing granular control over the scope of account and entitlement aggregation through Azure subscriptions and management groups. This improves performance, increases data relevance, and reduces data collection time. It also improves focus on relevant subscriptions and management groups by limiting irrelevant data.

### Impact on Aggregation

- **Account Aggregation**: Filters User/Service Principal role assignments and group memberships within specific Azure subscriptions and management groups.
- **Entitlement Aggregation**: Filters subscriptions, management groups, &amp; resource groups. After these are identified, the connector filters Azure role assignments, eligible roles, and active roles based on selected subscriptions and management groups.

### Azure Resource Configuration for Filtering

Add the following attributes using the SailPoint REST APIs:

- `subscriptionFilter`: Provides an array of Azure Subscription IDs.
- `managementGroupsFilter`: Provides an array of Azure Management Group IDs.

For example,

Use the SailPoint API by sending a PATCH request to the `/v3/sources/{source_id}` endpoint.

`PATCH https://{orgName}.api.identitynow.com/v3/sources/:source_id`

In the PATCH payload, add the attributes as shown below:

```text
[{
    "op": "add",
    "path": "/connectorAttributes/subscriptionFilter",
    "value": ["/subscriptions/<subscription_id1>", "/subscriptions/<subscription_id2>"]
},
{
    "op": "add",
    "path": "/connectorAttributes/managementGroupsFilter",
    "value": ["/providers/Microsoft.Management/managementGroups/<management_group_id1>", "/providers/Microsoft.Management/managementGroups/<management_group_id2>"]
}]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

#### Steps for Obtaining Azure Subscription IDs.

1. Sign in to Azure Portal.
2. Go to **Subscriptions**.
3. Select **Download** or **Export to CSV** (usually available in the top menu).

   This will give you a CSV file with Subscription ID.

   > **Note**
   >
   > When specifying a subscription in Azure resource paths, ensure the prefix `/subscriptions/` is included before the subscription ID.
   >
   > For example,
   >
   > Subscription ID only: `abcd-efgh-1234-5678-ijkl`
   >
   > Full subscription path: `/subscriptions/abcd-efgh-1234-5678-ijkl`

#### Steps for Obtaining Azure Management Group IDs.

1. Sign in to Azure Portal.
2. Search for Management Groups in the top search bar.
3. Select on **Management Groups** to view the hierarchy.
4. Select **Download** or **Export to CSV** (usually available in the top menu).

   This will give you a CSV file with Management Group ID.

   > **Note**
   >
   > When specifying a management groups in Azure resource paths, ensure the prefix `/providers/Microsoft.Management/managementGroups/` is included before the Management Group ID.
   >
   > For example, `/providers/Microsoft.Management/managementGroups/Your_Management_Group_Name`

## Sponsors for Guest User (B2B) and External Member (B2B)

The sponsor feature helps manage B2B users in your directory by tracking who is responsible for each guest user. While entitlement management can monitor guests from certain domains, it does not cover guests outside of these specific areas. With the sponsor feature, you can assign a person or group to every guest user, which helps track who invited them and promotes accountability.

The Sponsors field on the user object identifies the person or group tasked with managing and overseeing the user's lifecycle, ensuring they have the correct access to resources. Being a sponsor does not confer administrative powers to the sponsor user or group. However, it can be utilized for approval processes in entitlement management and for custom solutions, but it provides no other built-in directory powers.

### Supported Features

Aggregation and provisioning of `sponsors` for Guest User (B2B) and External Member (B2B).

### Adding Sponsors to the Source

To use this feature, you must manually add the sponsor attributes to the Account Schema for the Microsoft Entra source.

| Attribute | Type | Read/Write | Description |
| --- | --- | --- | --- |
| sponsors | String (multi-valued) | Read-only | Returns each sponsor as a JSON object containing `displayName` and `id`. Useful for display purposes. |
| sponsors.users | String (multi-valued) | Read + Write | Returns and accepts the UPN of each user-type sponsor. For example, `someone@example.com`. |
| sponsors.groups | String (multi-valued) | Read + Write | Returns and accepts the Object ID of each group-type sponsor. |

> [!NOTE]
>
> To provision sponsors, use `sponsors.users` for user-type sponsors and `sponsors.groups` for group-type sponsors. The `sponsors` attribute is read-only and cannot be used for provisioning.

For more information, refer to [Editing an Account Schema](<https://documentation.sailpoint.com/saas/help/accounts/schema.html#editing-an-account-schema>).

### Provisioning

When provisioning a Microsoft Entra user as a sponsor, add the `sponsors.users` attribute to the Account Schema and provide the user's User Principal Name (UPN). For example, `someone@example.com`.

When provisioning a Microsoft Entra group as a sponsor, add the `sponsors.groups` attribute to the Account Schema and provide the group's Object ID.

Both attributes support Add, Remove, and Set operations. A Set operation on `sponsors.users` replaces only the user-type sponsors, leaving any group sponsors intact, and vice versa for `sponsors.groups`.

# Connecting SailPoint and Microsoft Entra ID SaaS

To connect SailPoint with Microsoft Entra ID, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
5. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
7. Select **Save**.

## Connection Settings

Provide the information required to connect to the Microsoft Entra instance based on the selected **Grant Type** for OAuth 2.0 authentication:

### Client Credentials

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/cc.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/cc.png>)

1. In Client ID and Client Secret, enter the Microsoft Entra API details for OAuth2 authentication.
2. In Domain Name, enter the name of the Microsoft Entra domain to be managed. For example, `contoso.onmicrosoft.com`.

   > **Important**
   >
   > If you are using SailPoint CIEM, you must add the Entra domain under Client Credentials in the **Domain Name** field. It must end in `.onmicrosoft.com` or `.onmicrosoft.us`. Custom domain names are not supported.
3. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
4. Select **Save**.

### Refresh Token

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/rt.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/rt.png>)

1. In Client ID and Client Secret, enter the Microsoft Entra API details for OAuth2 authentication.
2. Enter the valid **Refresh Token**.
3. Enter the **Domain Name** of the Microsoft Entra domain to be managed. For example, contoso.onmicrosoft.com.
4. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
5. Select **Save**.

### JWT Certificate Credentials

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/jwt.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/jwt.png>)

To generate the JWT certificate credentials, refer to [Creating OAuth 2.0 JWT Certificate Credentials](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#creating-oauth-20-jwt-certificate-credentials>).

1. In the **Client ID** field, enter the Microsoft Entra API Client ID for OAuth2 authentication.
2. In the **Certificate** field, provide the unique alpha-numeric value of certificate used to sign the JWT assertion.
3. Enter the **Private Key** text used for encrypting the JWT assertion.
4. Enter the **Private Key Password** that is used for decrypting the private key.
5. In the **Domain Name** field, enter the name of the Microsoft Entra domain to be managed. For example, contoso.onmicrosoft.com.
6. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
7. Select **Save**.

## Activity Insights Settings

SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](<https://documentation.sailpoint.com/saas/help/ai/activity_insights/index.html>).

Activity Insights Settings allows you to gather account information and activity data from Microsoft Entra ID. To enable Activity Insights for the Microsoft Entra ID application, refer to [Prerequisites](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/index.html#prerequisites>) for more information.

To configure Activity Insights, complete the following:

> [!NOTE]
>
> **Screenshot**
>
> [![Activity Insights Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/common/assets/img/activity_insights.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/common/assets/img/activity_insights.png>)

1. Go to **Activity Insights Settings**.
2. Select **Enable Activity Insights** to view access to data insights on source and application activity such as logins and other app-specific events.
3. Select **Save**.

## Aggregation and Filter Settings

### Aggregation Settings

This section contains the configuration parameters for aggregation and filter settings.

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

For more information on the key factors to consider when choosing between Full Aggregation and Delta Aggregation, refer to [FAQs](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/faqs.html>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/delta_aggregation.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/delta_aggregation.png>)

1. Select the **Aggregate All Groups** checkbox to aggregate Security, Microsoft 365, Distribution List, and Mail Enabled Security Groups. If this option is not selected, only Security Groups are aggregated.
2. Select the **Delta Aggregation** checkbox to aggregate delta changes for accounts and groups.
3. Select the **Aggregate Group Hierarchy** checkbox to read the parent and child group hierarchical information for Microsoft Entra groups.
4. Select **Exclude Inherited App Role Assignments** to exclude inherited appRoleAssignments during account aggregation. Only application roles assigned directly to the account are aggregated.
5. Enter the value of **Page Size** for the number of objects to be fetched in a single page when iterating over large data sets. The default value is 100.

> [!NOTE]
>
> The connector uses paging and processes the retrieved accounts in parallel, improving account aggregation performance. The default configuration of the connector considers various level of rate limits set by the Microsoft Entra ID managed system. However, you can adjust the connector's aggregation performance by fine tuning the specific data set within your environment using Batch Size Configuration.
>
> You can configure Batch Size Configuration in your existing sources by adding the `userAggregationBatchSize` attribute to your source XML using the following REST API:
>
> `POST https://{orgName}.api.identitynow.com/v3/sources/{source ID}`
>
> In the body of the POST, use the form-data as shown below:
>
> ```text
> [
>     {
>         "op": "add",
>         "path": "/connectorAttributes/userAggregationBatchSize",
>         "value": "45"
>     }
> ]
> ```
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>) in the SailPoint Developer Community.

### Filter Settings

When configuring the filters, consider that the connector prioritizes account filters over group filters during aggregation. For example, the connector aggregates groups, which fall outside of the group filter, if the group is associated with an account included within the account filter.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/filter_settings_2_.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/filter_settings_2_.png>)

1. Set the **User Filters** to define the scope of Accounts applied during account aggregation. For example, to aggregate those Microsoft Entra ID users who are active, use `accountEnabled eq true`. For more information on filters, refer to the [Microsoft documentation](<https://docs.microsoft.com/en-us/graph/query-parameters>).
2. Select **Advanced User Filter** to include advanced filter queries such as `endsWith`, `NOT`, and `NE` during aggregation processes.

   To use the extension attributes from `onPremisesExtensionAttributes` e.g. `extensionAttribute1` , `extensionAttribute4` etc. as user filter, please use the below syntax: `onPremisesExtensionAttributes/extensionAttribute1 eq '21'`

   > **Screenshot**
   >
   > [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/advance_userf_filter_saas.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/advance_userf_filter_saas.png>)

   > **Note**
   >
   > Select the “Advanced User Filter” checkbox as it is advanced query filter.
3. Set the **Group Filters** to define the scope of Groups applied during group aggregation. Group filters apply during entitlement aggregation. For example, to only aggregate Microsoft Entra ID groups whose display name is starting with letter A, use `startswith(displayName,'A')`. For more information on filters, refer to the [Microsoft documentation](<https://docs.microsoft.com/en-us/graph/query-parameters>).
4. Select **Advanced Group Filter** to include advanced filter queries such as endsWith, NOT, and NE during group aggregation processes.
5. Select the **Group Membership Filters** to define the scope of the group memberships included in account aggregation. These filters apply during the account aggregation and are only applicable to memberships belonging to `objectType = group`. These are only applicable to the Security, Office 365, Mail Enabled Security, and Distributed type of group memberships. For more information on filters, refer to the [Microsoft documentation](<https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http>).

   > **Note**
   >
   > You can provide filters as mentioned in the examples above, and the connector ensures the formation of an appropriate advanced filter query. This field supports advanced filter queries such as `endsWith`, `NOT`, and `NE`.

   For example,

   - To aggregate only group memberships with group display name starting with 'A', use `startswith(displayName,'A')`.
   - To aggregate only group memberships with groups not belonging to on-premises AD (or to only include cloud group memberships), use `onPremisesSyncEnabled ne true`.
   - To exclude dynamic group memberships during account aggregation , use `NOT groupTypes/any(c:c eq 'DynamicMembership')`

   > **Important**
   >
   > SailPoint recommends excluding membership information is not a best practice from a governance and security standpoint. You should have full visibility into users and devices, including their groups, assigned permissions, and how these configurations impact access to resources. The group membership filter should be used carefully and only when necessary, ensuring that access is managed and only the right individuals have access to sensitive information or resources.
6. In the **Directory Roles Filter** field, when the entitlement schema "roles" is present in the source, enter filter statements to ensure that only the specified roles are aggregated during entitlement aggregation. For example, `isBuiltIn eq true`. For more information on filtering conditions and values, refer to the [Microsoft documentation](<https://learn.microsoft.com/en-us/graph/api/rbacapplication-list-roledefinitions?view=graph-rest-1.0&amp;tabs=http#optional-query-parameters>).
7. Select **Save**.

> [!NOTE]
>
> - If the filter (either Group Filter or User Filter) uses any advanced query filter (per the [Microsoft documentation](<https://learn.microsoft.com/en-us/graph/aad-advanced-queries>)), then Advanced User Filter and Advanced Group Filter should also be selected.
> - The connector supports advanced query filters like `endsWith`, `NOT`, and `NE` during aggregation. The Azure API does not support the advanced query filters while also using an expanded attribute such as `manager` in the URL. When using the advanced filters, ensure that you remove the `manager` attribute from the account schema and remove the `owners` attribute from the group schema.
> - If you're using the advanced filters you must add the `supportsAdvancedAccountFilter` attribute to the source XML using the SailPoint REST API. The connector will then automatically add the required header (ConsistencyLevel:eventual) in the header and add `&$count=true`
>
>   For example:
>
>   `POST https://{orgName}.api.identitynow.com/cc/api/source/update/{source ID}`
>
>   In the body of the POST, use the form-data as follows:
>
>   - Key: `supportsAdvancedAccountFilter`
>   - Value: `true`

## Machine Identity Governance Settings

> [!IMPORTANT]
>
> You must have a SailPoint Agent Identity Security license to enable the Agent governance features. Contact your SailPoint Customer Success Manager for more details on obtaining the necessary license.

To enable agents aggregation, follow these steps:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/agent_governance_settings.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/agent_governance_settings.png>)

1. Go to Microsoft Entra ID SaaS source configuration page within SailPoint.
2. Select **Machine Identity Governance Settings** tab.
3. Select **Enable Azure AI Foundry Agents**. This enables Azure AI Foundry agents aggregation for your environment. For more information, refer to [Azure AI Foundry Agents Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html#azure-ai-foundry-agents-management>).
4. Select **Always Use the Available Latest Version** if you want to use the latest available version of Azure Foundry AI agents for your environment. To select this option, ensure you have selected **Enable Azure AI Foundry Agents**.
5. Select **Enable Microsoft Copilot Studio Agents**. This enables Copilot agent aggregation for your environment. For more information, refer to [Microsoft Copilot Studio Agents Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html#microsoft-copilot-studio-agents-management>).
6. Select **Enable Microsoft Agent 365** when your tenant is licensed for Microsoft Agent 365. When you turn this toggle on, all catalog platform checkboxes below default to checked. If your source uses Client Credentials authentication, you need to provide a refresh token with the required permissions. For more information, refer to [Microsoft Agent 365 Catalog Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html#microsoft-agent-365-catalog-management>).
7. Select **Save**.

## Additional Configurations

### Additional Configuration Parameters

You must add the following attributes in the connector using the SailPoint REST API. Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>).

| Parameter | Description |
| --- | --- |
| createAppTemplateSPNDelay | (Only applicable for create service principals and applications that are created making use of gallery templates).<br>The time, in seconds, to wait after the create service principal and application, and before making the update for basic SAML configuration. The default is 24 seconds.<br>For example, `<entry key="createAppTemplateSPNDelay" value="30"/>` |
| performGetObjectForEXOAttributes | To enable / disable reading of exchange online attributes from exchange system (real time exchange online attribute values) during explicit get object call for specified user, set the value of `performGetObjectForEXOAttributes` attribute to true.<br>Note<br>This configuration parameter is applicable only for get object call. Enabling this configuration parameter will degrade performance of get object calls. |
| createAccountTimelag | Time in seconds to wait after create account and before calling get account. The default is 20 seconds. |
| fetchB2CMembership | (*Applicable for B2C tenant only*) If set to true B2C user memberships is fetched for all users. The default value is false. |
| useMSGraphAPI | Enables use of Microsoft Graph API for all connector operations.<br>To use the latest attributes and features supported by Microsoft Graph API, add the `useMSGraphAPI` attribute using the REST API and set it to true. |
| msgraph-api-version | The Microsoft Graph API version is configurable.<br>You must add the `msgraph-api-version` attribute in the source using the REST API.<br>The value of the attribute must be a valid version stated by Microsoft for MS Graph APIs. |
| skipEncodingImmutableId | Enable to skip encoding of `ImmutableID` while creating a federated user. Enable this feature by using the REST API to set the `skipEncodingImmutableID` parameter to `true`. The default value is `false`. |
| fetchServicePlan | To disable fetching of service plans during account and group aggregation, set the value of `fetchServicePlan` to `false` using the REST APIs. For example:<br>`curl -L -X PATCH 'https://.api.identitynow.com/v3/sources/:id' \-H 'Content-Type: application/json-patch+json' \-H 'Accept: application/json' \-H 'Authorization: Bearer ' \--data-raw '[ {       "op": "add",        "path": "/connectorAttributes/fetchServicePlan",        "value": false  }]` |
| sleepBetweenAssignedPlans | Time in seconds to wait between adding or removing `assignedPlans`. The default is 3 seconds.<br>Add the `sleepBetweenAssignedPlans` attribute using the REST API and set it as required. |

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

---

title: AI Agent Resources url: [https://documentation.sailpoint.com/connectors/microsoft/entra\_id/saas/help/datasets/ai\_agent\_resources.html](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html>) tags: - Microsoft Foundry Resources - Microsoft Agent 365 Catalog Resources - Microsoft Copilot Studio Resources

# AI Agent Resources

## Microsoft Foundry Resources

The Microsoft Foundry dataset includes the following resources, which are collected together during dataset aggregation.

| Resource name | Resource type | Resource ID |
| --- | --- | --- |
| [Microsoft Foundry Agent](<#microsoft-foundry-agent>) | Agent | `azure:foundry-agent` |
| [Microsoft Foundry Tool](<#microsoft-foundry-tool>) | Capability | `azure:foundry-tool` |
| [Microsoft Foundry Agent Has Tool](<#microsoft-foundry-agent-has-tool>) | Access | `azure:agent-has-tool` |
| [Microsoft Foundry Agent Has Connected Sub-Agent](<#microsoft-foundry-agent-has-connected-sub-agent>) | Access | `azure:agent-has-connected-agent` |

### Microsoft Foundry Agent

| Field | Value |
| --- | --- |
| Resource ID | `azure:foundry-agent` |
| Resource type | `std:agent` |
| Identity attribute | id |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Foundry Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| agentName | The agent name or lineage identifier (for example, `teams-agent`). | string | No | No |
| atomic\_unit | The stable GUID shared across all versions of the same agent lineage. | string | No | No |
| agentLaunchId | The Azure Resource Manager (ARM) resource path for the Foundry project. The connector uses this value during provisioning to construct deployment operations. | string | No | No |
| blueprintClientId | The client ID portion of the agent blueprint managed identity. Empty for legacy agents. | string | No | No |
| blueprintId | The stable, human-readable blueprint identifier (for example, `teams-agent-safe`). Empty for legacy agents. | string | No | No |
| blueprintPrincipalId | The Microsoft Entra object ID of the agent blueprint service principal (managed identity). Empty for legacy agents. | string | No | No |
| blueprintType | The blueprint type (for example, `ManagedIdentityBaseBlueprint`). Empty for legacy agents. | string | No | No |
| createdAt | The ISO-8601 timestamp when the agent version was created. | string | No | No |
| createdBy | The identity that created the parent Foundry project resource through ARM provisioning, stored in `systemData.createdBy`. This is not the RBAC owner. | string | No | No |
| deploymentNames | The ARM deployment names that reference this agent version. | string | No | No |
| description | The description of the agent version. | string | No | No |
| id | The primary key for the agent. For classic Foundry agents, the value follows the `ProjectName/versionId` format. | string | No | No |
| instanceClientId | The client ID of the agent instance service principal. When present, this value matches the Microsoft Graph agent identity. | string | No | No |
| instancePrincipalId | The Microsoft Entra object ID of the agent instance service principal. Empty for legacy agents. | string | No | No |
| instructions | The system prompt or instructions for this agent version. | string | No | No |
| kind | The agent kind. Possible values include `prompt`, `toolset`, `workflow`, and `container_app`. | string | No | No |
| lastModifiedBy | The identity that last modified the parent Foundry project resource through ARM provisioning, stored in `systemData.lastModifiedBy`. This is not the RBAC owner. | string | No | No |
| model | The AI model assigned to the agent (for example, `gpt-4o` or `gpt-4`). | string | No | No |
| modifiedAt | The ISO-8601 timestamp when the agent version was last modified, sourced from `metadata:modifiedAt`. | string | No | No |
| name | The display name of the agent or assistant. | string | No | No |
| operationalDate | The ARM deployment state for published versions. Possible values are `Running` and `Stopped`. | string | No | No |
| primary\_deploymentName | The ARM deployment name the connector uses for step or start operations. | string | No | No |
| projectName | The name of the Foundry project that contains the agent (for example, `TestProject`). | string | No | No |
| published | Indicates whether the agent version is published (`true` when at least one ARM deployment exists for the version). | boolean | No | No |
| response\_format | The response format setting for the agent. Supported for classic Foundry agents only. | string | No | No |
| saasInstanceLocation | The source SaaS instance name (Azure AI Foundry). | string | No | No |
| status | The operational state of the agent. Possible values are `Active`, `Running`, and `Inactive` (Stopped). Empty when the agent is not yet deployed. | string | No | No |
| temperature | The temperature parameter for the agent. Supported for classic Foundry agents only. | int | No | No |
| tools | The simplified list of tools allowed for this agent version. | string | No | No |
| top\_p | The top-p sampling parameter for the agent. Supported for classic Foundry agents only. | int | No | No |
| version | The version label for the agent (for example, `latest` or `v1`). | string | No | No |
| versionId | The version ID for the agent (for example, `1`, `2`, or a raw ID). | string | No | No |
| Version Status | The lifecycle status returned by the project API (for example, `active`). | string | No | No |

### Microsoft Foundry Tool

| Field | Value |
| --- | --- |
| Resource ID | `azure:foundry-tool` |
| Resource type | `std:capability` |
| Identity attribute | identity |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Foundry Tool resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>identity</td> <td>The unique identifier for the tool, constructed from the agent identity, tool type, and tool name or ID.</td> <td colspan="1" rowspan="4">string</td> <td colspan="1" rowspan="4">No</td> <td colspan="1" rowspan="4">No</td> </tr> <tr> <td>name</td> <td>The display name of the tool. Empty for <code>file_search</code> and <code>code_interpreter</code> tool types.</td> </tr> <tr> <td>toolResourceId</td> <td>The fallback identifier for tools without a name, such as a <code>file_search</code> vector store ID or a <code>code_interpreter</code> resource ID.</td> </tr> <tr> <td>toolType</td> <td>The category of the tool. Possible values include <code>openapi</code>, <code>file_search</code>, <code>code_interpreter</code>, and <code>other</code>.</td> </tr> </table>

### Microsoft Foundry Agent Has Tool

| Field | Value |
| --- | --- |
| Resource ID | `azure:agent-has-tool` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Foundry Agent Has Tool resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Foundry agent and a tool. | string | No | No |
| linkResolvedBy | Service that resolved this link( during aggregation.??) | string | No | No |

### Microsoft Foundry Agent Has Connected Sub-Agent

| Field | Value |
| --- | --- |
| Resource ID | `azure:agent-has-connected-agent` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Foundry Agent Has Connected Sub-Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Foundry agent and a connected sub-agent. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

## Microsoft Agent 365 Catalog Resources

The Microsoft 365 Agent Catalog dataset includes the following resources, which are collected together during dataset aggregation.

| Resource name | Resource type | Resource ID |
| --- | --- | --- |
| [Microsoft Agent 365](<#microsoft-agent-365>) | Agent | `microsoft:agent365-package` |
| [Microsoft Agent 365 Package Service Principal](<#microsoft-agent-365-package-service-principal>) | Access | `microsoft:agent365-uses-service-principal` |

### Microsoft Agent 365

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:agent365-package` |
| Resource type | `std:agent` |
| Identity attribute | identity |
| Display attribute | name |

The following table lists schema attributes for Microsoft Agent 365 resource:

| Attribute Name | Attribute Details |
| --- | --- |
| agentIdentityBlueprintId | The Microsoft Entra Blueprint service principal application ID linked to the catalog package. |
| agentIdentityId | The Microsoft Entra AgentIdentity service principal object ID linked to the catalog package. For line-of-business packages without element details, this value falls back to `appId`. Used as the machine account key. |
| appId | The application ID for the catalog package, when present. |
| assetId | The asset ID for the catalog package, when present. |
| availableTo | The availability scope for the catalog package. |
| catalogPackageType | The Microsoft Graph copilot package type. Possible values include `shared`, `lob`, and `thirdParty`. |
| deployedTo | The deployment scope for the catalog package. |
| elementTypes | The element types included in the catalog package. This is a multi-valued attribute. |
| identity | The unique catalog package identifier (for example, `T_xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx` or `P_...`). |
| isBlocked | Indicates whether the catalog package is blocked (`true`) or unblocked (`false`). Block and unblock operations are supported only for Foundry and Microsoft 365 Copilot Agent Builder packages. |
| lastModifiedDateTime | The ISO-8601 timestamp when the catalog package was last modified. |
| longDescription | The long description of the catalog package. |
| manifestId | The manifest ID for the catalog package, when present. |
| manifestVersion | The manifest version of the catalog package. |
| name | The display name of the catalog package. |
| ownerId | The object ID of the catalog package owner, when present. |
| platform | The platform where the agent was created. Possible values include `Foundry`, `Microsoft 365 Copilot Agent Builder`, and `Copilot Studio`. |
| publisher | The publisher of the catalog package. |
| shortDescription | The short description of the catalog package. |
| spBusinessApplication | The source business application name (Microsoft Agent 365). |
| spStatus | The status of the catalog package. Possible values are `Active` (when `isBlocked` is `false`) and `Inactive` (when `isBlocked` is `true`). This value is empty when the blocked state is unknown. |
| supportedHosts | The hosts where the catalog package runs. This is a multi-valued attribute. |
| version | The version of the catalog package. |

### Microsoft Agent 365 Package Service Principal

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:agent365-uses-service-principal` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for Microsoft Agent 365 Package Service Principal resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier for the access link between an Agent 365 catalog package and its associated Entra service principal. Constructed as `microsoft:agent365-uses-service-principal#<packageId>#<servicePrincipalId>`. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

## Microsoft Copilot Studio Resources

The Microsoft Copilot Studio dataset includes the following resources, which are collected together during dataset aggregation.

| Resource name | Resource type | Resource ID |
| --- | --- | --- |
| [Microsoft Copilot Studio Agent](<#microsoft-copilot-studio-agent>) | Agent | `microsoft:copilot-agent` |
| [Microsoft Copilot Studio Tool](<#microsoft-copilot-studio-tool>) | Capability | `microsoft:copilot-tool` |
| [Microsoft Copilot Studio Knowledge Base](<#microsoft-copilot-studio-knowledge-base>) | Capability | `microsoft:copilot-knowledge` |
| [Microsoft Copilot Studio File Attachment](<#microsoft-copilot-studio-file-attachment>) | Capability | `microsoft:copilot-file` |
| [Microsoft Copilot Studio Agent Uses Tool](<#microsoft-copilot-studio-agent-uses-tool>) | Access | `microsoft:copilot-agent-uses-tool` |
| [Microsoft Copilot Studio Agent Uses Knowledge Base](<#microsoft-copilot-studio-agent-uses-knowledge-base>) | Access | `microsoft:copilot-agent-uses-knowledge` |
| [Microsoft Copilot Studio Agent Has File Attachment](<#microsoft-copilot-studio-agent-has-file-attachment>) | Access | `microsoft:copilot-agent-has-file` |
| [Microsoft Copilot Studio Agent Uses Connected Agent](<#microsoft-copilot-studio-agent-uses-connected-agent>) | Access | `microsoft:copilot-agent-uses-agent` |
| [Microsoft Copilot Studio Connected Agent](<#microsoft-copilot-studio-connected-agent>) | Access | `microsoft:copilot-connected-agent` |
| [Microsoft Copilot Studio Agent Uses Service Principal](<#microsoft-copilot-studio-agent-uses-service-principal>) | Access | `microsoft:copilot-agent-uses-service-principal` |

### Microsoft Copilot Studio Agent

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-agent` |
| Resource type | `std:agent` |
| Identity attribute | identity |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Copilot Studio Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| created\_at | The ISO-8601 timestamp when the agent was created. | string | No | No |
| description | The description of the Copilot agent. | string | No | No |
| entraIdentityId | The Microsoft Entra service principal identity associated with the agent. For legacy App Registration bots, this value is the `appId`. For Entra Agent ID bots, this value is the `AgentIdentity` service principal object ID from `synchronizationstatus.botRegistration.applicationId`. | string | No | No |
| identity | The unique identifier of the Copilot agent. | string | No | No |
| name | The display name of the Copilot agent. | string | No | No |
| orgApiUrl | The Dataverse organization API base URL for the Power Platform environment that hosts the agent. | string | No | No |
| owner | The owner of the agent, specified as a user principal name (UPN) or email address. | string | No | No |
| spBusinessApplication | The source business application name ( Microsoft Copilot Studio | string | No | No |
| spStatus | The lifecycle status of the agent derived from the Power Platform statecode Active statecode Inactive statecode | string | No | No |
| status | The operational status of the agent. Possible values are Active Inactive | string | No | No |
| updated\_at | The ISO-8601 timestamp when the agent was last updated. | string | No | No |

### Microsoft Copilot Studio Tool

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-tool` |
| Resource type | `std:capability` |
| Identity attribute | Identity |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Copilot Studio Tool resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>credentialMode</td> <td>The credential mode defined in <code>connectionProperties</code> for the tool connection.</td> <td colspan="1" rowspan="4">string</td> <td colspan="1" rowspan="4">No</td> <td colspan="1" rowspan="4">No</td> </tr> <tr> <td>Identity</td> <td>The tool GUID (<code>botcomponentid</code> from Dataverse).</td> </tr> <tr> <td>name</td> <td>The display name of the tool.</td> </tr> <tr> <td>toolType</td> <td>The tool type extracted from the component data YAML.</td> </tr> </table>

### Microsoft Copilot Studio Knowledge Base

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-knowledge` |
| Resource type | `std:capability` |
| Identity attribute | identity |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Copilot Studio Knowledge Base resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| credentialMode | The credential mode defined in `connectionProperties` for the knowledge base connection. | string | No | No |
| identity | The knowledge base GUID (`botcomponentid` from Dataverse). | string | No | No |
| name | The display name of the knowledge base. | string | No | No |

### Microsoft Copilot Studio File Attachment

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-file` |
| Resource type | `std:capability` |
| Identity attribute | identity |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Copilot Studio File Attachment resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | The file attachment GUID (`botcomponentid` from Dataverse). | string | No | No |
| name | The name of the uploaded file. | string | No | No |

### Microsoft Copilot Studio Agent Uses Tool

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-agent-uses-tool` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Copilot Studio Agent Uses Tool resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Copilot Studio agent and a tool. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

### Microsoft Copilot Studio Agent Uses Knowledge Base

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-agent-uses-knowledge` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Copilot Studio Agent Uses Knowledge Base resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Copilot Studio agent and a knowledge base. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

### Microsoft Copilot Studio Agent Has File Attachment

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-agent-has-file` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Copilot Studio Agent Has File Attachment resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Copilot Studio agent and a file attachment. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

### Microsoft Copilot Studio Agent Uses Connected Agent

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-agent-uses-agent` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Copilot Studio Agent Uses Connected Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Copilot Studio agent and a connected agent. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

### Microsoft Copilot Studio Connected Agent

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-connected-agent` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Copilot Studio Connected Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link for a Microsoft Copilot Studio connected agent. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

### Microsoft Copilot Studio Agent Uses Service Principal

| Field | Value |
| --- | --- |
| Resource ID | `microsoft:copilot-agent-uses-service-principal` |
| Resource type | `std:access` |
| Identity attribute | identity |
| Display attribute | identity |

The following table lists schema attributes for the Microsoft Copilot Studio Agent Uses Service Principal resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| identity | Unique identifier of the access link between a Microsoft Copilot Studio agent and a service principal. | string | No | No |
| linkResolvedBy | Service that resolved this link during aggregation. | string | No | No |

# Dataset Management

The Microsoft Entra ID SaaS connector uses datasets to aggregate and govern AI agents and other non-human identities from the managed system into SailPoint. Each dataset groups one or more resources during dataset aggregation. A resource defines the object types a source collects and controls how the source aggregates those objects.

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Microsoft Entra ID SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

The connector uses datasets to schedule aggregation of the following resource types:

| Dataset | Resource Type | Associated Resources |
| --- | --- | --- |
| Microsoft Foundry | Agent | [Microsoft Foundry Agent](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-foundry-agent>) |
| Microsoft Foundry | Capability | [Microsoft Foundry Tool](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-foundry-tool>) |
| Microsoft Foundry | Access | [Microsoft Foundry Agent Has Tool](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-foundry-agent-has-tool>) |
| Microsoft Foundry | Access | [Microsoft Foundry Agent Has Connected Sub-Agent](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-foundry-agent-has-connected-sub-agent>) |
| Microsoft Agent 365 | Agent | [Microsoft Agent 365](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-agent-365>) |
| Microsoft Agent 365 | Access | [Microsoft Agent 365 Package Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-agent-365-package-service-principal>) |
| Microsoft Copilot Studio | Agent | [Microsoft Copilot Studio Agent](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-agent>) |
| Microsoft Copilot Studio | Capability | [Microsoft Copilot Studio Tool](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-tool>) |
| Microsoft Copilot Studio | Capability | [Microsoft Copilot Studio Knowledge Base](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-knowledge-base>) |
| Microsoft Copilot Studio | Capability | [Microsoft Copilot Studio File Attachment](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-file-attachment>) |
| Microsoft Copilot Studio | Access | [Microsoft Copilot Studio Agent Uses Tool](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-agent-uses-tool>) |
| Microsoft Copilot Studio | Access | [Microsoft Copilot Studio Agent Uses Knowledge Base](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-agent-uses-knowledge-base>) |
| Microsoft Copilot Studio | Access | [Microsoft Copilot Studio Agent Has File Attachment](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-agent-has-file-attachment>) |
| Microsoft Copilot Studio | Access | [Microsoft Copilot Studio Agent Uses Connected Agent](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-agent-uses-connected-agent>) |
| Microsoft Copilot Studio | Access | [Microsoft Copilot Studio Connected Agent](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-connected-agent>) |
| Microsoft Copilot Studio | Access | [Microsoft Copilot Studio Agent Uses Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-agent-uses-service-principal>) |
| Azure Entro Agent | Agent | [Microsoft Entra AI Agent](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-ai-agent-resource>) |
| Azure Entra App Token | Credential | [Microsoft Entra App Token](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-app-token-resources>) |
| Azure Entra Hybrid Service Account | Account | [Microsoft Entra Hybrid Service Account](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-hybrid-service-account-resource>) |
| Azure Entra SAML Certificate | Credential | [Microsoft Entra SAML Certificate](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-saml-certificate-resource>) |
| Microsoft 365 Copilot Chat | Agent | [Microsoft 365 Copilot Chat](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-365-copilot-chat-resource>) |
| Microsoft Entra Application Credentials | Credential | [Microsoft Entra App Client Secret](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-app-client-secret>) |
| Microsoft Entra Application Credentials | Credential | [Microsoft Entra App Certificate](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-app-certificate>) |
| Microsoft Entra Application Credentials | Credential | [Microsoft Entra App Federated Credential](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-app-federated-credential>) |
| Microsoft Entra Application Credentials | Credential | [Microsoft Entra SAML Token Signing Certificate](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html#microsoft-entra-saml-token-signing-certificate>) |

## Supported Resources

A resource represents a type of object the connector collects from the connected system (such as, service accounts, bots or agents). Each resource defines the attributes collected for that object type (such as name, ID, or status) and how each object appears in SailPoint.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Refer to [AI Agent Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html>) and [Non-Human Identity Discovery Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/nhi_discovery_resources.html>) for the resources in each dataset.

# Non-Human Identity Discovery Resources

## Microsoft Entra AI Agent Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure-as-agent` |
| Resource type | `std:agent` |
| Identity attribute | id |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Entra AI Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| agentType | Constant discriminator supplied by SailPoint NHI Discovery (for example, `SaaS Agent`). | string | No | No |
| appUrl | Application URL in the source system (for example, an Azure portal app URL). | string | No | No |
| classification | Pre-filled classification enum (for example, `Third-party` or `Homegrown`). | string | No | No |
| detectionMethod | Detection method used by SailPoint NHI Discovery (for example, `Azure Service Principal`). | string | No | No |
| environment | Environment name from the source account. | string | No | No |
| id | Stable identity for the agent (Azure service principal ID). | string | No | No |
| insights | Human-readable insight descriptions from SailPoint NHI Discovery policy evaluation. | string | No | Yes |
| integrationType | Integration type reported by the source (for example, `AZURE`). | string | No | No |
| isVerifiedPublisher | Whether Microsoft has verified the publisher. Returns null when verification status is unavailable. | boolean | No | No |
| lastSeen | ISO-8601 timestamp for the most recent usage or update. | string | No | No |
| name | Normalized AI client name (for example, `m365-mcp-server-for-copilot`). | string | No | No |
| ownerEmail | Flattened owner email used for owner correlation. | string | No | No |
| rawName | Original name from the source system (for example, `M365 MCP Server for Copilot`). | string | No | No |
| riskBand | Severity band from SailPoint NHI Discovery (for example, `BENIGN`, `LOW`, `MEDIUM`, or `HIGH`). | string | No | No |
| sourceAccount | Account display name (falls back to account or tenant ID when a display name is unavailable). | string | No | No |
| sourceUrl | Deep link to the source object (for example, an Azure portal URL). | string | No | No |
| tags | Tags from the source account. | string | No | Yes |
| verifiedPublisherName | Verified publisher display name, when present. | string | No | No |

## Microsoft Entra App Token Resources

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-token` |
| Resource type | `std:credential` |
| Identity attribute | id |
| Display attribute | id |

The following table lists schema attributes for the Microsoft Entra App Token resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>complianceBreach</td> <td>Compliance control IDs the token fails.</td> <td>string</td> <td colspan="1" rowspan="8">No</td> <td>Yes</td> </tr> <tr> <td>exposed</td> <td>Whether the token is externally exposed.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>id</td> <td>Stable token identifier from SailPoint NHI Discovery.</td> <td>string</td> <td>No</td> </tr> <tr> <td>lastUsedService</td> <td>Downstream service most recently used by the token.</td> <td>string</td> <td>No</td> </tr> <tr> <td>ownerEmail</td> <td>Flattened primary owner email used for owner correlation.</td> <td>string</td> <td>No</td> </tr> <tr> <td>riskSeverity</td> <td>Severity band from SailPoint NHI Discovery (for example, <code>LOW</code> or <code>HIGH</code>).</td> <td>string</td> <td>No</td> </tr> <tr> <td>suspiciousActivity</td> <td>Whether SailPoint NHI Discovery has flagged suspicious activity for the token.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>tags</td> <td>Tags carried through from the source account.</td> <td>string</td> <td>Yes</td> </tr> </table>

## Microsoft Entra Hybrid Service Account Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure:hybrid-service-account` |
| Resource type | `std:account` |
| Identity attribute | id |
| Display attribute | id |

The following table lists schema attributes for the Microsoft Entra Hybrid Service Account resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>complianceBreach</td> <td>Compliance control IDs the account fails.</td> <td>string</td> <td colspan="1" rowspan="8">No</td> <td>Yes</td> </tr> <tr> <td>exposed</td> <td>Whether the account is externally exposed.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>id</td> <td>Stable account identifier from SailPoint NHI Discovery.</td> <td>string</td> <td>No</td> </tr> <tr> <td>lastUsedService</td> <td>Downstream service most recently used by the account.</td> <td>string</td> <td>No</td> </tr> <tr> <td>ownerEmail</td> <td>Flattened primary owner email used for owner correlation.</td> <td>string</td> <td>No</td> </tr> <tr> <td>riskSeverity</td> <td>Severity band from SailPoint NHI Discovery (for example, <code>LOW</code> or <code>HIGH</code>).</td> <td>string</td> <td>No</td> </tr> <tr> <td>suspiciousActivity</td> <td>Whether SailPoint NHI Discovery has flagged suspicious activity for the account.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>tags</td> <td>Tags carried through from the source account.</td> <td>string</td> <td>Yes</td> </tr> </table>

## Microsoft Entra SAML Certificate Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure-saml-certificate` |
| Resource type | `std:credential` |
| Identity attribute | id |
| Display attribute | id |

The following table lists schema attributes for the Microsoft Entra SAML Certificate resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>complianceBreach</td> <td>Compliance control IDs the certificate fails.</td> <td>string</td> <td colspan="1" rowspan="8">No</td> <td>Yes</td> </tr> <tr> <td>exposed</td> <td>Whether the certificate is externally exposed.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>id</td> <td>Stable certificate identifier from SailPoint NHI Discovery.</td> <td>string</td> <td>No</td> </tr> <tr> <td>lastUsedService</td> <td>Downstream service most recently used by the certificate.</td> <td>string</td> <td>No</td> </tr> <tr> <td>ownerEmail</td> <td>Flattened primary owner email used for owner correlation.</td> <td>string</td> <td>No</td> </tr> <tr> <td>riskSeverity</td> <td>Severity band from SailPoint NHI Discovery (for example, <code>LOW</code> or <code>HIGH</code>).</td> <td>string</td> <td>No</td> </tr> <tr> <td>suspiciousActivity</td> <td>Whether SailPoint NHI Discovery has flagged suspicious activity for the certificate.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>tags</td> <td>Tags carried through from the source account.</td> <td>string</td> <td>Yes</td> </tr> </table>

## Microsoft 365 Copilot Chat Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure:copilot-enterprise-chat` |
| Resource type | `std:agent` |
| Identity attribute | id |
| Display attribute | name |

The following table lists schema attributes for the Microsoft 365 Copilot Chat resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| agentType | Discriminator from SailPoint NHI Discovery (for example, `Microsoft Copilot License`). | string | No | No |
| classification | Prettified classification enum (for example, `Third-party` or `Homegrown`). | string | No | No |
| connectedServices | Connected Microsoft 365 services (for example, SharePoint, Office, or Outlook). | string | No | Yes |
| detectionMethod | Detection method used by SailPoint NHI Discovery (for example, `Microsoft 365 Copilot License Assignment`). | string | No | No |
| environment | Environment name from the source account (for example, `Production`). | string | No | No |
| id | Stable identity for the Copilot chat or license assignment (GUID from SailPoint NHI Discovery). | string | No | No |
| insights | Human-readable insight descriptions from SailPoint NHI Discovery policy evaluation. | string | No | Yes |
| integrationType | Integration type reported by the source (for example, `AZURE`). | string | No | No |
| lastSeen | ISO-8601 timestamp for the most recent usage or update signal. | string | No | No |
| name | Normalized name (for example, `microsoft 365 copilot`). | string | No | No |
| ownerEmail | Flattened owner email used for owner correlation. Returns null when SailPoint NHI Discovery provides only `userPrincipalName`. | string | No | No |
| rawName | Original name from the source system (for example, `M365 BizChat`). | string | No | No |
| riskBand | Severity band from SailPoint NHI Discovery (for example, `BENIGN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`, or `UNKNOWN`). | string | No | No |
| sessionCount | Total Copilot session count reported by SailPoint NHI Discovery. | int | No | No |
| sourceAccount | Account display name (falls back to account or tenant ID when a display name is unavailable). | string | No | No |
| sourceUrl | Deep link to the source object. Returns null when SailPoint NHI Discovery has no URL. | string | No | No |
| suspiciousSessionCount | Count of Copilot sessions SailPoint NHI Discovery marked as suspicious. | int | No | No |
| tags | Tags from the source account. | string | No | Yes |
| userPrincipalName | User principal name (UPN) of the licensed or chat user. Used as the primary owner correlation key when owner email is null. | string | No | No |

## Microsoft Entra Application Credentials Resources

The Microsoft Entra Application Credentials dataset includes the following resources, which are collected together during dataset aggregation. These credentials belong to app registrations and SAML enterprise applications.

Application credential native IDs use `{application.appId}:{credential.keyId}`. The SAML token signing certificate native ID uses `{SP object id}:{Sign keyId}`.

<table class="span-table"> <tr> <td>Resource name</td> <td>Resource type</td> <td>Resource ID</td> </tr> <tr> <td><a href="#microsoft-entra-app-client-secret">Microsoft Entra App Client Secret</a></td> <td colspan="1" rowspan="4">Credential</td> <td><code>azure:app-client-secret</code></td> </tr> <tr> <td><a href="#microsoft-entra-app-certificate">Microsoft Entra App Certificate</a></td> <td><code>azure:app-certificate</code></td> </tr> <tr> <td><a href="#microsoft-entra-app-federated-credential">Microsoft Entra App Federated Credential</a></td> <td><code>azure:app-federated-credential</code></td> </tr> <tr> <td><a href="#microsoft-entra-saml-token-signing-certificate">Microsoft Entra SAML Token Signing Certificate</a></td> <td><code>azure:saml-cert</code></td> </tr> </table>

### Microsoft Entra App Client Secret

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-client-secret` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra App Client Secret resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| LastRotated | The last rotation time. This value matches startDateTime. | String | No | No |
| NHIType | The non-human identity type. Always set to `AZURE_APP_TOKEN`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Credentials blade URL. | String | No | No |
| appDisplayName | The display name of the app registration. This value comes from Microsoft Graph application.displayName. | String | No | No |
| creationDate | The credential start time (startDateTime). | String | No | No |
| credentialId | The keyId of the Microsoft Graph passwordCredential. | String | No | No |
| credentialType | The Certificates &amp; secrets tab name in the Microsoft Entra admin center. Always set to `Client secrets`. | String | No | No |
| daysSinceLastUse | The number of full days from lastUsed to the current time. This attribute is omitted when the credential is expired or the last-used time is unknown. | Integer | No | No |
| daysUntilExpiry | The number of full days from the current time to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| discoveredAt | The time the connector aggregated the credential. | String | No | No |
| expirationDate | The credential end time (endDateTime). | String | No | No |
| extendedPermissions | A JSON object of extended permissions, stored as a string. | String | No | No |
| isActive | Indicates whether the credential is not expired, has been created, and was last used within 90 days (`true` or `false`). | Boolean | No | No |
| isAdmin | Indicates whether the parent service principal has an Azure Resource Manager (ARM) role with the exact scope `*` (`true` or `false`). | Boolean | No | No |
| isIdle | Indicates whether the credential meets the 30-day unused rule (`true` or `false`). | Boolean | No | No |
| lastUsed | The last sign-in time for this keyId. This value comes from Microsoft Graph appCredentialSignInActivities lastSignInDateTime. | String | No | No |
| lifetimeDays | The number of full days from the start date to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| name | The list display name, in the form `{appDisplayName}:{credentialId}`. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| permissions | A JSON array of API permissions, stored as a string. | String | No | No |
| riskFlags | A JSON array of SailPoint policy flags, stored as a string. The array includes `EXPIRED` when the current time is past endDateTime. | String | No | No |
| sailpointId | The native ID, in the form `{application.appId}:{credential.keyId}`. | String | No | No |
| secretHint | The password hint. This value comes from Microsoft Graph passwordCredential.hint. | String | No | No |
| spDescription | The display name of the Microsoft Graph passwordCredential. | String | No | No |
| tags | A JSON array of Microsoft Graph application tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |
| tokenAgeDays | The number of full days from the start date to aggregation. This attribute is omitted when the credential is expired. | Integer | No | No |
| tokenName | The parent application ID (appId). | String | No | No |

### Microsoft Entra App Certificate

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-certificate` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra App Certificate resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| LastRotated | The last rotation time. This value matches startDateTime. | String | No | No |
| NHIType | The non-human identity type. Always set to `AZURE_APP_TOKEN`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Credentials blade URL. | String | No | No |
| appDisplayName | The display name of the app registration. This value comes from Microsoft Graph application.displayName. | String | No | No |
| certificateThumbprint | The certificate thumbprint. This value comes from Microsoft Graph customKeyIdentifier. | String | No | No |
| creationDate | The credential start time (startDateTime). | String | No | No |
| credentialId | The keyId of the Microsoft Graph keyCredential. | String | No | No |
| credentialType | The Certificates &amp; secrets tab name in the Microsoft Entra admin center. Always set to `Certificates`. | String | No | No |
| daysSinceLastUse | The number of full days from lastUsed to the current time. This attribute is omitted when the credential is expired or the last-used time is unknown. | Integer | No | No |
| daysUntilExpiry | The number of full days from the current time to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| discoveredAt | The time the connector aggregated the credential. | String | No | No |
| expirationDate | The credential end time (endDateTime). | String | No | No |
| extendedPermissions | A JSON object of extended permissions, stored as a string. | String | No | No |
| isActive | Indicates whether the credential is not expired, has been created, and was last used within 90 days (`true` or `false`). | Boolean | No | No |
| isAdmin | Indicates whether the parent service principal has an Azure Resource Manager (ARM) role with the exact scope `*` (`true` or `false`). | Boolean | No | No |
| isIdle | Indicates whether the credential meets the 30-day unused rule (`true` or `false`). | Boolean | No | No |
| lastUsed | The last sign-in time for this keyId. This value comes from Microsoft Graph appCredentialSignInActivities lastSignInDateTime. | String | No | No |
| lifetimeDays | The number of full days from the start date to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| name | The list display name, in the form `{appDisplayName}:{credentialId}`. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| permissions | A JSON array of API permissions, stored as a string. | String | No | No |
| riskFlags | A JSON array of SailPoint policy flags, stored as a string. The array includes `EXPIRED` when the current time is past endDateTime. | String | No | No |
| sailpointId | The native ID, in the form `{application.appId}:{credential.keyId}`. | String | No | No |
| secretHint | The password hint. This attribute is empty for certificates. | String | No | No |
| spDescription | The display name of the Microsoft Graph keyCredential. | String | No | No |
| tags | A JSON array of Microsoft Graph application tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |
| tokenAgeDays | The number of full days from the start date to aggregation. This attribute is omitted when the credential is expired. | Integer | No | No |
| tokenName | The parent application ID (appId). | String | No | No |

### Microsoft Entra App Federated Credential

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-federated-credential` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra App Federated Credential resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| NHIType | The non-human identity type. Always set to `AZURE_FEDERATED_CREDENTIAL`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Certificates &amp; secrets blade URL. | String | No | No |
| appDisplayName | The display name of the app registration. This value comes from Microsoft Graph application.displayName. | String | No | No |
| audiences | A JSON array of audiences, stored as a string. A typical value is `api://AzureADTokenExchange`. | String | No | No |
| credentialId | The ID of the Microsoft Graph federatedIdentityCredential. | String | No | No |
| credentialType | The Certificates &amp; secrets tab name in the Microsoft Entra admin center. Always set to `Federated credentials`. | String | No | No |
| extendedPermissions | A JSON object of extended permissions from the parent application, stored as a string. | String | No | No |
| issuer | The issuer of the Microsoft Graph federatedIdentityCredential. | String | No | No |
| name | The list display name, in the form `{appDisplayName}:{FIC name}`. FIC is the federated identity credential. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| permissions | The parent application's requiredResourceAccess, stored as a string. This value is copied from the parent application and is not stored on the federated identity credential. | String | No | No |
| sailpointId | The native ID, in the form `{application.appId}:{federatedIdentityCredential.id}`. | String | No | No |
| spDescription | The description of the Microsoft Graph federatedIdentityCredential. | String | No | No |
| subject | The subject of the Microsoft Graph federatedIdentityCredential. This value is an OpenID Connect (OIDC) subject or a managed identity object ID. | String | No | No |
| tags | A JSON array of Microsoft Graph application tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |

### Microsoft Entra SAML Token Signing Certificate

| Field | Value |
| --- | --- |
| Resource ID | `azure:saml-cert` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra SAML Token Signing Certificate resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| LastRotated | The last rotation time. This value matches startDateTime. | String | No | No |
| NHIType | The non-human identity type. Always set to `AZURE_SAML_CERTIFICATE`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Single sign-on blade URL. | String | No | No |
| appDisplayName | The display name of the enterprise application. | String | No | No |
| certificateThumbprint | The certificate thumbprint. This value comes from Microsoft Graph customKeyIdentifier. | String | No | No |
| creationDate | The certificate start time (startDateTime). | String | No | No |
| credentialId | The Sign keyId from Microsoft Graph. | String | No | No |
| credentialType | The portal credential kind. Always set to `Saml Certificate`. | String | No | No |
| daysSinceLastUse | The number of full days since last use. This attribute is omitted because lastUsed is empty for SAML certificates. | Integer | No | No |
| daysUntilExpiry | The number of full days from aggregation to endDateTime. This attribute is omitted when the certificate is expired. | Integer | No | No |
| expirationDate | The certificate end time (endDateTime). | String | No | No |
| lifetimeDays | The number of full days from startDateTime to endDateTime. This attribute is omitted when the certificate is expired. | Integer | No | No |
| name | The list display name, in the form `{appDisplayName}:{credentialId}`. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| riskFlags | A JSON array of SailPoint policy flags based on Microsoft Graph dates and isAdmin, stored as a string. The array includes `EXPIRED` when the current time is past endDateTime. These flags are not Microsoft risk indicators. | String | No | No |
| sailpointId | The native ID, in the form `{SP object id}:{Sign keyId}`. | String | No | No |
| spDescription | The display name of the Microsoft Graph keyCredential. | String | No | No |
| tags | A JSON array of Microsoft Graph service principal tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |
| tokenAgeDays | The number of full days from startDateTime to aggregation. This attribute is omitted when the certificate is expired. | Integer | No | No |
| usage | The certificate key usage. Set to `Sign` or `Verify`. | String | No | No |

# Frequently Asked Questions

This Frequently Asked Questions (FAQs) section provides answers to the most commonly asked questions about the Microsoft Entra ID SaaS connector in SailPoint.

## What are the key factors to consider when deciding between Full Aggregation and Delta Aggregation in SailPoint?

**Answer**: Full Aggregation retrieves all records from the source and evaluates them for changes. This approach is efficient for bulk data loads, as it fetches all users in large pages, with each response containing complete user details.

Delta Aggregation is an aggregation method that only loads data that has changed, been added, or been removed from the source. It uses a delta token to fetch only the modified users and then retrieves their details in small batches (for example, 15 at a time). However, not all connectors support Delta Aggregation.

Consider the following performance factors:

- If both methods take a similar amount of time (approximately 4 hours for 4,000-6,000 users), Full Aggregation is preferable, as it ensures all records are evaluated for changes.
- If only a small subset of users has changed (for example, around 1,000 users, taking about 30 minutes), and the source supports Delta Aggregation, this method is more efficient, as it only processes the modified data.

Use Full Aggregation for large changes or when the connector does not support Delta Aggregation. Use Delta Aggregation for fewer changes and when the connector supports it, as it can significantly reduce the processing time and API calls required.

# Feature Management

This section describes the various features that you can enable or disable for your configuration. Feature management enables you to select or deselect features on demand as your need for their services arises.

## Manage Microsoft 365 Groups

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/ms365.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/ms365.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft 365 Groups** if you want to enable the option to manage Office 365 Groups.

   > **Important**
   >
   > If you are utilizing Data Access Services (DAS) to manage access to cloud applications like Microsoft 365, you must enable the **Manage Microsoft 365 Groups**. This ensures that DAS can properly synchronize and manage Microsoft 365 groups, which control access to various collaborative resources within the Microsoft 365 ecosystem.
3. Select **Save**.

## Managed Identities Settings

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/manage_identities.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/manage_identities.png>)

1. Go to **Feature Management \> Managed Identities Settings**.
2. Enable the setting that corresponds to the identity type you want to manage:

   - For User-Assigned Managed Identities: Enable **Manage User-Assigned Managed Identities as Accounts**.
   - For System-Assigned Managed Identities: Enable **Manage System-Assigned Managed Identities as Accounts**.
   - For Microsoft Entra Service Principals: Go to **Feature Management \> Manage Microsoft Entra Service Principals as Accounts**. Enable **Manage Microsoft Entra Service Principals as Accounts**.

   Select **Aggregate Custom Security Attribute** checkbox to aggregate custom attributes for respective identities. For more information, refer to [Custom Security Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#custom-security-attributes>).

## Manage Microsoft Entra Service Principals As Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/service_principal_as_account.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/service_principal_as_account.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list.

   > **Note**
   >
   > To automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing azure Service Principal as account . For more information, refer to [Service Principal as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>).
3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'`

   > **Note**
   >
   > Advanced queries are not supported.

   Example filters:

   - For a filter to match the Enterprise Application default view on the Azure portal use the following:

     `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')`
4. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal.
5. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal.
6. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra Group memberships for Service Principal.
7. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals.
8. Select the **Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals.

   > **Note**
   >
   > This is for delegated permissions.
9. Select the **Aggregate Custom Security Attribute** checkbox to aggregate custom security attributes for Service Principals. For more information, refer to [Custom Security Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#custom-security-attributes>).
10. Select **Save**.

## Manage Exchange Online

1. Go to **Feature Management**.
2. Select **Manage Exchange Online** to enable aggregation of Exchange mailbox attributes. This includes Shared Mailboxes, User Mailbox properties, Distribution Lists, and Mail-Enabled Security Groups.
3. Select one of the following from the **Authentication Method** dropdown list:

   - **Basic Authentication**

     > **Screenshot**
     >
     > [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/managebasic.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/managebasic.png>)

     1. Select **Basic Authentication** from the dropdown list.
     2. Enter the **Username** (UserPricipalName) and associated Password of a user that has the Exchange Administrator role.
     3. Select **Save**.

     Certificate Based Authentication

     > **Screenshot**
     >
     > [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/managecert.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/managecert.png>)

     1. Select **Certificate Based Authentication** from the drop dropdown list.
     2. In Exchange Certificate, provide the unique alpha-numeric value of the certificate used to sign the JWT assertion. The same certificate must also be uploaded to the respective Microsoft Entra application.
     3. Enter the **Exchange Private Key Password** that is used for decrypting the private key.
     4. Select **Save**.
4. Select **Mail Contact Governance** to manage mail contacts as accounts. For more information, refer to [Azure Mail Contact Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#azure-mail-contact-management>).
5. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')`

## Manage Azure Privileged Identity Management

Privileged Identity Management (PIM) enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

For more information, refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-privileged-identity-management-pim>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/az_ad_feat4_new.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/az_ad_feat4_new.png>)

1. Go to **Feature Management**.
2. Select the **Enable Privileged Identity Management** checkbox to define the scope of the Microsoft Entra PIM roles (Microsoft Entra as well as Azure). For more information on privileged identity management, refer to the [Microsoft documentation](<https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure>).
3. In the **Microsoft Entra PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Microsoft Entra PIM roles aggregated during entitlement aggregation. For example, `isBuiltIn eq true`

   For more information on filtering conditions and values, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/graph/api/rbacapplication-list-roledefinitions?view=graph-rest-1.0&amp;tabs=http#optional-query-parameters>).
4. In the **Azure PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Azure PIM roles aggregated during entitlement aggregation. For example, `type eq 'CustomRole'`

   For more information on filtering conditions and values, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions-list#rest-api>).
5. In the **Microsoft Entra PIM Active and Eligible Groups Filter** field, enter a filter to define the scope of the Azure PIM groups aggregated during entitlement aggregation. For example, `securityEnabled eq true`

   > **Important**
   >
   > User-defined filter expressions in this field cannot be combined with the connector's internal group type filter, which restricts groups to Office 365 and Security types. The internal filter is always applied. Any value you enter in this field functions as an additional standalone filter on the PIM group catalog and does not combine with the internal filter.

   For more information on filtering conditions and values, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0&amp;tabs=http#filter-by-group-types>).
6. Select **Save**.

## Access Package Management Settings

An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization. For more information, refer to [Access Package Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#access-package-management>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/access_package_management.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/access_package_management.png>)

1. Go to Feature Management.
2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off.
3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal.
4. Select **Save**.

## Administrative Unit Management Settings

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/admin_units.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/admin_units.png>)

1. Go to **Feature Management**.
2. Select **Manage Administrative Units** to manage administrative units.
3. Select **Save**.

## Account Disable Settings

To configure Account Disable Settings:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/revoke_sessions.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/revoke_sessions.png>)

1. Go to **Feature Management**.
2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled.
3. Select **Save**.

> [!NOTE]
>
> - For newly created sources, this is enabled by default to align with security best practices.
> - For existing sources, this is disabled by default. When required, ensure to enable this option.

For more information about this feature, including the required permissions, refer to [Revoke Session After Disabling User Account](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#revoke-session-after-disabling-user-account>).

# Integrating SailPoint with Microsoft Entra ID SaaS

The SailPoint Microsoft Entra ID SaaS connector manages the users and groups in Microsoft Entra. Microsoft Entra is the directory for all cloud based organizational Microsoft Directory services including Microsoft Office 365.

The SailPoint Microsoft Entra ID SaaS connector:

- Can also be used to aggregate users into a federated domain in Microsoft Entra.
- Uses Microsoft Graph APIs to manage users and groups.

Azure is Microsoft’s cloud solution platform, which provides plenty of cloud services such as IaaS, PaaS, or SaaS. Azure uses Microsoft Entra as its authentication source to provide access on different services to users. Azure has management container objects which are used to group resources and manage access to them.

The Microsoft Entra ID SaaS connector provides support for access management of Azure Management Objects along with managing of the Microsoft Entra Management Objects.

Microsoft Entra ID SaaS connector supports deleting accounts.

## Onboard Microsoft Entra with SailPoint Agentic Fabric (SAF)

SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your Microsoft Entra environment to SailPoint. SAF automatically creates, deploys, and configures the Microsoft Entra ID SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance.

For detailed onboarding instructions, prerequisites, and supported deployment models, refer to [Configuring the Microsoft Entra ID SaaS Connector](<https://documentation.sailpoint.com/saas/help/agentic_fabric/onboarding/sources.html#configuring-the-microsoft-entra-saas-connector>).

> [!IMPORTANT]
>
> To enable advanced governance capabilities for Microsoft Entra ID SaaS resources and AI agents, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

Refer to [Supported Features](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/index.html>) for the features the connector supports.

## Prerequisites

Refer to [Prerequisites and Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html>).

# Machine Account Attributes

Machine account attributes are used in provisioning configurations for machine accounts.

After you have [created the required machine account subtypes](<https://documentation.sailpoint.com/saas/help/machine/account_configuration.html#creating-machine-account-subtypes>), you can use the machine account attributes to provision machine accounts in your SailPoint tenant.

Refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>) for more information.

> [!NOTE]
>
> Attributes marked with an asterisk (\*) are mandatory.

## Machine Account Provisioning Attributes

Machine account creation uses the same source attributes as standard service principal provisioning. For the complete list of supported attributes and their descriptions, refer to [Account Profile for Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/azure_policies.html#account-profile-for-service-principal>).

| Create Machine Account Attribute | Description |
| --- | --- |
| spn\_appDisplayName\* | Display name for the Microsoft Entra ID application. Used to create the associated service principal (machine account). |
| spn\_appId | Existing application (client) ID to associate with service principal creation/update flows. |
| spn\_appTemplateId | Microsoft Entra ID application template ID used for template-based app creation. |
| spn\_appTemplateName | Human-readable name of the application template. |
| spn\_homepage | Homepage URL for the application object. |
| spn\_loginUrl | Login URL configured on the application/service principal. |
| spn\_logoutUrl | Logout URL configured on the application/service principal. |
| description | Description text for the application/service principal object. |
| spn\_tags | Tags to set on the service principal. Multi-valued attribute. |
| spn\_owners | Object IDs / references of owners assigned to the service principal/application. Multi-valued attribute. |
| spn\_app\_keyCredentials | Key credential definitions (certificate-based credentials) for the application object. Multi-valued attribute. |
| spn\_passwordCredentials | Password credential definitions (client secrets) for the service principal. Multi-valued attribute. |
| spn\_app\_passwordCredentials | Password credential definitions (client secrets) for the application object. Multi-valued attribute. |
| spn\_appRoles | The roles exposed by the application that this service principal represents. |
| appRoleAssignments | Lists the associated application roles for the account. Multi-valued attribute. |

# Prerequisites and Permissions

## Prerequisites

### Azure Management

- Ensure that a client application has been registered on your Azure Management portal as a web application or web API, and you have access to the Client ID and Client Secret for this application.
- For cloud management prerequisites and requirements, refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>).
- To use Graph API, a client application must be registered on the Azure management portal. This application is responsible for calling Web APIs on behalf of the connector. The application's client ID and client secret key are required while configuring the application.

  To register an application on Azure, perform the following:

  1. Use either of these Azure management portals to do the configuration: [https://portal.azure.com](<https://portal.azure.com>) Or [https://aad.portal.azure.com](<https://aad.portal.azure.com>)
  2. Select **Microsoft Entra ID** in the left pane.
  3. Select **App registrations**.
  4. Select **New registration**.
  5. On the **Register an application** page, in the **Name** field, enter the name of the application that you want to set up. For example, SailPointAzureADManagement.
  6. In the Supported account types, set up accounts based on users that are able to use that application or the API.
  7. (*Optional*) Set up the URL in Redirect URL, to have the successful response after authentication. You can use the following format: **http://*domainName*/GraphWebapp**

     > **Note**
     >
     > The Microsoft Entra ID SaaS connector does not use the URL mentioned above, the above example is just a placeholder and does not impact functionality.
  8. Select **Register**. An application is created. On the Application page the **Application (client) ID**, and other details are displayed. Note down this ID.
  9. On the left-hand panel, select **Certificates &amp; secrets**. On the Certificates &amp; secrets page, in the **Client secrets** section, select **New client secret**.
  10. On the **Add a client secret** page, enter the **Description** to generate a secret, choose the validity duration in the **Expires** list. Select **Add**. Note down the value of the secret that you have just created.

### Microsoft Entra

The required host values (`https://<host>/`) by the Microsoft Entra ID SaaS connector to interact with the managed system are as follows:

- [https://graph.microsoft.com](<https://graph.microsoft.com>)
- [https://login.microsoftonline.com](<https://login.microsoftonline.com>)

  > **Note**
  >
  > If you are using this option, refer to the [Azure Government Endpoint Configuration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-government-endpoint-configuration>) topic for configuration details.

### Creating OAuth 2.0 JWT Certificate Credentials

> [!NOTE]
>
> SailPoint recommends JWT certificate credentials for OAuth 2.0 authentication.

Use the following steps to create JWT certificate credentials for OAuth 2.0 authentication. For more information, refer to [OAuth 2.0 Authentication](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#oauth-20-authentication>).

#### Registering an Application and Assigning API Permissions

1. Register an application in Azure portal. For more information, refer to [register an application](<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app>) in the Microsoft documentation.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.
2. After you register the app, copy the Application (client) ID, and then generate a client secret.
3. Assign API permissions to the application. For the permissions this connector requires, refer to [Required Permissions](<#required-permissions>). For more information about assigning permissions, refer to [API permissions](<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis>) in the Microsoft documentation.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.

If you have already registered the application and assigned API permissions, continue with [Creating and Using the Certificate](<#creating-oauth-20-jwt-certificate-credentials>).

#### Creating and Using the Certificate

1. Run PowerShell as an administrator on a Windows computer, and then generate a self-signed certificate with the following command:

   `New-SelfSignedCertificate -DnsName "EntraID" -CertStoreLocation "cert:\LocalMachine\My"`
2. Go to **certlm.msc \> Personal \> Certificates**, right-click the certificate, and select **Export**. Complete the Certificate Export Wizard and export the certificate in PFX format.
3. Select **Include all certificates in the certification path if possible** and Enable certificate privacy.
4. Enter a password to protect the private key, and use AES-256-SHA256 encryption. You need this password when you use the PFX file.
5. Save the PFX file to a directory of your choice. Download [OpenSSL](<https://sourceforge.net/projects/openssl/>), or use Git Bash.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.

   Copy the PFX file into the directory where the command prompt or terminal is open as an administrator. Run the following commands one at a time, and press Enter after each command. The file names are examples. You can use other file names if you use the same names in each command.

   1. `openssl pkcs12 -in test1.pfx -nocerts -out sp.key`
   2. `openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt`
   3. `openssl rsa -in sp.key -out rsasp.key`
6. Upload the `sp.crt` file to the Microsoft Entra app registration:

   1. Sign in to the Azure portal.
   2. In App registrations, select the client application.
   3. Select **Certificates &amp; secrets**.
   4. Select **Upload certificate**, select the certificate file, and then select **Add**.
7. On the Connection Settings page, enter the text of `rsasp.key` in Private Key and the text of `sp.crt` in Certificate. For more information, refer to [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#connection-settings>).

   Private Key Password is the passphrase you entered when you created `sp.key`.

## Required Permissions

> [!NOTE]
>
> This list of permissions includes the most commonly used features from the connector, however there may be custom permissions and roles required for certain specific features. Ensure to read the details for each feature in the [Supported Features](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/index.html#supported-features>) section.

If you don’t want to provide granular permissions on each API, provide the following permissions on the entire directory to the client application created in Azure, which will enable the connector to perform read and write operations on users and groups (excluding deleting users and groups) :

- Directory.Read.All (Read Directory Data)
- Directory.ReadWrite.All (Read and Write Directory Data)

> [!IMPORTANT]
>
> To grant read-only access, assign the built-in Reader role to the service principal or the application you created at the tenant root group level.

### Assigning the Built-in Reader Role to the Application

To grant the built-in reader role to the application, follow these steps in the Microsoft Entra ID portal:

1. Go to **Management groups**.
2. Select the **Tenant Root Group** and open its **Access control (IAM)** settings.
3. Select **Add**, then choose **Add role assignment** from the dropdown menu.
4. Select the **Reader**(built-in) role from the list.
5. Go to the **Members** tab and select **Select members**.
6. Search for the application you created earlier and select it.
7. Select the **Review and assign** to finalize the role assignment.

### Assigning Necessary Permissions to the Client Application

To grant the necessary permissions to the client application, follow these steps:

1. In the Microsoft Entra console, go to **API permissions** and select **Add a permission**.
2. On the **Request API permissions** page, select **Microsoft Graph API** from the list of APIs.
3. For the permission type, select **Application permissions**.
4. Under **Select permissions**, choose the permissions listed in the table below, and then select **Add permissions**.
5. Go to the **Grant consent** section and select **Grant admin consent** for your directory.
6. When the confirmation dialog appears, select **Yes**.

### Granular Level Application Permission

- To perform Set Password and Delete user operations, an application created on Azure must have the User Administrator role.
- To manage users with administrative roles or users who are members/owners of role-assignable groups, an application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role.
- Use the Azure portal to assign the previously mentioned administrative roles. For more information, refer to [Assign Microsoft Entra Roles to Users](<https://learn.microsoft.com/en-us/azure/active-directory/roles/manage-roles-portal>).

### Additional API Permissions for CIEM

The following API permissions are necessary for SailPoint CIEM to include potential Azure cloud resource access derived from eligible membership in PIM groups:

- PrivilegedAccess.Read.AzureADGroup
- PrivilegedAssignmentSchedule.Read.AzureADGroup
- PrivilegedEligibilitySchedule.Read.AzureADGroup

The following table lists the required permission types and their purposes:

<table class="span-table"> <tr> <td>Permission</td> <td>Type</td> <td>Purpose</td> </tr> <tr> <td>User.Invite.All</td> <td colspan="1" rowspan="13">Application</td> <td>Creating / Inviting B2B User</td> </tr> <tr> <td>User.Read.All</td> <td>Account Aggregation, Account Delta, Get Object, Roles and Groups Membership Aggregation</td> </tr> <tr> <td>User.ReadWrite.All</td> <td>Create User, Update User Properties (Non Entitlement), Add / Remove License Pack and Plan, Enable/ Disable User Account, Delete User</td> </tr> <tr> <td>Organization.Read.All</td> <td>Aggregate License Pack and Plan Details of tenant</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Add / Remove Directory Roles</td> </tr> <tr> <td>User.Read</td> <td>Pass-through Authentication</td> </tr> <tr> <td>Group.Read.All</td> <td>Group Aggregation</td> </tr> <tr> <td>Group.ReadWrite.All</td> <td>Create Group, Update Group, Delete Group</td> </tr> <tr> <td>Application.Read.All</td> <td>Aggregation of Application Roles</td> </tr> <tr> <td>AppRoleAssignment.ReadWrite.All</td> <td>Add / Remove users from Service Principal</td> </tr> <tr> <td>DelegatedPermissionGrant.Read.All</td> <td>Aggregation of Admin/User Consented Permissions for Service Principals</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Role provisioning (if defined as Entitlement object)</td> </tr> <tr> <td>RoleManagement.Read.Directory</td> <td>Role Aggregation (if defined as Entitlement object)</td> </tr> </table>

The following permission applies to SAML Bearer Assertion, Refresh Token / AuthCode, and JWT Certificate Credentials grant types:

| Permission | Type | Purpose |
| --- | --- | --- |
| Directory.AccessAsUser.All | Delegated | Change Password, Delete User |

The following permissions apply to Access Packages management:

| Permission | Type | Purpose |
| --- | --- | --- |
| EntitlementManagement.ReadWrite.All | Application | Add / Remove Access Packages |
| EntitlementManagement.Read.All | Application | Access Package Aggregation |

The following permissions apply to User management:

| Permission | Type | Purpose |
| --- | --- | --- |
| User.EnableDisableAccount.All | Application | Delete User |
| User-PasswordProfile.ReadWrite.All | Application | Set Password |

### Additional Permissions for SailPoint Non-Human Identity (NHI) Discovery

The following permissions are required when you enable SailPoint NHI Discovery features on the Microsoft Entra ID SaaS connector. Grant only the permissions that correspond to the features you plan to use. For supported features, refer to [Supported Features](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/index.html#supported-features>).

The following table lists additional Microsoft Graph application permissions:

<table class="span-table"> <tr> <td>Applicable For</td> <td>Permission</td> <td>Type</td> <td>Purpose</td> </tr> <tr> <td>Azure cloud and NHI analysis</td> <td>AuditLog.Read.All</td> <td colspan="1" rowspan="24">Application</td> <td>Access Microsoft Entra ID audit logs for activity tracking and correlation between secrets and related identity activity.</td> </tr> <tr> <td>Azure cloud and NHI analysis</td> <td>Device.Read.All</td> <td>Azure cloud and NHI analysis.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>Channel.ReadBasic.All</td> <td>Enumerate channels and basic channel metadata.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>ChannelMember.Read.All</td> <td>Read channel membership for access correlation.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>ChannelMessage.Read.All</td> <td>Read channel messages for secrets scanning.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>ChannelSettings.Read.All</td> <td>Read channel settings and moderation configuration.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>Chat.Read.All</td> <td>Read chat messages and metadata for secrets scanning.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>TeamsActivity.Read.All</td> <td>Read Teams activity metadata for discovery and correlation.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>TeamsAppInstallation.ReadForChat.All</td> <td>Read app installations in chats.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>TeamsAppInstallation.ReadForTeam.All</td> <td>Read app installations in teams.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>TeamsAppInstallation.ReadForUser.All</td> <td>Read app installations for users.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>TeamsTab.Read.All</td> <td>Read installed Teams tabs and related configuration.</td> </tr> <tr> <td>Microsoft Teams secret scanning</td> <td>TeamSettings.Read.All</td> <td>Read team settings and configuration metadata.</td> </tr> <tr> <td>Microsoft Teams messaging</td> <td>TeamsAppInstallation.ReadWriteForTeam.All</td> <td>Install and manage a Teams app in teams to deliver risk notifications.</td> </tr> <tr> <td>Microsoft Teams messaging</td> <td>TeamsAppInstallation.ReadWriteForUser.All</td> <td>Install and manage a Teams app for users who receive risk notifications.</td> </tr> <tr> <td>Microsoft Teams messaging</td> <td>TeamsAppInstallation.ReadWriteSelfForUser.All</td> <td>Allow the Teams app to manage its own user-level installation state.</td> </tr> <tr> <td>SharePoint and OneDrive secret scanning</td> <td>Files.Read.All</td> <td>Read file metadata and document structure across SharePoint and OneDrive.</td> </tr> <tr> <td>SharePoint and OneDrive secret scanning</td> <td>Sites.Read.All</td> <td>Read SharePoint site collections and site metadata.</td> </tr> <tr> <td>Copilot and AI agent discovery</td> <td>AiEnterpriseInteraction.Read.All</td> <td>Read Microsoft Copilot enterprise AI interaction metadata.</td> </tr> <tr> <td>Copilot and AI agent discovery</td> <td>Reports.Read.All</td> <td>Access usage and activity reports for discovery and analysis.</td> </tr> <tr> <td>Copilot and AI agent discovery</td> <td>ExternalConnection.Read.All</td> <td>Read external connection metadata used by Copilot.</td> </tr> <tr> <td>Copilot and AI agent discovery</td> <td>AppCatalog.Read.All</td> <td>Enumerate app catalog entries and related application metadata.</td> </tr> <tr> <td>Microsoft Defender - WindowsDefenderATP API, not Microsoft Graph</td> <td>Machine.Read.All</td> <td>Read device inventory and related machine metadata.</td> </tr> <tr> <td>Microsoft Defender - WindowsDefenderATP API, not Microsoft Graph</td> <td>ThreatHunting.Read.All</td> <td>Query advanced hunting data for AI agent discovery visibility.</td> </tr> </table>

#### Using the Microsoft Teams Permissions with SailPoint Entro

If you use the same Microsoft Entra app registration with SailPoint Entro for Microsoft Teams message scanning, grant admin consent for the Microsoft Teams secret scanning application permissions listed in the preceding table. These permissions are optional for the Microsoft Entra connector on its own, and are required only when Entro scans Teams content with the shared app registration. For Entro setup, refer to [Microsoft Teams Onboarding](<https://documentation.sailpoint.com/entro/help/integrations/collaboration-saas/microsoft-teams-onboarding.html>) and [Microsoft Teams Permissions Reference](<https://documentation.sailpoint.com/entro/help/integrations/collaboration-saas/microsoft-teams-permissions-reference.html>).

# Provisioning

The Microsoft Entra ID SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft Entra ID directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

| Account Attribute | Generator | Description |
| --- | --- | --- |
| userPrincipalName\* | Create Unique Account ID | User principal name (UPN) of the user. This generator uses the value in the Pattern Used field to generate a unique user name for the new account.<br>For example, `jeff@contoso.onmicrosoft.com`<br>Note<br>You must edit your domain in the Pattern Used field to match your domain. |
| password\* | Create Password | Password for the new account. |
| displayName\* | Identity Attribute | Display name of the account. |
| mailNickname\* | Create Unique Account ID | Mail alias for the account. |
| accountEnabled | Static | Set it to false to create disabled account. Default: True |
| forceChangePasswordNextSignIn | Static | If true, asks user to change password on next sign in. Default: True |
| department | Disable | Department in which the user works. |
| jobTitle | Disable | User's job title. |
| passwordPolicies | Disable | Specifies password policies for the user.<br>For example: DisablePasswordExpiration, DisableStrongPassword |
| otherMails | Disable | Additional email addresses for the user. |
| givenName | Identity Attribute | First name of the user. |
| surname | Identity Attribute | Surname of the user. |
| usageLocation | Static | A two letter country code (ISO standard 3166). Required for users that will be assigned licenses. |
| country | Disable | Country/region in which the user is located. For example, US or UK |
| state | Disable | State or province in the user's address. |
| city | Disable | City in which the user is located. |
| streetAddress | Disable | Street address of the user's place of business. |
| postalCode | Disable | Postal code for the user's postal address. |
| physicalDeliveryOfficeName | Disable | Office location in the user's place of business. |
| telephoneNumber | Disable | Primary telephone number of the user's place of business. |
| mobile | Disable | Primary cellular telephone number for the user. |
| facsimileTelephoneNumber | Disable | Telephone number of the user's business fax machine. |
| userType | Disable | A string value that can be used to classify user types in your directory. |
| isFederatedDomain | Static | Set it true to create federated domain user. If this is checked and **immutableId** is not set then random **immutableId** value will be used. |
| preferredLanguage | Disable | Preferred language for the user. Should follow ISO 639-1 Code.<br>For example, `en-US` |

### Guest User (B2B) Support

The Microsoft Entra ID SaaS connector supports creation of Guest User (B2B) by sending invitations. Creation of Guest User (B2B) varies from normal user creation in terms of attributes provided during creation.

#### Create Guest User (B2B) Account Policy

| Attribute Name | Description |
| --- | --- |
| accountType\* | Default is User<br>To create Guest User (B2B), set this value to Guest User B2B. |
| invitedUserEmailAddress\* | Email address of the user. |
| inviteRedirectUrl\* | The URL that the user will be redirected to after redemption. |
| sendInvitationMessage\* | Set it to False if invitation email need not to be sent to the user. Default is True |
| customizedMessageBody | Customized message text that can be added in the invitation email for the B2B Guest User. |
| invitedUserDisplayName | The display name of the user being invited. |
| invitedUserUsageLocation | A two letter country code indicating usage location (ISO standard 3166). |

### External Member (B2B) Support

The Microsoft Entra ID SaaS connector supports the creation of External Member (B2B) users by sending invitations. This process is similar to creating a Guest (B2B) user, but the `userType` is configured as Member instead of Guest.

#### Create External Member (B2B) Account Policy

| Attribute Name | Description |
| --- | --- |
| accountType\* | Default is User.<br>To create External Member (B2B), set this value to External Member B2B. |
| invitedUserEmailAddress\* | Email address of the user. |
| inviteRedirectUrl\* | The URL that the user will be redirected to after redemption. |
| sendInvitationMessage\* | Default is True.<br>Set it to False if the invitation email should not be sent to the user. |
| customizedMessageBody | Customized message text that can be added in the invitation email for the External Member user. |
| invitedUserDisplayName | The display name of the user being invited. |
| invitedUserUsageLocation | A two-letter country code indicating usage location (ISO standard 3166). |

### Local User (B2C) Support

The Microsoft Entra ID SaaS connector supports creation of Local Users. Creation of Local User account varies from normal user in terms of attributes provided during creation. Account creation also supports custom attribute.

#### Create Local User (B2C) Account Policy

| Attribute Name | Description |
| --- | --- |
| accountType\* | Default is User<br>To create Local User (B2C), set this value to Local User B2C. |
| signInNameType\* | Sign-in type for user in your Azure directory. |
| signInNameValue\* | Sign-in name for user. |
| localAccountDisplayName\* | Display name of account. |
| b2cPassword\* | Password for the new account. |
| enableLocalAccount | Set it to false to create disabled account. Default: True |
| b2cForceChangePasswordNextLogin | If true, asks user to change password on next login. Default: True |

## Multi-Factor Authentication (MFA) Provisioning Policy Attributes

To provision MFA attributes for users, add the same attributes in the provisioning policy that are present in the account schema (for more information, refer to [Multi-Factor Authentication (MFA) Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/index.html#multi-factor-authentication-mfa-attributes>)) with the Review Required flag checked.

> [!NOTE]
>
> When using the phone authentication method, the values for the following attributes are expected to be provided with the country code as a prefix: `mfa_phoneNumber_mobile`, `mfa_phoneNumber_alternateMobile`, and `mfa_phoneNumber_office`. If the country code is not provided provisioning operations will result in failure. The value for these attributes should follow this format (there must be a space between the country code and the phone number):`<country code> <phone number>`
>
> Examples:
>
> - `<AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>`
> - `<AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>`
> - `<AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>`

> [!NOTE]
>
> Once you enable MFA for any user there will be one default authentication method set. This is usually the first method configured, but you can modify it later from the Azure portal. If you are trying to remove values for an attribute that belongs to the default authentication method, the Azure APIs will throw an error as the APIs do not expect to remove values for attributes that belong to the default authentication method. For example, if email is the default authentication method configured for an Azure user, the connector will not be able to remove the value for the `mfa_emailAddress` attribute.

<table> <thead> <tr> <th>Authentication Method</th> <th>Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Phone</td> <td>mfa_phoneNumber_mobile</td> <td>String</td> <td>Mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_alternateMobile</td> <td>String</td> <td>Alternate mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_office</td> <td>String</td> <td>Office phone number assigned to the user.</td> </tr> <tr> <td>Email</td> <td>mfa_emailAddress</td> <td>String</td> <td>Email address assigned to the user.</td> </tr> <tr> <td>Microsoft Authentication</td> <td>mfa_microsoftAuthenticatorAuthenticationMethod</td> <td>String: Multivalued</td> <td>Microsoft Authentication method assigned to the user.</td> </tr> <tr> <td>Other</td> <td>mfa_methodName<br>Where methodName is the authentication method name.<br>For example:<br><ul><li>mfa_fido2AuthenticaitonMethod</li><li>mfa_temporaryAccessPassAuthenticationMethod</li><li>mfa_softwareOauthAuthenticationMethod</li><li>mfa_windowsHelloForBusinessAuthenticationMethod</li></ul></td> <td>String: Multivalued</td> <td>Other authentication method assigned to the user.</td> </tr> </tbody> </table>

For the `mfa_methodName` attribute, the connector only supports removing or clearing the MFA related information. For more information, refer to the second sample update request.

### Sample Provisioning Request

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="displayName" op="Add" value=“Abcde”/>
        <AttributeRequest name="mailNickname" op="Add" value="Abcde"/>
        <AttributeRequest name="password" op="Add" value="Abcde"/>
        <AttributeRequest name="userPrincipalName" op="Add" value="Abcde@gmail.com”/>
        <AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>
        <AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>
        <AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>
        <AttributeRequest name="mfa_emailAddress" op="Add" value=“Abcde@gmail.com"/>
    </AccountRequest>
</ProvisioningPlan>
```

### Sample Update Account Requests

#### Example 1

```text
<ProvisioningPlan>
    <AccountRequest nativeIdentity="8cb133a4-0cea-XXXX-8c02-XXXXXXXX" op="Modify">
        <AttributeRequest name="mfa_phoneNumber_alternateMobile" op=“Add” value="+1 2065555562"/>
        <AttributeRequest name="mfa_phoneNumber_office" op=“Set” value="+1 2065555563"/>
        <AttributeRequest name="mfa_emailAddress" op="Remove" value="Abcde@gmail.com"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

```text
<ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="8cb133a4-0cea-XXXX-8c02-XXXXXXXX">
        <AttributeRequest name="mfa_microsoftAuthenticatorAuthenticationMethod" op="Remove">
            <Value>
                <List>
                    <String>{"@odata.type":"#microsoft.graph.microsoftAuthenticatorAuthenticationMethod","id":"8cb133a4-0cea-XXXX-8c02-XXXXXXXX","displayName”:”iPhone”,”deviceTag":"SoftwareTokenActivated","phoneAppVersion”:”6.7.X”}</String>
                </List>
            </Value>
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```

## Provisioning B2C userIdentities and signInNames

You can use the Update and Modify operations like Add, Set, and Remove of `identities` for a social and local user account in an Azure Active Directory B2C tenant.

If you want to leverage this functionality, add the following attribute in the provisioning policy with type as string and multi as true (with the value in JSON format):

- `identities`

### Sample Provisioning Request

1. For Local B2C user :

   ```text
   <?xml version='1.0' encoding='UTF-8'?>
    <!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">
     <ProvisioningPlan>
      <AccountRequest op="Add">
       <AttributeRequest name="identities" op='Add'>
         <Value>
          <List>
         <String>{"signInType":"userName", "issuer": "SPTechQA.onmicrosoft.com", "value":"User1"}</String>
       </List>
      </Value>
     </AttributeRequest>
    </AccountRequest>
   </ProvisioningPlan>
   ```
2. For Social B2C user:

   ```text
   <?xml version='1.0' encoding='UTF-8'?>
    <!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">
     <ProvisioningPlan>
      <AccountRequest op="Add">
       <AttributeRequest name="identities" op='Add'>
        <Value>
         <List>
        <String>{"signInType":"federated", "issuer": "gmail.com", "value":"User2"}</String>
       </List>
      </Value>
     </AttributeRequest>
    </AccountRequest>
   </ProvisioningPlan>
   ```

## Create/Modify/Delete Mail Contact Profile Attributes

The followings lists the create mail contact profile attributes:

> [!NOTE]
>
> Attributes marked with an asterisk (\*) are mandatory.

| Attribute Name | Description |
| --- | --- |
| displayName\* | Display name of the mail contact. |
| mailContact\_mail\* | External email address of the mail contact. |
| mailContact\_mailNickname | Mail nickname of the mail contact. |
| mailContact\_givenName | First name of the mail contact. |
| mailContact\_surname | Last name of the mail contact. |

### Sample Provisioning Request for Creating Mail Contact

```text
<ProvisioningPlan>
  <AccountRequest op="Create">
    <AttributeRequest name="displayName" op="Set" value="DummyContact"/>
    <AttributeRequest name="mailContact_mail" op="Set" value="DummyContact@gmail.com"/>
    <AttributeRequest name="mailContact_mailNickname" op="Set" value="DummyContact"/>
    <AttributeRequest name="mailContact_givenName" op="Set" value="DummyContact-FirstName"/>
    <AttributeRequest name="mailContact_surname" op="Set" value="DummyContact-LastName"/>
</ProvisioningPlan>
```

### Sample Provisioning Request for Modifying Mail Contact

```text
<ProvisioningPlan nativeIdentity="DummyContact">
  <AccountRequest nativeIdentity="microsoft.mailContact:615a0c76-b18f-476c-b448-83610a600973" op="Modify">
    <AttributeRequest  displayValue="DummyGroupName" name="groups" op="Add" value="0a9bd1d7-a993-49b8-ab01-0e4f709ef42b">
      <Attributes>
        <Map>
          <entry key="assignment" value="true"/>
        </Map>
      </Attributes>
    </AttributeRequest>
    <AttributeRequest name="mailContact_city" op="Add" value="Delhi" />
  </AccountRequest>
</ProvisioningPlan>
```

### Sample Provisioning Request for Deleting Mail Contact

```text
<ProvisioningPlan nativeIdentity="DummyContact">
  <AccountRequest nativeIdentity="microsoft.mailContact:615a0c76-b18f-476c-b448-83610a600973" op="Delete"></AccountRequest>
</ProvisioningPlan>
```

# Configuring Retry Errors

The Microsoft Entra ID SaaS connector can automatically retry failed error messages and error codes when the connector encounters a transient error. This is configured by adding error messages to the source's connector attributes list using the REST API.

When an error occurs, the connector checks the error message against a configured list of strings. If any string matches, the operation is retried automatically instead of failing immediately.

Retry errors are configured by adding connector attributes to the source using the REST API.

**API endpoint**:

`PATCH https://{tenant}.api.identitynow.com/v3/sources/{sourceId}`

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Prerequisites

- The admin needs REST API access and the source ID.
- To find your source ID, go to **Admin \> Sources \> \[Your Source\]**. The ID appears in the browser URL. For API authentication, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/idn/api/authentication>).

## Adding Retry Error Messages

To configure retries for failed error messages, add the `retryableErrorMessages` attribute as shown below:

```text
[
  {
    "op": "add",
    "path": "/connectorAttributes/retryableErrorMessages",
    "value": [ "Failed to execute" , "backend request"]
  }
]
```

## Adding Retry Error Codes

To configure retries for failed error codes, add the `retryableErrorCodes` attribute as shown below:

```text
[
  {
    "op": "add",
    "path": "/connectorAttributes/retryableErrorCodes",
    "value": "502,409"
  }
]
```

## Adding the retryDelay Attribute

To set the delay between retry attempts, add the `retryDelay` attribute as shown below. The default is 1000. You can increase the value to a maximum of 5000.

```text
[
  {
    "op": "add",
    "path": "/connectorAttributes/retryDelay",
    "value": 2000
  }
]
```

## Adding the maxRetryCount Attribute

To set the maximum number of retry attempts, add the `maxRetryCount` attribute as shown below. The default is 3. You can increase the value to a maximum of 5.

```text
[
  {
    "op": "add",
    "path": "/connectorAttributes/maxRetryCount",
    "value": 4
  }
]
```

# Azure Attributes

The Microsoft Entra ID SaaS connector supports additional account and group schema attributes for Azure objects. Add the attributes for the features you manage to the corresponding account or group schema.

The Azure attributes are described on the following pages:

- [Azure PIM and Cloud Object Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/pim_cloud_objects.html>) - Azure PIM attributes and group attributes for Azure cloud objects such as management groups, subscriptions, and resource groups.
- [Workload Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html>) - Group attributes for service principals, account attributes for managing service principals as accounts, and account attributes for user-assigned and system-assigned managed identities.
- [Machine Identity Schema Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/machine_identity_attributes.html>) - Attributes for Azure AI Foundry agents and Copilot Studio agents.

# Machine Identity Schema Attributes

Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.

For more information, refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>).

To manage Machine Identity Objects, ensure that the attributes are present in the respective agents schema:

## Azure AI Foundry Agents Attributes

> [!IMPORTANT]
>
> Microsoft has deprecated Classic Azure AI Foundry agents. Because of this, the Microsoft Entra SaaS connector now supports discovery (aggregation) of New Azure AI Foundry agents only. It no longer aggregates Classic Azure AI Foundry agents.

Following lists the supported schema attributes for the classic Azure AI Foundry Agents.

> [!NOTE]
>
> The attribute list cannot be extended.

<table class="span-table"> <tr> <td>Parent Attribute Name</td> <td>Child Attribute Name</td> <td>Description</td> </tr> <tr> <td>identity</td> <td>-</td> <td>Unique identifier for the agent.</td> </tr> <tr> <td>name</td> <td>-</td> <td>Display name assigned to the agent.</td> </tr> <tr> <td>datasetId</td> <td>-</td> <td>Internal SailPoint dataset identifier for the agent.</td> </tr> <tr> <td>description</td> <td>-</td> <td>Text describing the agent's purpose and behavior.</td> </tr> <tr> <td colspan="1" rowspan="11">attributes</td> <td>model</td> <td>Identifier of the AI model the agent uses (for example, a GPT variant).</td> </tr> <tr> <td>resources</td> <td>Tools or resources assigned to and accessible by the agent.</td> </tr> <tr> <td>connectedAgents</td> <td>Other agents connected to this agent as sub-agents or collaborators.</td> </tr> <tr> <td>top_p</td> <td>Controls the diversity of the agent's responses by limiting token selection to the top cumulative probability mass. Lower values produce more focused outputs; higher values allow more variety.</td> </tr> <tr> <td>temperature</td> <td>Controls the randomness of the agent's responses. Lower values produce more focused and consistent answers; higher values produce more diverse and creative outputs.</td> </tr> <tr> <td>tool_resources</td> <td>External resources required by specific tools assigned to the agent (for example, a list of file IDs for the Code Interpreter tool).</td> </tr> <tr> <td>metadata</td> <td>Custom key-value metadata attached to the agent. Supports up to 16 key-value pairs.</td> </tr> <tr> <td>response_format</td> <td>Specifies the preferred format for the agent's responses (for example, text or json_object).</td> </tr> <tr> <td>created_at</td> <td>Date and time when the agent was created.</td> </tr> <tr> <td>creator</td> <td>Identity that originally created the parent Foundry account resource through Azure Resource Manager (ARM) provisioning. Stored in systemData.createdBy. This is not the same as the RBAC Owner.</td> </tr> <tr> <td>last_modified_by</td> <td>Identity that last modified the parent Foundry account resource through ARM provisioning. Stored in systemData.lastModifiedBy. This is not the same as the RBAC Owner.</td> </tr> </table>

Following lists the supported schema attributes for the new Azure AI Foundry Agents.

| Attribute | Description |
| --- | --- |
| agent\_guid | The globally unique identifier for the agent. |
| blueprintClientId | The client ID (appId) of the Blueprint Service Principal. Used as the join key to link an AgentIdentity to its shared Blueprint in SailPoint. |
| blueprintId | The object ID of the Blueprint Service Principal in Entra ID. |
| blueprintPrincipalId | The principal ID of the Blueprint SP. Used for Entra identity linkage and governance. |
| blueprintType | The type classification of the Blueprint (for example, `AgentIdentityBlueprint`). |
| deploymentNames | List of deployment names associated with the agent. |
| instanceIdentityClientId | The client ID (appId) of the AgentIdentity Service Principal - the runtime identity for this specific agent instance. |
| instanceIdentityPrincipalId | The principal ID of the AgentIdentity SP. Used for Entra identity linkage and governance. |
| operationalState | The current operational state of the agent. Possible values:`Running, Stopped`. |
| primaryDeploymentName | The name of the primary deployment. Used for stop and start operations on the agent. |
| projectName | The name of the Azure AI Foundry project that hosts this agent. |
| published | Indicates whether the agent has been published. |
| version | The version of the agent. Each version is aggregated as a separate Machine Identity in SailPoint. |
| versionId | The unique identifier for this specific agent version. |
| versionStatus | The status of this agent version (for example, `Active, Inactive`). |

## Copilot Studio Agents Attributes

Following lists the supported schema attributes for the Copilot Studio Agents.

| Parent Attribute Name | Attribute Details |
| --- | --- |
| identity | The unique identifier of the Copilot agent. |
| name | The name of the Copilot agent. |
| description | The description of the Copilot agent. |
| status | The status of the agent whether it's active or inactive. |
| owner | The owner of the agent. |
| created\_at | ISO timestamp representing when the agent was created. |
| updated\_at | ISO timestamp when the agent was last updated. |
| resources | List of resource IDs (tools and knowledge bases) associated with the agent. It is an array of objects.<br>Note<br>Viewing an Agent's Control Panel |

> [!NOTE]
>
> This attribute list cannot be extended.

# Azure PIM and Cloud Object Attributes

## Azure PIM Attributes

Add the following attributes to connector Account Schema:

<table class="span-table"> <tr> <td>Name</td> <td>Type</td> <td>Details</td> </tr> <tr> <td>azureEligibleRoles</td> <td colspan="1" rowspan="6">String : Multivalued : Entitlement</td> <td>List of Azure Roles for which user is eligible</td> </tr> <tr> <td>azureADEligibleRoles</td> <td>List of Microsoft Entra ID Roles for which user is eligible</td> </tr> <tr> <td>azureActiveRoles</td> <td>List of Azure Roles assigned to user</td> </tr> <tr> <td>azureADActiveRoles</td> <td>List of Microsoft Entra ID Roles assigned to user</td> </tr> <tr> <td>azureADEligibleGroups</td> <td>List of groups for which the account has PIM eligible membership.</td> </tr> <tr> <td>azureADActiveGroups</td> <td>List of groups for which the account has PIM active membership.</td> </tr> </table>

### Membership Aggregation

Membership Aggregation is part of account aggregation. PIM Membership aggregation will be added to existing membership aggregation flow and will be triggered only if flag is ON and required attributes are present in account schema Memberships will be aggregated if flag is true and account attributes are present in schema.

For example:

- If the enablePIM attribute is true and only Microsoft Entra ID Roles : Active is present in schema, only Microsoft Entra ID Roles membership for active assignments are aggregated.
- PIM Memberships are aggregated per page. For example, membership is fetched for users aggregated in a page.
- PIM Memberships for Azure resources are aggregated if Azure Management is enabled and respective attributes are present in the schema.

### Membership Aggregation of PIM Roles for Microsoft Entra ID Groups

Azure / Microsoft Entra ID PIM Role assignments / membership for Microsoft Entra ID groups will be visible as entitlement attributes after running group / entitlement aggregation ONLY when relevant role attributes (mentioned above as Azure PIM attributes) are added to group schema and PIM flag is true.

> [!NOTE]
>
> The PIM membership for such groups would show only the native identity of the assigned PIM roles.

### Group Schema Objects

The following new group schema objects are supported.

### Microsoft Entra ID Eligible Role

Object Type is azureADEligibleRole, Identity Attribute is id, and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Eligible role display name. |
| id | Microsoft Entra ID eligible role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Microsoft Entra ID Active Role

Object Type is azureADActiveRole, Identity Attribute is id, and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Active AD role display name. |
| id | Microsoft Entra ID active role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Azure Active Role

Object Type is azureActiveRole, Identity Attribute is id, and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Active role display name. |
| id | Azure active role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Azure Eligible Role

Object Type is azureEligibleRole, Identity Attribute is id , and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Eligible role display name. |
| id | Azure eligible role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Azure AD Eligible Group

Represents a group for which a principal holds a time-bound eligible PIM membership (the principal must activate the membership before it becomes active).

Object Type is azureADEligibleGroup, Identity Attribute is id , and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| id | Native ID. The unique identifier (object ID) of the group. |
| displayName | Display name of the group. |
| description | Description of the group. |
| securityEnabled | Indicates whether the group is a security group. |
| groupTypes | Type of the group. Blank for Security groups; Unified for Microsoft 365 groups. |

### Azure AD Active Group

Represents a group for which a principal holds a time-bound active PIM membership.

Object Type is azureADActiveGroup, Identity Attribute is id , and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| id | Native ID. The unique identifier (object ID) of the group. |
| displayName | Display name of the group. |
| description | Description of the group. |
| securityEnabled | Indicates whether the group is a security group. |
| groupTypes | Type of the group. Blank for Security groups; Unified for Microsoft 365 groups. |

## Group Attributes for Azure Cloud Objects

> [!NOTE]
>
> The schema for the following mentioned Group objects is not available with the included Microsoft Entra ID SaaS connector. You must purchase a CIEM license in order to enable the Cloud Governance features of the connector.

To manage the following Azure Management Objects, ensure that the attributes present in the respective sections are present in the group schema:

### Azure Role Assignments

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| displayName | Display name. |
| id | Azure Role Assignment ID. |
| resource | Display name of the resource on which role can be assigned. |
| roleName | Display name of the role which can be assigned on resource. |

Example schema:

```text
<Schema displayAttribute="displayName" identityAttribute="id" nativeObjectType="azureRoleAssignment" objectType="azureRoleAssignment">
    <AttributeDefinition name="id" type="string">
        <Description>Azure Role Assignment ID</Description>
    </AttributeDefinition>
    <AttributeDefinition name="displayName" type="string">
        <Description>Display Name</Description>
    </AttributeDefinition>
    <AttributeDefinition name="resource" type="string">
        <Description>Display name of the resource on which role can be assigned</Description>
    </AttributeDefinition>
    <AttributeDefinition name="roleName" type="string">
        <Description>Display name of the role which can be assigned on resource</Description>
    </AttributeDefinition>
</Schema>
```

The following is the corresponding sample entry of this entitlement in the account schema (if needed):

```text
<AttributeDefinition entitlement="true" managed="true" multi="true" name="azureRoleAssignments" schemaObjectType="azureRoleAssignment" type="string">
    <Description>azureRoleAssignments</Description>
</AttributeDefinition>
```

### Management Groups

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| displayName | Friendly name of the management group. |
| id | Fully qualified ID for the management group. |
| type | Type of resource. |
| name | Name of the management group. |

Example schema:

```text
<Schema displayAttribute="name"  identityAttribute="id" nativeObjectType="managementGroup" objectType="managementGroup">
    <AttributeDefinition name="id" type="string">
        <Description>Fully qualified ID for the management group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="displayName" type="string">
        <Description>Friendly name of the management group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="name" type="string">
        <Description>Name of the management group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="type" type="string">
        <Description>Type of the resource</Description>
    </AttributeDefinition>
</Schema>
```

### Resource Groups

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| id | ID of the resource group. |
| name | Name of the resource group. |
| type | Type of the resource group. |
| location | Location of the resource group. |
| provisioningState | Provisioning state of the resource group. |

Example schema:

```text
<Schema displayAttribute="name" identityAttribute="id" nativeObjectType="resourceGroup" objectType="resourceGroup">
    <AttributeDefinition name="id" type="string">
        <Description>ID of the resource group.</Description>
    </AttributeDefinition>
    <AttributeDefinition name="name" type="string">
        <Description>Name of the resource group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="type" type="string">
        <Description>Type of the resource group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="location" type="string">
         <Description>Location of the resource group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="provisioningState" type="string">
        <Description>Provisioning state of the resource group</Description>
    </AttributeDefinition>
</Schema>
```

### Subscriptions

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| displayName | Display name of the subscription. |
| id | Fully qualified ID for the subscription. |
| authorizationSource | Authorization source of the request. |
| managedByTenants | List of tenants managing subscription. |
| subscriptionId | Object ID for the subscription. |
| tenantId | Tenant ID with which subscription has trust relationship. |
| state | State of subscription, that is, it is enabled or disabled. |

Example schema:

```text
<Schema displayAttribute="name" identityAttribute="subscriptionId" nativeObjectType="subscription" objectType="subscription">
    <AttributeDefinition name="subscriptionId" type="string">
        <Description>Object Id of the subscription</Description>
    </AttributeDefinition>
    <AttributeDefinition name="displayName" type="string">
        <Description>Subscription display name.</Description>
    </AttributeDefinition>
    <AttributeDefinition name="state" type="string">
        <Description>Subscription state</Description>
    </AttributeDefinition>
    <AttributeDefinition name="authorizationSource" type="string">
        <Description>Authorization source of request</Description>
    </AttributeDefinition>
    <AttributeDefinition name="id" type="string">
        <Description>Fully qualified ID for the subscription</Description>
    </AttributeDefinition>
    <AttributeDefinition name="tenantId" type="string">
        <Description>Subscription tenant ID</Description>
    </AttributeDefinition>
    <AttributeDefinition multi="true" name="managedByTenants" type="string">
        <Description>List of tenants managing subscription</Description>
    </AttributeDefinition>
</Schema>
```

# Workload Identity Attributes

## Service Principal As Accounts Attributes

You can automate the process of adding Service Principal account attributes to the account schema, with the toggle option for **Manage Azure Service Principal As Account** during Account Schema configuration. This reduces your efforts by automating the Service Principal account attributes addition process. It allows the segregation of various feature attributes within account schema for better retreival.

> [!IMPORTANT]
>
> Ensure Manage Microsoft Entra Service Principals as Accounts during [Manage Microsoft Entra Service Principals as Accounts](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/feature_management.html#manage-microsoft-entra-service-principals-as-accounts>) configuration is selected to aggregate Azure Service Principals along with users during the account aggregation process.

Select **Include Attributes in Schema** for managing azure Service Principal as account to automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration.

To manage Service Principals, following lists the attributes that are present in the account schema:

<table> <thead> <tr> <th>Schema Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>objectId</td> <td>String</td> <td>The ID of the user, service principal, or managed identity.<br>This is an Identity Attribute that must not be changed.<br><strong>Note</strong><br><code>objectId</code> is a concatenation of the Service Principal (SPN) Object ID and the corresponding Application Object ID.</td> </tr> <tr> <td>accountEnabled</td> <td>Boolean</td> <td>This is set to true if the user, service principal, or managed identity is enabled. Otherwise, this is set to false.</td> </tr> <tr> <td>spn_appDisplayName</td> <td>String</td> <td>The display name for the application.</td> </tr> <tr> <td>spn_app_Description</td> <td>String</td> <td>This is a free-text field for providing the description of the application object to end users. The maximum size is 1024 characters.</td> </tr> <tr> <td>spn_appId</td> <td>String</td> <td>This is the unique identifier for the application that is assigned to an application by Microsoft Entra.</td> </tr> <tr> <td>spn_applicationTemplateId</td> <td>String</td> <td>This is the unique identifier of the application template.</td> </tr> <tr> <td>spn_appOwnerOrganizationId</td> <td>String</td> <td>This contains the tenant ID where the application is registered.</td> </tr> <tr> <td>spn_createdDateTime</td> <td>String</td> <td>This is the date and time the application was registered.</td> </tr> <tr> <td>spn_homepage</td> <td>String</td> <td>This is the home page or landing page of the application.</td> </tr> <tr> <td>spn_loginUrl</td> <td>String</td> <td>Displays the URL where the service provider redirects the user to Microsoft Entra to authenticate.</td> </tr> <tr> <td>spn_logoutUrl</td> <td>String</td> <td>Displays the URL that will be used by Microsoft's authorization service to log out a user.</td> </tr> <tr> <td>description</td> <td>String</td> <td>The description that is displayed in the address book for the user or service principal.</td> </tr> <tr> <td>displayName</td> <td>String</td> <td>The name displayed in the address book for the user or service principal.</td> </tr> <tr> <td>spn_servicePrincipalType</td> <td>String</td> <td>Identifies whether the service principal represents an application, managed identity, or legacy application.</td> </tr> <tr> <td>spn_signInAudience</td> <td></td> <td>Displays the Microsoft accounts that are supported for the current application.</td> </tr> <tr> <td>spn_passwordCredentials</td> <td>String<br>Multi</td> <td>The collection of password credentials associated with the service principal.</td> </tr> <tr> <td>spn_keyCredentials</td> <td>String<br>Multi</td> <td>The collection of key credentials associated with the service principal.</td> </tr> <tr> <td>spn_tags</td> <td>String<br>Multi</td> <td>The custom strings that can be used to categorize and identify the service principal.</td> </tr> <tr> <td>spn_app_owners<br><strong>Note</strong><br>Both Users and Applications (corresponding SPN) can be owners.<br>For consistency, the following are shown:<br><ul><li>For SPN as App Owner<br>spn_app_owners = &lt;object Id of SPN&gt;</li><li>For User as App Owner<br>spn_app_owners = &lt;UPN of the User&gt;</li></ul></td> <td>String<br>Multi</td> <td>Directory objects that are owners of the application.</td> </tr> <tr> <td>spn_owner<br><strong>Note</strong><br>Only Users can be owners of SPN.<br>For User as SPN Owner<br><code>spn_owner = &lt;UPN of the User&gt;</code></td> <td>String<br>Multi</td> <td>Directory objects that are owners of this servicePrincipal.</td> </tr> <tr> <td>spn_app_passwordCredentials</td> <td>Multi</td> <td>The collection of password credentials associated with the application.</td> </tr> <tr> <td>spn_app_keyCredentials</td> <td>Multi</td> <td>The collection of key credentials associated with the service principal.</td> </tr> <tr> <td>spn_appRoles</td> <td>String<br>Multi</td> <td>The roles exposed by the application that this service principal represents.</td> </tr> <tr> <td>appRoleAssignments</td> <td>applicationRole<br>Multi</td> <td>Lists the associated application roles for the Account. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>groups</td> <td>group<br>Multi</td> <td>Lists the associated groups for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>roles</td> <td>roles<br>Multi</td> <td>Lists the associated Microsoft Entra Roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>azureRoleAssignments</td> <td>azureRoleAssignment<br>Multi</td> <td>Lists the associated RBAC roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>spn_adminConsentedPermissions</td> <td>adminConsentedPermission<br>Multi<br>Entitlement</td> <td>Lists the associated Azure admin consented permissions for the service principal. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>spn_userConsentedPermissions</td> <td>String<br>Multi<br>Entitlement</td> <td>Lists the associated Azure user consented permissions for the service principal. This is a multi-valued, entitlement, and managed attribute.</td> </tr> </tbody> </table>

> [!NOTE]
>
> The Service Principal object will also display Application object properties. Attributes with *app* in the name are Application object properties and all others are Service Principal object properties.
>
> For example,
>
> - spn\_app\_owners is for directory objects that are owners of the *application*.
> - spn\_owners is for directory objects that are owners of this *service principal*.

## User-Assigned Managed Identity Attributes

You can automate the process of adding user-assigned managed identities account attributes to the account schema, with the toggle option for **User Assigned Managed Identities** during Account Schema configuration. This reduces your efforts by automating the user-assigned managed identities account attributes addition process. It allows the segregation of various feature management attributes within account schema for better retreival.

> [!IMPORTANT]
>
> Ensure Manage User-Assigned Managed Identities as Accounts during [User-Assigned Managed Identities Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html#user-assigned-managed-identities>) configuration is selected to manage user-assigned identities.

Select **Include Attributes in Schema** for managing user-assigned managed identities to automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration.

To manage user-assigned managed identities, following lists the attributes that are present in the account schema:

| Attribute Name | Description |
| --- | --- |
| objectId | ID of the user or managed identity. |
| managedIdentity\_location | The geolocation where the managed identity lives. |
| displayName | The display name of the user or managed identity. |
| managedIdentity\_tags | Tags for the managed identity resource. |
| managedIdentity\_type | The type of managed identity resource. |
| managedIdentity\_principalId | The ID of the service principal object associated with the managed identity. |
| managedIdentity\_associatedResources | Lists the associated Azure resources for the managed identity. This is a multi-valued attribute. |
| azureRoleAssignements | Lists the associated RBAC roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| groups | Lists the associated groups for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureActiveRoles | Lists the associated Azure active roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |

## System-Assigned Managed Identity Attributes

You can automate the process of adding system-assigned managed identities account attributes to the account schema, with the toggle option for **System-Assigned Managed Identities** during Account Schema configuration. This simplifies your workflow by automating the system-assigned managed identities account attributes addition process. It enables organized segregation of system-assigned identity-related attributes within the account schema for more efficient retrieval.

> [!IMPORTANT]
>
> Ensure Include System-Assigned Managed Identities during Cloud Resource Management configuration is selected to manage system-assigned identities.

Select **Include Attributes in Schema** for managing system-assigned managed identities to automate the process of adding system-assigned managed identities account attributes to the account schema during Account Schema configuration.

To manage system-assigned managed identities, following lists the attributes that are present in the account schema:

| Attribute Name | Description |
| --- | --- |
| objectId | ID of the user or managed identity. |
| managedIdentity\_location | The geolocation where the managed identity lives. |
| displayName | The display name of the user or managed identity. |
| managedIdentity\_tags | Tags for the managed identity resource. |
| managedIdentity\_type | The type of managed identity resource. |
| managedIdentity\_principalId | The ID of the service principal object associated with the managed identity. |
| managedIdentity\_associatedResources | Lists the associated Azure resources for the managed identity. This is a multi-valued attribute. |
| azureRoleAssignements | Lists the associated RBAC roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| groups | Lists the associated groups for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureActiveRoles | Lists the associated Azure active roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| managedIdentity\_tenantId | The Azure Active Directory (AAD) tenant ID associated with the managed identity. This uniquely identifies the directory where the resource resides. |
| managedIdentity\_resourceName | The name of the Azure resource (e.g., a Storage Account, App Service, etc.) to which the managed identity is attached. |
| managedIdentity\_resourceType | The resource type identifies the service provider and the specific type of the resource. |
| managedIdentitiy\_resourceKind | The kind of the Azure resource, providing additional classification or capabilities. |

# Directory Attributes

## Admin Consented Permission Attributes

To manage admin consented permissions, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The object type is `adminConsentedPermission`.

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for adminConsentedPermission.<br>This is the native identity attribute. This ID is a concatenation of `resourceId:value`<br>Where `resourceId` is the ID of SPN and `value` is the value for the adminConsentedPermssion within that SPN.<br>For example:<br>`2555d458-1b3c-4953-bcc4-a38409561c2f:AuditLog.Read.All` |
| displayName | String | This is the display name of the adminConstentedPermission.<br>Just like id, displayName is a concatenation of `value [on] resource-DisplayName`<br>For example:<br>If an SPN with a displayName of `Microsoft Graph` has a permission defined with the value as `AuditLog.Read.All`, then the displayName for adminConsentedPermission after concatenation would be `AuditLog.Read.All [on] Microsoft Graph` |
| spn\_description | String | This is the description for the SPN. |
| permission\_description | String | This is the description for the adminConsentedPermission. |
| type | String | The possible values are `User` and `Admin`. This denotes whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an admin consent should always be required. |
| isEnabled | boolean | Whether the adminConsentedPermission is enabled or disabled. |
| value | String | The value for the attribute. For example:<br>`AuditLog.Read.All` |

Use the following JSON request and REST API to add the `adminConsentedPermission` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
        "nativeObjectType": "adminConsentedPermission",
        "identityAttribute": "id",
        "displayAttribute": "displayName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "displayName",
                "type": "STRING",
                "schema": null,
                "description": "The display name for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "spn_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of service principal",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "permission_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "id",
                "type": "STRING",
                "schema": null,
                "description": "The unique identifier for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "type",
                "type": "STRING",
                "schema": null,
                "description": "Allowed types for admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "isEnabled",
                "type": "STRING",
                "schema": null,
                "description": "States whether the admin consented permission is enabled or not",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "value",
                "type": "STRING",
                "schema": null,
                "description": "Value of the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ]
}
```

## Administrative Units Attributes

### Object Type - administrativeUnit

<table class="span-table"> <tr> <td>Schema Attribute Name</td> <td>Type</td> <td>Description</td> </tr> <tr> <td>id</td> <td colspan="1" rowspan="8">String</td> <td>Fully qualified ID for the Administrative Unit.</td> </tr> <tr> <td>displayName</td> <td>Friendly name of the Administrative Unit.</td> </tr> <tr> <td>description</td> <td>This is the description of the Administrative Unit.</td> </tr> <tr> <td>isMemberManagementRestricted</td> <td>This is the description of Administrative Unit.</td> </tr> <tr> <td>membershipRule</td> <td>Membership Rule.</td> </tr> <tr> <td>membershipType</td> <td>MembershipType.</td> </tr> <tr> <td>membershipRuleProcessingState</td> <td>Membership Rule Processing State.</td> </tr> <tr> <td>visibility</td> <td>Visibility.</td> </tr> </table>

Use the following JSON request and the SailPoint REST API to add the `administrativeUnit` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
      "type": "administrativeUnit",
      "nativeObjectType": "administrativeUnit",
      "identityAttribute": "id",
      "displayAttribute": "displayName",
      "attributes": [
        {
          "name": "id",
          "type": "STRING",
          "schema": null,
          "description": "Fully qualified ID for the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "displayName",
          "type": "STRING",
          "schema": null,
          "description": "Friendly name of the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "description",
          "type": "STRING",
          "schema": null,
          "description": "Description of Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "isMemberManagementRestricted",
          "type": "BOOLEAN",
          "description": "Description of Administrative Unit"
        },
        {
          "name" : "membershipRule",
          "type" : "STRING",
          "description": "Membership Rule"
        },
        {
          "name" : "membershipType",
          "type" : "STRING",
          "description": "Membership Type"
        },
        {
          "name" : "membershipRuleProcessingState",
          "type" : "STRING",
          "description": "Membership Rule Processing State"
        },
        {
          "name" :"visibility",
          "type" : "STRING",
          "description" : "Visibility"
        }

]

}
```

## Application Role Attributes

### Object Type - applicationRole

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for Application Role.<br>This is the nativeIdentity attribute.<br>This id is a concatenation of:<br>`resourceId:appRoleId`<br>Where, `resourceId` is the ID of SPN, and `appRoleId` is the ID for the appRole within that SPN.<br>For example, `70b32868-8393-4c4e-99fc-916710f62412:6f445064-b311-4d3e-a869-e024e787d6a9` |
| displayName | String | This is the display name of the Application Role.<br>Just like id, displayName is a concatenation of:<br>`resource-DisplayName: appRole-DisplayName`<br>For example, if an SPN with displayName TestSPN, has an appRole defined with name Engineer, then the displayName for appRole after concatenation would be TestSPN:Engineer |
| spn\_description | String | This is the description for the SPN. |
| appRole\_description | String | This is the description for the appRole. |
| allowedMemberTypes | String<br>Multi | Displays the types of members that this role can be assigned to. For example, `Users,Groups,Applications` |
| isEnabled | boolean | Displays whether the appRoles is enabled or disabled. |
| value | String |  |

Use the following JSON request and the REST API to add the `ApplicationRole` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
    "nativeObjectType": "applicationRole",
    "name": "applicationRole",
    "identityAttribute": "id",
    "displayAttribute": "displayName",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "id",
            "type": "STRING",
            "schema": null,
            "description": "Unique Identifier for Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "displayName",
            "type": "STRING",
            "schema": null,
            "description": "Display Name of the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "spn_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Service Principal",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "appRole_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "allowedMemberTypes",
            "type": "STRING",
            "schema": null,
            "description": "Types of members that this role can be assigned to, for example: Users,Groups,Applications",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "isEnabled",
            "type": "BOOLEAN",
            "schema": null,
            "description": "Represents whether the Application Role is enabled or disabled.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "value",
            "type": "STRING",
            "schema": null,
            "description": "The value of the Application Role.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}
```

## Roles

To manage the Microsoft Entra role objects, ensure that the following attributes are present in the group schema.

| Attribute Name | Description |
| --- | --- |
| description | Specify the description of the Microsoft Entra role. |
| displayName | Specify the display name for the Microsoft Entra role. |
| id | Specify the unique identifier for the Microsoft Entra role. |
| isBuiltIn | Specify the flag indicating whether the role is part of the default set included in Microsoft Entra or a custom one. |
| isEnabled | Specify the flag indicating whether the role is enabled for assignment. If it is false, the role is not available for assignment. |
| rolePermissions | Specify the list of permissions included in the role. |

## Mail Contacts As Accounts Attributes

To manage mail contacts as accounts, ensure the following attributes are present in your account schema:

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| objectId | String | ID is normal GUID. So to identity this object as `mailContacts` you should save this as `microsoft.mailContact:88914ce6-7962-4465-8cb3-371268c1e64a` |
| displayName | String | Display name of the mail contact. |
| groups | String<br>Multivalued<br>Entitlement<br>Managed | List of groups that the mail contact is a member of. |
| mailContact\_department | String | The name for the department in which the contact works. |
| mailContact\_companyName | String | The name of the company that this mail contact belongs to. |
| mailContact\_givenName | String | First name of the mail contact. |
| mailContact\_jobTitle | String | Job title of the mail contact. |
| mailContact\_mail | String | The SMTP address of the contact. For example, `jeff@contoso.onmicrosoft.com` |
| mailContact\_mailNickname | String | Email alias (portion of the email address prepending the @ symbol) of the mail contact. |
| mailContact\_surname | String | Last name of the mail contact. |
| mailContact\_addresses | String | Post address of the mail contact.<br>Note<br>The contact can only have one physical address. |
| mailContact\_phones | String | List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax. |

### Sample JSON Request for Managing Mail Contacts As Accounts

```text
{
  "nativeObjectType": "account",
  "identityAttribute": "objectId",
  "displayAttribute": "userPrincipalName",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [],
  "configuration": {},
  "attributes": [
    {
      "name": "objectId",
      "type": "STRING",
      "schema": null,
      "description": "The unique identifier for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "STRING",
      "schema": null,
      "description": "The name displayed in the address book for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "groups",
      "type": "STRING",
      "schema": {
        "type": "CONNECTOR_SCHEMA",
        "id": "2c918085843dc5ce01845bebf6e43a8a",
        "name": "group"
      },
      "description": "Groups assigned to a user",
      "isMulti": true,
      "isEntitlement": true,
      "isGroup": true
    },
    {
      "name": "mailContact_phones",
      "type": "STRING",
      "schema": null,
      "description": "List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax.",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_department",
      "type": "STRING",
      "schema": null,
      "description": "The name for the department in which the contact works.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_companyName",
      "type": "STRING",
      "schema": null,
      "description": "The name of the company that this mail contact belongs to.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_givenName",
      "type": "STRING",
      "schema": null,
      "description": "First name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_surname",
      "type": "STRING",
      "schema": null,
      "description": "Last name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_jobTitle",
      "type": "STRING",
      "schema": null,
      "description": "Job title of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mailNickName",
      "type": "STRING",
      "schema": null,
      "description": "Email alias (portion of the email address prepending the @ symbol) of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mail",
      "type": "STRING",
      "schema": null,
      "description": "The SMTP address of the contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```

## Channel Attributes

To manage the channel management objects, ensure that the following attributes are present in the group schema.

<table> <thead> <tr> <th>Attribute Name</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>description</td> <td>Optional textual description for the channel.</td> </tr> <tr> <td>displayName</td> <td>Channel name as it will appear to the user in Microsoft Teams.<br>Combination of team display name: channel display name.</td> </tr> <tr> <td>id</td> <td>The channel's unique identifier.<br>Combination of team id: channel id</td> </tr> <tr> <td>isFavoriteByDefault</td> <td>Indicates whether the channel must automatically be marked favorite for all members of the team. Default: false.</td> </tr> <tr> <td>email</td> <td>The email address for sending messages to the channel. Read-only.</td> </tr> <tr> <td>webUrl</td> <td>A hyperlink that will go to the channel in Microsoft Teams.</td> </tr> <tr> <td>membershipType</td> <td>The type of the channel. Possible values are:<br><ul><li>standard: Channel inherits the list of members of the parent team.</li><li>private: Channel can have members that are a subset of all the members on the parent team.</li></ul></td> </tr> <tr> <td>createdDateTime</td> <td>Read only. Timestamp at which the channel was created.</td> </tr> <tr> <td>teamEmail</td> <td>The email address of the parent team.</td> </tr> <tr> <td>owners</td> <td>The list of owners of the private channel.<br>Properties: Multi-Valued</td> </tr> </tbody> </table>

# Schema Reference

This section describes the different schema attributes. The Microsoft Entra ID SaaS connector currently supports the following types of objects:

- Account: Account objects are used when building identities Link objects.
- Group: The group schema is used when building Account-Group objects that are used to hold entitlements shared across identities.
- Role: The Role schema is used when building Directory Role objects that are used to hold entitlements shared across identities.
- Management Group: The Management group schema is used to represent Azure Management Groups which are created to allow Azure customers to organize their subscriptions and apply governance controls such as Role Based Access Control and Policies.
- Subscription: The Subscription schema is used to represent Azure Subscription objects which represent a signed agreement between a supplier and customer that the customer would receive and provide payment for regular products or services.
- Resource Group: The Resource group schema is used to represent Azure Resource Groups which are container objects that hold related resources for an Azure solution.
- Azure Role Assignment: The Azure Role Assignment schema is used to represent custom group objects that consist of the following elements:

  - Security Principal (user, groups, service principal, managed identity)
  - Role Definition
  - Access Scope

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Microsoft Entra ID SaaS connector uses the following default correlation and object configurations.

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the Microsoft Entra ID SaaS source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| userPrincipalName | Equals | Work Email |
| mail | Equals | Work Email |

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| objectId | account |
| objectId | group |
| id | role |
| id | azureRoleAssignment |
| id | managementGroup |
| subscriptionId | subscription |
| id | resourceGroup |

### Default Account Attributes

The Microsoft Entra ID SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| accountEnabled | True if the user is enabled; otherwise, false. |
| city | City in which the user is located. |
| country | Country/region in which the user is located. |
| creationType | Indicates whether the user account is a local account for an Azure Active Directory B2C tenant. |
| department | Name for the department the user belongs to. |
| onPremisesSyncEnabled | Indicates whether a Microsoft Entra ID user is synchronized from an on-premises directory. |
| displayName | Name displayed in the address book for the user. |
| facsimileTelephoneNumber | Telephone number of the user's business fax machine. |
| givenName | First name of an user. |
| groups | Groups assigned to an user (Entitlement). |
| identities | Represents the identities that can be used to sign in to this user account, that can be either a local or social account.<br>Note<br>During account aggregation, the connector excludes identity records with `signInType` set to `userPrincipalName`. |
| immutableId | Property used to associate an on-premises Active Directory user account to their Microsoft Entra ID user account. |
| jobTitle | User’s job title. |
| lastDirSyncTime | Indicates the last time at which the user was synchronized with the on-premises directory. |
| signInActivity.lastNonInteractiveSignInDateTime | Indicates the last time a user signed in to the directory with an non-interactive authentication method.<br>The timestamp represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2022 is `2022-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastNonInteractiveSignInRequestId | Indicates the request identifier of the last non-interactive sign-in performed by this user.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSignInDateTime | Indicates the last time a user signed in to the directory with an interactive authentication method.<br>The timestamp represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2022 is `2022-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSignInRequestId | Indicates the request identifier of the last interactive sign-in performed by this user.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSuccessfulSignInDateTime | Indicates the date and time of the user's most recent successful sign-in activity.<br>The timestamp type represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSuccessfulSignInRequestId | Indicates the request identifier of the last successful sign-in activity.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| mail | The SMTP address for the user. For example, `john@contoso.onmicrosoft.com` |
| mailNickname | Mail alias for the user. |
| manager | Manager of the user. (Type: String).<br>The Microsoft Entra ID SaaS connector provides support for provisioning the `manager` attribute. For more information, refer to [Support for Provisioning Operations of manager Attribute](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#support-for-provisioning-operations-of-manager-attribute>). |
| mobile | Primary cellular telephone number for the user. |
| objectId | Unique identifier for the user. |
| onPremisesSecurityIdentifier | Contains the on-premises security identifier (SID) for the user that was synchronized from on-premises to the cloud. |
| otherMails | A list of additional email addresses for the user. |
| passwordPolicies | Specifies password policies for the user. |
| physicalDeliveryOfficeName | Office location in the user's place of business. |
| postalCode | ZIP OR postal code for the user's postal address. |
| preferredLanguage | Preferred written or spoken language for a person. |
| proxyAddresses | Proxy addresses.<br>For example, `["SMTP: bob@contoso.com", "smtp: bob@sales.contoso.com"]` |
| roles | Administrator Role assigned to user (Entitlement). |
| sipProxyAddress | Specifies the voice over IP (VOIP) session initiation protocol (SIP) address for the user. |
| state | State or province in the user's address. |
| sponsors | Sponsors of the user. The Microsoft Entra ID SaaS connector provides support aggregation and provisioning of sponsors attribute. For more information, refer to [Configuring Sponsors for Guest User ( B2B) and External Member (B2B)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#sponsors-for-guest-user-b2b-and-external-member-b2b>). |
| streetAddress | Street address of the user's place of business. |
| surname | Last name of the user. |
| telephoneNumber | Primary telephone number of the user's place of business. |
| usageLocation | A two letter country code indicating usage location. |
| userPrincipalName | User principal name (UPN) of the user. |
| userType | Type of the user. |
| azureRoleAssignments\* | Azure Role Assignments assigned to user (Only applicable for CIEM). |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Microsoft Entra ID SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| description | Description for the group. |
| dirSyncEnabled | Indicates whether this group was synced from the on-premises directory. |
| displayName | Display name for the group. |
| lastDirSyncTime | Indicates the last time at which the group was synced with the on-premises directory. |
| mail | SMTP address for the group. |
| mailEnabled | Specifies whether the group is mail-enabled |
| mailNickname | Mail alias for the group. |
| objectId | Group ID. |
| onPremisesSecurityIdentifier | Contains the on-premises security identifier (SID) for the group that was synchronized from on-premises to the cloud. |
| owners | Owner of the group. |
| proxyAddresses | Proxy addresses of the group. |
| securityEnabled | Specifies whether the group is a security group. |
| teamsEnabled | Specifies whether teams has been enabled for the group. |
| groupTypes | Type of the group. Blank for Security and /or Unified for Office 365 type of groups.<br>For example, Unified for Office 365 group. |

## Access Package Attributes

To manage access packages, ensure that the following attribute is present in the account schema:

| Attribute Name | Description |
| --- | --- |
| accessPackages | List of access packages assigned to the user.<br>Type: Entitlement, Multi-Valued |

To manage the Microsoft Entra access package objects, ensure that the following attributes are present in the group schema:

| Attribute Name | Description |
| --- | --- |
| id | Unique identifier of the Access Package. |
| displayName | Display name made by combining the Access Package name and Policy name. |
| description | Description of the Access Package. |
| policyDescription | Description of the Access Package's policy. |
| expiration | Expiration time for the Access Package's policy. |
| isHidden | Indicates whether the Access Package is hidden from end users on My Access portal. |
| catalog | Container where the Access Package resides. |
| Resource Roles | Indicates what all resources are present in the access package with the role. |

## Identity Profile Mapping

The Microsoft Entra ID SaaS connector supports the following attributes in Identity Profile Mapping by default:

| Identity Attribute | Schema Attribute |
| --- | --- |
| uid | objectId |
| email | userPrincipalName |
| displayName | displayName |
| firstname | givenName |
| lastname | surname |
| manager | manager |
| personalEmail | mail |
| workPhone | telephoneNumber |
| phone | mobile |
| title | jobTitle |
| department | department |

## Multi-Factor Authentication (MFA) Attributes

To manage multi-factor authentication user information, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> When using the phone authentication method, the values for the following attributes are expected to be provided with the country code as a prefix: `mfa_phoneNumber_mobile`, `mfa_phoneNumber_alternateMobile`, and `mfa_phoneNumber_office`. If the country code is not provided provisioning operations will result in failure. The value for these attributes should follow this format (there must be a space between the country code and the phone number):`<country code> <phone number>`
>
> Examples:
>
> - `<AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>`
> - `<AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>`
> - `<AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>`

> [!NOTE]
>
> Once you enable MFA for any user there will be one default authentication method set. This is usually the first method configured, but you can modify it later from the Azure portal. If you are trying to remove values for an attribute that belongs to the default authentication method, the Azure APIs will throw an error as the APIs do not expect to remove values for attributes that belong to the default authentication method. For example, if email is the default authentication method configured for an Azure user, the connector will not be able to remove the value for the `mfa_emailAddress` attribute.

<table> <thead> <tr> <th>Authentication Method</th> <th>Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Phone</td> <td>mfa_phoneNumber_mobile</td> <td>String</td> <td>Mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_alternateMobile</td> <td>String</td> <td>Alternate mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_office</td> <td>String</td> <td>Office phone number assigned to the user.</td> </tr> <tr> <td>Email</td> <td>mfa_emailAddress</td> <td>String</td> <td>Email address assigned to the user.</td> </tr> <tr> <td>Microsoft Authentication</td> <td>mfa_microsoftAuthenticatorAuthenticationMethod</td> <td>String: Multivalued</td> <td>Microsoft Authentication method assigned to the user.</td> </tr> <tr> <td>Other</td> <td>mfa_methodName<br>Where methodName is the authentication method name.<br>For example:<br><ul><li>mfa_fido2AuthenticationMethod</li><li>mfa_temporaryAccessPassAuthenticationMethod</li><li>mfa_softwareOathAuthenticationMethod</li><li>mfa_windowsHelloForBusinessAuthenticationMethod</li></ul></td> <td>String: Multivalued</td> <td>Other authentication method assigned to the user.</td> </tr> </tbody> </table>

## Service Plan

Object Type - servicePlan

<table class="span-table"> <tr> <td>Schema Attribute Name</td> <td>Type</td> <td>Description</td> </tr> <tr> <td>objectId</td> <td colspan="1" rowspan="8">String</td> <td>Unique identifier for the service plan which is a combination of skuId and servicePlanId separated by colon (:).</td> </tr> <tr> <td>skuId</td> <td>Unique identifier (GUID) for the License Pack.</td> </tr> <tr> <td>skuPartNumber</td> <td>The SKU part number of the License Pack. For example, <code>AAD_PREMIUM</code></td> </tr> <tr> <td>appliesTo</td> <td>Object types to which the license pack can be assigned. For example, <code>User, Company</code></td> </tr> <tr> <td>displayName</td> <td>Display name of service plan which is a combination of skuPartNumber and servicePlanName separated by colon (:).</td> </tr> <tr> <td>servicePlanId</td> <td>Unique identifier of the service plan.</td> </tr> <tr> <td>servicePlanName</td> <td>The name of the service plan.</td> </tr> <tr> <td>provisioningStatus</td> <td>The provisioning status of the service plan.</td> </tr> </table>

Use the following JSON request and the REST API to add the `servicePlan` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
  "name": "servicePlan",
  "nativeObjectType": "servicePlan",
  "identityAttribute": "objectId",
  "displayAttribute": "displayName",
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "attributes": [
    {
      "name": "objectId",
      "type": "string",
      "isMultiValued": false,
      "description": "Unique identifier for the service plan which is a combination of skuId and servicePlanId separated by colon (:).",
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuId",
      "type": "string",
      "description": "Unique identifier (GUID) for the License Pack",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuPartNumber",
      "type": "string",
      "description": "The SKU part number of the License Pack. For example, AAD_PREMIUM",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "appliesTo",
      "type": "string",
      "description": "Object types to which the license pack can be assigned. For example: User, Company",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "string",
      "description": "Display name of service plan which is a combination of skuPartNumber and servicePlanName separated by colon (:).",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanId",
      "type": "string",
      "description": "Unique identifier of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanName",
      "type": "string",
      "description": "The name of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "provisioningStatus",
      "type": "string",
      "description": "The provisioning status of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ],
  "created": "2019-12-24T22:32:58.104Z",
  "modified": "2019-12-31T20:22:28.104Z"
}​
```

# Privileged Access and Azure Cloud Governance

## Azure Cloud Object Management

> [!IMPORTANT]
>
> You must have a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access.
>
> To display cloud resource data through SailPoint CIEM, you must also configure the CIEM Azure source. For more information, refer to [Connecting Azure and CIEM](<https://documentation.sailpoint.com/saas/help/ciem/azure/connect_azure.html>) to learn more.

The Microsoft Entra ID SaaS connector provides support for access management of the following Azure Management Objects:

- Management Groups
- Subscriptions
- Resource Groups
- Role Assignment (RBAC role assignments. This is a custom group object)

The newly supported group objects (Azure Management objects) and operations are:

| Operations | Group Objects |
| --- | --- |
| Aggregation | Management Groups, Subscriptions, and Resource Groups |
| Aggregation and Add / Remove Entitlement | Role Assignment (RBAC role assignments. This is a custom group object.) |

The following attributes can be configured in the source XML using the REST APIs in accordance with your requirements:

| Parameter | Description |
| --- | --- |
| managementGroup-api-version | API version to be used for management group API. Type: String<br>Default value: 2020-02-01 |
| subscription-api-version | API version to be used for subscription API. Type: String<br>Default value: 2020-01-01 |
| resourceGroup-api-version | API version to be used for resource group API. Type: String<br>Default value: 2020-06-01 |
| role-assignment-api-version | API version to be used for Role Assignments API. Type: String<br>Default value: 2018-07-01 |
| azure-management-resource-base | Azure management API resource base in case of Entra Gov or another private instance. Type: String<br>Default value: [https://management.azure.com](<https://management.azure.com>) |
| fetch-azure-roleassignment-getobject | Specify if role assignments need to be fetched during Get Account call. Type: boolean<br>Default value: False |

### Prerequisites

- The Microsoft Entra ID SaaS connector supports the following grant types for OAuth2 authentication:

  - Client Credentials
  - Auth Code / Refresh Token
  - Certificate Credentials

  Ensure that the appropriate permissions are granted as mentioned in the Administrator Permissions section below.
- Existing clients must be modified for supporting `management.azure.com` as the scope.

### Administrator Permissions

Based on the supported operations (Aggregation and Add/ Remove Entitlements), the following are the required permissions:

| Parameter | Description |
| --- | --- |
| Object Aggregation | Permission: Microsoft.Management/managementGroups/read<br>*Or*<br>Role: Reader<br>Scope: Management Group |
| Role Assignment Aggregation | Permission: Microsoft.Authorization/roleAssignments/read<br>*Or*<br>Role: Reader<br>Scope: Management Group / Subscription |
| Role Definition Aggregation | Permission: Microsoft.Authorization/roleDefinitions/read<br>*Or*<br>Role: Reader<br>Scope: Management Group / Subscription |
| Add Role Assignment | Permission: Microsoft.Authorization/roleAssignments/write<br>*Or*<br>Role: User Access Administrator<br>Scope: Management Group / Subscription |
| Remove Role Assignment | Permission: Microsoft.Authorization/roleAssignments/delete<br>Or<br>Role: User Access Administrator<br>Scope: Management Group / Subscription |

#### API Permissions

| OAuth2.0 Authentication | Type | API | Permission |
| --- | --- | --- | --- |
| Client Credentials | Delegated | Azure Service Management | user\_impersonation |
| Client Credentials | Application | Microsoft Graph | Directory.ReadWriteAll |
| Refresh Token / AuthCode | Delegated | Azure Service Management | user\_impersonation |
| JWT Certificate Credentials | Delegated | Azure Service Management | user\_impersonation |

Refer to the following table to learn more about object management when CIEM license is enabled (Cloud Governance) and otherwise (Identity Governance).

<table class="span-table"> <tr> <td>Management Type</td> <td>Object</td> <td>Identity Governance</td> <td>Cloud Governance</td> </tr> <tr> <td>Account Management</td> <td>User</td> <td>Yes</td> <td colspan="1" rowspan="8">Yes</td> </tr> <tr> <td>Account Management</td> <td>Federated User (Synchronized with On-Prem AD)</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Groups</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Administrator Roles</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Management Groups</td> <td>No</td> </tr> <tr> <td>Entitlement Management</td> <td>Subscriptions</td> <td>No</td> </tr> <tr> <td>Entitlement Management</td> <td>Resource Groups</td> <td>No</td> </tr> <tr> <td>Entitlement Management</td> <td>Roles Assignment (RBAC)</td> <td>No</td> </tr> </table>

## Azure Government Endpoint Configuration

> [!IMPORTANT]
>
> When SailPoint CIEM is enabled for MS Entra source that uses GCC High, ensure `azure-management-resource-base` attribute is set to `https://management.usgovcloudapi.net` so that entitlement aggregation works correctly.

To meet security and compliance needs of federal agencies, state and local governments, Microsoft provides a separate instance of the Azure service. A few example of such instances are Azure Government, and Azure China. As these instances are separated from general Azure services, endpoint (host address) for such instances might also be different.

With endpoint configuration functionality, the Microsoft Entra connector can be configured to communicate with these instances.

The following attributes must be configured in the source XML using the REST APIs:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

<table> <thead> <tr> <th>Parameter</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>msGraphResourceBase</td> <td>Base resource URL to be used for Microsoft Graph API rest calls.<br>The following example points base to default Microsoft Graph resource base:<br><code>POST https://{orgName}.api.identitynow.com/cc/api/source/update/{source ID}</code><br>In the body of the POST, use the form-data as follows:<br><ul><li>Key: <code>msGraphResourceBase</code></li><li>Value: <code>https://graph.microsoft.us</code></li></ul></td> </tr> <tr> <td>msGraphTokenBase</td> <td>Base token URL to be used to get access token for Microsoft Graph API rest calls<br>The following example points base to default Microsoft Graph token base:<br><code>POST https://{orgName}.api.identitynow.com/cc/api/source/update/{source ID}</code><br>In the body of the POST, use the form-data as follows:<br><ul><li>Key: <code>msGraphTokenBase</code></li><li>Value: <code>https://login.microsoftonline.us</code></li></ul></td> </tr> <tr> <td>azure-management-resource-base</td> <td>Base resource URL to be used for Microsoft Graph API rest calls when CIEM is enabled.<br>The following example points base to default Microsoft Graph resource base:<br>key: azure-management-resource-base<br>value: <a href="https://management.azure.com" target="_blank">https://management.azure.com</a></td> </tr> </tbody> </table>

> [!NOTE]
>
> The actual values of endpoints can be found in Microsoft documentation for specific instance. For connector operation, the values for the above attributes must be provided.

## Azure Privileged Identity Management (PIM)

The Microsoft Entra ID SaaS connector supports Privileged Identity Management (PIM) as a service in Microsoft Entra ID. PIM enables you to manage, control, and monitor access to important resources in your organization.

### Azure PIM for Roles

The Microsoft Entra ID SaaS connector supports Privileged Identity Management (PIM) as a service in Microsoft Entra ID. PIM enables you to manage, control, and monitor access to important resources in your organization.

These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources. It reduces the chance of a malicious actor getting access to the resource or an authorized user accidentally impacting a sensitive resource.

#### Supported Features

- Aggregation of PIM Role Assignment objects for Azure and Microsoft Entra ID during entitlement aggregation of type "Groups"
- Aggregation of PIM Role Assignment objects for Azure and Microsoft Entra ID during Account aggregation
- Aggregation of Azure and Microsoft Entra ID PIM roles during Entitlement Aggregation
- Provisioning of eligible role assignment on user for Azure or Microsoft Entra ID PIM role

| Operations | Group Objects |
| --- | --- |
| Entitlement Aggregation of type "Groups" | The following group objects are aggregated as entitlements: Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles. |
| Entitlement Aggregation | Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles (These are custom group objects) |
| Account Aggregation | The following group objects are aggregated as entitlements: Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles. |
| Add or Remove Entitlement | Azure Eligible Roles, Microsoft Entra ID Eligible Roles |

#### Permissions

##### Microsoft Entra Roles (azureADActiveRoles and azureADEligibleRoles)

To communicate with the PIM Graph API for Microsoft Entra ID roles, you must have at least one of the following permissions:

- `RoleManagement.ReadWrite.Directory`
- `RoleManagement.Read.Directory`

To grant these permissions to the client application, refer to the steps in the [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>).

##### Azure Resource Roles (azureActiveRoles and azureEligibleRoles)

The PIM API for Azure resource roles is developed on top of the Azure Resource Manager framework. You will need to give consent to Azure Resource Management but won’t need any Graph API permission. You must ensure that the user or the service principal communicating with the API has at least the Owner or User Access Administrator role on the resource.

To assign the Owner or User Access Administrator role, complete the following:

1. Login to portal.azure.com and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. On the left-hand side of the screen, select **Access Control (IAM)**.
3. Select **Role Assignments** and then the +Add button to assign the Owner or User Access Administrator role on the resource.

##### PIM with Single Account Aggregation

If PIM is enabled, use full aggregation only.

Single Account Aggregation is not recommended, as processing the PIM membership cache for one user can be time-consuming and may lead to a timeout, especially with large amounts of PIM data.

### Azure PIM for Groups

The Microsoft Entra ID SaaS connector now supports Privileged Identity Management (PIM) for Groups. This includes time-bound eligible and active group memberships managed through Microsoft Entra PIM.

- Aggregation of PIM Group Assignment objects (`azureADEligibleGroup` and `azureADActiveGroup`) for Microsoft Entra ID during entitlement aggregation.
- Aggregation of PIM Group Assignment objects (`azureADEligibleGroups` and `azureADActiveGroups`) for Microsoft Entra ID during Account aggregation.
- Provisioning of Group Assignment on Users for Microsoft Entra ID PIM Group.
- Provisioning requests for eligible and active PIM group memberships can include a duration, a start date, and an end date. You can also set a default duration on the source. For the request attributes and the order the connector applies them, refer to [Azure PIM Provisioning Policy](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/azure_policies.html#azure-pim-provisioning-policy>). For the source attributes, refer to [Azure PIM Configuration](<#azure-pim-configuration>).

#### Prerequisites

- Azure AD Premium P2 license.
- Required to use Privileged Identity Management for Groups.
- Enable Privileged Identity Management

  The Enable Privileged Identity Management checkbox must be selected in the connector's Azure Privileged Identity Management Settings section. For more information, refer to [Manage Azure Privileged Identity Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/feature_management.html#manage-azure-privileged-identity-management>).
- Microsoft Graph API permissions

  The Enterprise Application used for the integration must have the permissions granted (Application type).

##### Microsoft Graph API Permissions

| Permission | Purpose |
| --- | --- |
| PrivilegedEligibilitySchedule.Read.AzureADGroup | Read PIM eligible group schedule instances |
| PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup | Assign/revoke eligible group memberships |
| PrivilegedAssignmentSchedule.Read.AzureADGroup | Read PIM active group schedule instances |
| PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup | Assign/revoke active group memberships |

> [!IMPORTANT]
>
> - Microsoft Graph returns a `Request_UnsupportedQuery error (filter height 4, max 3)` when you combine the PIM groups filter field value with the connector's internal group type filter. The internal filter always takes precedence. The user-defined filter applies independently.
> - The Graph API for eligibility and assignment schedule instances accepts `principalId` as a filter. The system fetches membership per account, not in bulk.

## Cloud Infrastructure Entitlement Management (CIEM) Settings

Configure this feature if your application is intended to manage Azure Management Objects. This includes Management Groups, Subscriptions, Resource Groups, and Role assignments.

> [!IMPORTANT]
>
> You must have a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access. For more information on CIEM Cloud Governance, refer to [CIEM Cloud Governance Overview](<https://documentation.sailpoint.com/saas/help/ciem/index.html>).

### Prerequisites

- Before enabling CIEM and adding your instance IDs, you need to configure Azure and Microsoft Entra ID SaaS. For more information on these steps, refer to [Configuring Azure and Microsoft Entra](<https://documentation.sailpoint.com/saas/help/ciem/azure/config_azure.html>).
- CIEM currently supports only the Client Credential authentication method.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/ciem_settings.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/ciem_settings.png>)

To configure CIEM, complete the following:

1. Go to **CIEM Settings**.
2. Select **Enable Cloud Infrastructure Entitlement Management (CIEM)** to manage Azure Management Objects, which include Management Groups, Subscriptions, Resource Groups, and Role Assignments.
3. Enter up to 250 **Instance IDs**, separated by a comma. These are the Application IDs used to resolve Microsoft Entra ID SaaS accounts with federated IAM roles with AWS. For more information, refer to the [Microsoft Entra documentation](<https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/view-applications-portal>).
4. Select **Save**.

## Azure PIM Configuration

| Attribute | Details |
| --- | --- |
| enablePIM | Select the **Enable Privileged Identity Management** checkbox to define the scope of the Microsoft Entra ID PIM roles (Microsoft Entra ID as well as Azure). |
| eligibleRoleExpiresAfter | Specifies the default duration for which Azure and Microsoft Entra ID eligible roles must be assigned to user. The values must be in the ISO\_8601 duration format.<br>For example, if eligible role needs to be assigned for 180 Days, use \<entry key="eligibleRoleExpiresAfter" value="P180D" /\> |
| activeRoleExpiresAfter | Specifies the default duration for which Azure and Microsoft Entra ID Active roles must be assigned to user. The values must be in the ISO\_8601 format.<br>For example, if eligible role must be assigned for 10 Hours, use \<entry key="activeRoleExpiresAfter" value="PT10H" /\> |
| eligibleGroupExpiresAfter | Specifies the default duration for an eligible PIM group membership when the provisioning request does not include `duration` or `endDateTime`. Use the ISO 8601 duration format, or permanent for a membership that does not expire. If this attribute is not set, the connector uses P365D.<br>For example, to set the default to 60 days, use \<entry key="eligibleGroupExpiresAfter" value="P60D" /\> |
| activeGroupExpiresAfter | Specifies the default duration for an active PIM group membership when the provisioning request does not include `duration` or `endDateTime`. Use the ISO 8601 duration format, or permanent for a membership that does not expire. If this attribute is not set, the connector uses P180D.<br>For example, to set the default to 90 days, use \<entry key="activeGroupExpiresAfter" value="P90D" /\> |

# Account, Group, and Role Management

## Account Management for User, User in Federated Domain, Guest User (B2B), and External Member (B2B)

This section describes the supported features for user, user in federated domain, guest user (B2B), and external member (B2B).

The following table lists various operations supported by connector for different Users:

<table> <thead> <tr> <th>Operations</th> <th>User</th> <th>User in Federated Domain</th> <th>Guest User (B2B)</th> <th>External Member (B2B)</th> </tr> </thead> <tbody> <tr> <td>Aggregation</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Delta Aggregation</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Get Account</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Pass-Through Authentication</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Create</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Update</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Delete</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Enable/Disable Users</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Set Password</td> <td>Yes</td> <td>No</td> <td>No</td> <td>No</td> </tr> <tr> <td>Add/Remove Entitlements<br><ul><li>Add/Remove Roles</li><li>Add/Remove user's group membership</li><li>Add/Remove individual license plans</li><li>Add/Remove Channels</li></ul></td> <td>Yes</td> <td>Yes</td> <td>Yes<br>Note <br><em>Not applicable to Add/Remove Shared Mailbox from users</em></td> <td>Yes<br>Note <br><em>Not applicable to Add/ Remove Shared Mailbox from users</em></td> </tr> <tr> <td>Aggregate Exchange Mailbox Attribute</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Aggregate Shared Mailbox as an Entitlement</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Aggregate and Provision Sponsors</td> <td>No</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> </tbody> </table>

## Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Account Management for Local User (B2C)

Azure Active Directory B2C is primarily for businesses and developers that create customer-facing applications. With Azure Active Directory B2C, users can use Microsoft Entra as the full-featured identity system for their application, while letting customers sign in with an identity they already have established (like Facebook or Gmail).

B2C is intended for inviting customers of your mobile and web applications, whether individuals, institutional or organizational customers into your Microsoft Entra.

Supported identities are Consumer users with local application accounts (any email address or user name) or any supported social identity with direct federation. A new/separate Microsoft Entra application must be created to manage B2C tenants.

<table class="span-table"> <tr> <td>Operations</td> <td>Manage B2C Tenant - Local User</td> <td>Manage B2C Tenant - Social User</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="6">Yes</td> <td>Yes</td> </tr> <tr> <td>Create</td> <td>No</td> </tr> <tr> <td>Update</td> <td>Yes</td> </tr> <tr> <td>Delete</td> <td>Yes</td> </tr> <tr> <td>Enable/Disable Users</td> <td>Yes</td> </tr> <tr> <td>Add/Remove Entitlements<br>Add/Remove Roles<br>Add/Remove User's Group Membership</td> <td>Yes</td> </tr> </table>

## Revoke Session After Disabling User Account

Disabling a user account prevents future authentication attempts, but existing active sessions can remain valid until token expiration. With this feature enabled, the Microsoft Entra ID SaaS connector automatically revokes active sign-in sessions during the disable account workflow, cutting off access immediately.

### Supported Operations

- Revoke active user sign-in sessions when their account is disabled.

> [!NOTE]
>
> This feature applies to user accounts only. Service principals do not have sign-in sessions.

### Administrator Permissions

To revoke sign-in sessions, assign the following Microsoft Graph API application permissions to your Entra ID app registration:

| Type | Permission | Purpose |
| --- | --- | --- |
| Application | `User.RevokeSessions.All` | Revoke a user's sign-in sessions |
| Application | `User.ReadWrite.All` | Revoke a user's sign-in sessions |

> [!NOTE]
>
> If your application registration already contains the required permissions to perform the standard account disable operation `(User.ReadWrite.All)`, no additional permissions are required.

### Configuring Account Disable Settings

> [!NOTE]
>
> - For newly created sources, this is enabled by default to align with security best practices.
> - For existing sources, this is disabled by default. When required, ensure to select this option.

To configure Account Disable Settings:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/revoke_sessions.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/revoke_sessions.png>)

1. Go to **Feature Management**.
2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled.
3. Select **Save**.

## Last Login for Accounts

The Microsoft Entra ID SaaS connector can retrieve the last login date and time for individual users. This information can enable governance workflows to certify access and remove long-standing access if it's no longer needed.

The connector uses the MS Graph API to retrieve the last login account data.

### Prerequisites

You must have an Microsoft Entra P1/P2 license to use this feature.

### Administrator Permissions

To retrieve the last login account data, the MS Graphs API requires you to assign it the `AuditLog.Read.All` API permission.

### Supported Operations

The connector retrieves last login information during the following operations:

- Account aggregation
- Get account

### Required Attributes

This feature requires the following login information:

> [!IMPORTANT]
>
> Important These attributes are not present by default and you must add them explicitly to the account schema, if required. To add these attributes to the account schema, use `signInActivity.<attribute_name>` format. For example, to use `lastSuccessfulSignInDateTime` from the managed system, add `signInActivity.lastSuccessfulSignInDateTime` to the account schema. For more information, refer to [Account Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/index.html#default-account-attributes>).

#### Attributes Related to Interactive Authentication Method

> [!NOTE]
>
> If you have an existing connector with attributes in your account schema named `lastSignInDateTime` and `lastNonInteractiveSignInDateTime`, the connector will still aggregate the values assigned to those attributes.

- `signInActivity.lastSignInDateTime`: To retrieve the last time a user logged into the directory with an interactive authentication method.
- `signInActivity.lastSignInRequestId`: To retrieve the request identifier of the last interactive sign-in performed by this user.

#### Attributes Related to Non-Interactive Authentication Method

- `signInActivity.lastNonInteractiveSignInDateTime`: To retrieve the last time a client signed in to the directory on behalf of a user.
- `signInActivity.lastNonInteractiveSignInRequestId`: To retrieve the request identifier of the last non-interactive sign-in performed by this user.

#### Other Supported Attributes

The following attributes are also supported along with the above listed attributes:

- `signInActivity.lastSuccessfulSignInDateTime`:To retrieve the date and time of the user’s most recent successful sign-in activity.
- `signInActivity.lastSuccessfulSignInRequestId`: To retrieve the request ID of the last successful sign-in.

## Azure Mail Contact Management

Mail contacts (also known as organizational contacts) are managed by an organization's administrators. Additionally, mail contacts are generally synchronized from Exchange Online. With this feature, the connector supports managing mail contacts as accounts.

### Supported Operations

The following operations are supported for Azure Mail Contact:

<table class="span-table"> <tr> <td>Operations</td> <td>Mail Contact</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="7">Yes</td> </tr> <tr> <td>Delta Aggregation</td> </tr> <tr> <td>Get Account</td> </tr> <tr> <td>Create</td> </tr> <tr> <td>Modify</td> </tr> <tr> <td>Delete</td> </tr> <tr> <td>Add/Remove Entitlements<br><ul><li>Add/Remove Mail Contacts from Distribution Groups/Lists</li></ul></td> </tr> </table>

### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregate Mail Contacts | `OrgContact.Read.All` |
| Fetch Group Membership | `GroupMember.Read.All` |
| Create, Update, Delete, and Add/Remove Entitlements | The user account must have the Exchange Administrator Role and the prerequisites mentioned in the [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/microsoft_365.html#exchange-online-management>). |

### Supported Schema Attributes

To aggregate mail contacts as accounts, ensure that the mail contact attributes are present in the account schema. For more information, refer to [Mail Contacts as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/directory_attributes.html#mail-contacts-as-accounts-attributes>).

### Supported Provisioning Attributes

To provision mail contacts related information, refer to [Create/Modify/Delete Mail Contact Profile Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/provisioning.html#createmodifydelete-mail-contact-profile-attributes>).

### Configure Mail Contacts As Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/mail_contacts_as_accounts.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/mail_contacts_as_accounts.png>)

1. Go to **Feature Management**.
2. If it is not already selected, select **Manage Exchange Online** to view the rest of the fields.
3. Select **Mail Contact Governance** to manage mail contacts as accounts.
4. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')`

## Service Plan Management (managing Licenses)

The Microsoft Entra ID SaaS connector supports assigning different Azure services licenses to the users. The connector uses individual plan to assign licenses. For the requirements and the group-based licensing considerations, refer to [Service Plan Management (managing Licenses)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#service-plan-management-managing-licenses>).

Service Plan now has separate group schema attributes. For a detailed list of the attributes, refer to [Service Plan](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/index.html#service-plan>).

The following operations are supported for the Service Plan object type:

- Aggregation
- View details of Service Plan (like object properties, members, and so on)
- Assign and Revoke access request for Service Plan (entitlement attribute: `assignedPlans`)

## Custom (extension) Attributes

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the extended attributes that are registered on the client application on Azure.

> [!NOTE]
>
> To update the custom attribute, the provisioning policy must be updated with the custom attribute name.

To aggregate custom attributes, you must update the schema for account or entitlement with the custom attribute names. The custom attribute name must match the custom attribute name on the managed Microsoft Entra ID system.

Use the following format for single-valued and multivalued string type custom attributes:

`extension_<clientID>_<CustomAttributeName>`

### Managing Complex Extension Attributes

To manage complex extension attributes, as shown below:

```text
"onPremisesExtensionAttributes": {
             "extensionAttribute1": "Value1",
             "extensionAttribute2": "Value2",
            "extensionAttribute3": "Value3",
            "extensionAttribute4": "Value4",
            "extensionAttribute5": "Value5",
            "extensionAttribute6": "Value6",
            "extensionAttribute7": "Value7",
            "extensionAttribute8": "Value8",
            "extensionAttribute9": "Value9",
            "extensionAttribute10": "Value10",
            "extensionAttribute11": "Value11",
            "extensionAttribute12": "Value12",
            "extensionAttribute13": "Value13",
            "extensionAttribute14": "Value14",
            "extensionAttribute15": "Value15"
```

Add these attributes in the **Account Schema** and **Create Account** sections in the SailPoint user interface. To add, use the following format:

> [!NOTE]
>
> Attributes are case sensitive.

`onPremisesExtensionAttributes_extensionAttribute1`

`onPremisesExtensionAttributes_extensionAttribute2`

`onPremisesExtensionAttributes_extensionAttribute3`

`onPremisesExtensionAttributes_extensionAttribute4`

`onPremisesExtensionAttributes_extensionAttribute5`

`onPremisesExtensionAttributes_extensionAttribute6`

`onPremisesExtensionAttributes_extensionAttribute7`

`onPremisesExtensionAttributes_extensionAttribute8`

`onPremisesExtensionAttributes_extensionAttribute9`

`onPremisesExtensionAttributes_extensionAttribute10`

`onPremisesExtensionAttributes_extensionAttribute11`

`onPremisesExtensionAttributes_extensionAttribute12`

`onPremisesExtensionAttributes_extensionAttribute13`

`onPremisesExtensionAttributes_extensionAttribute14`

`onPremisesExtensionAttributes_extensionAttribute15`

## Account - Group Management

The Microsoft Entra ID SaaS connector supports managing following group types as an entitlement and as separate group objects. These different types of groups are created for different purpose which are described as follows:

- Microsoft 365 groups (formerly Office 365 groups) are used for collaboration between internal and external users of the company.
- Distribution Lists (Distribution groups) are used for sending notifications to a group of people.
- Security groups are used for granting access to resources such as SharePoint sites.
- Mail-enabled security groups are used for granting access to resources such as SharePoint, and emailing notifications to those users.

The following table describes different conditions or configurations depending on which connector will aggregate different types of groups:

<table class="span-table"> <tr> <td>Group Types</td> <td>Default Aggregation</td> <td>Manage Office 365 checkbox selected in Feature Management</td> <td>Aggregate All Groups checkbox selected in Aggregation Settings</td> </tr> <tr> <td>Security</td> <td>Yes</td> <td>Yes</td> <td colspan="1" rowspan="4">Yes</td> </tr> <tr> <td>Mail-Enabled Security</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Office 365</td> <td>No</td> <td>Yes</td> </tr> <tr> <td>Distribution List</td> <td>No</td> <td>No</td> </tr> </table>

For more information on enabling Aggregate All Groups, refer to [Account - Group Management](<#account-group-management>).

For more information on enabling provisioning for Distribution Lists and Mail-Enabled Security Groups, refer to [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/microsoft_365.html#exchange-online-management>).

For more information on enabling Office 365 Groups, refer to [Feature Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/feature_management.html#feature-management>).

## Group Hierarchy Information

This feature shows read-only group hierarchy information. For more information on enabling this feature, refer to [Aggregation Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#aggregation-and-filter-settings>).

> [!NOTE]
>
> The group hierarchy calculation requires additional MS Graph API calls, so you may see an increase in aggregation time depending on the number of groups and the associated number of parent-child relations between them.

## Microsoft Entra Role Management

Microsoft Entra ID SaaS roles allow you to grant granular permissions to your admins, abiding by the principle of least privilege. Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, and applications.

Microsoft Entra supports two types of roles definitions:

- **Built-in roles** - Built-in roles are out of box roles that have a fixed set of permissions. These role definitions cannot be modified.
- **Custom roles** - To round off the edges and meet your sophisticated requirements, Microsoft Entra also supports custom roles.

Microsoft Entra roles object type supports the following operations:

- Aggregation of built-in and custom roles as separate group object
- Aggregation of user membership to roles during account aggregation
- Add / Remove built-in and custom roles to Microsoft Entra users

### Administrator Permissions

<table class="span-table"> <tr> <td>Permission</td> <td>Permission Type</td> <td>Purpose</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td colspan="1" rowspan="4">Application</td> <td>Add/Remove Roles for Accounts</td> </tr> <tr> <td>RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All</td> <td>Aggregate Roles</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Provisioning</td> </tr> <tr> <td>RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All</td> <td>Read Roles entitlement for Accounts</td> </tr> </table>

### Supported Schema Attributes

To manage the Microsoft Entra role objects, ensure that the attributes present in [Roles Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/directory_attributes.html#roles>) are present in the group schema.

## Administrative Units

An administrative unit is a Microsoft Entra resource that serves as a container for other Microsoft Entra resources. It can contain only users, groups, or devices. A user can be a member of multiple administrative units.

### Supported Operations

This feature supports the following operations:

- Manage administrative units as entitlements.
- Create a user with a single or multiple administrative units.
- Add/Remove administrative units from users.
- Delete administrative units from users.

### Administrator Permissions

To fetch administrative units details, the following API permissions must be assigned:

| Type | Permission | Purpose |
| --- | --- | --- |
| Application | AdministrativeUnit.Read.All | Aggregate Administrative Units |
| Application | AdministrativeUnit.ReadWrite.All | Add Users to Administrative Units |
| Application | AdministrativeUnit.ReadWrite.All | Delete Users from Administrative Units |

### Supported Schema Attributes

To manage the administrative units, ensure administrative units attributes are present in the group schema. For more information, refer to [Administrative Units Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/directory_attributes.html#administrative-units-attributes>).

### Configure Administrative Unit

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/admin_units.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/admin_units.png>)

1. Go to **Feature Management**.
2. Select **Manage Administrative Units** to manage administrative units.

## Access Package Management

An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization.

Microsoft Entra ID SaaS access package management can help you manage access to Groups &amp; Teams, Applications, and SharePoint Online sites as a bundle.

> [!IMPORTANT]
>
> To use entitlement management and assign users to access packages, you must have one of the following licenses:
>
> - Microsoft Entra ID P2 or Microsoft Entra ID Governance
> - Enterprise Mobility + Security (EMS) E5 license
>
> For more information, refer to [Access Package in Entitlement Management](<https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-reprocess-access-package-assignments>).

The following operations are supported for the Microsoft Entra ID SaaS access packages object type:

- Aggregation of custom access package objects (a combination of access package and policy) as a separate group type.
- Aggregation of user membership to access packages during account aggregation.
- Add and Remove access packages entitlements to users.

### Administrator Permissions

| Purpose | Permission Type | Permissions |
| --- | --- | --- |
| Aggregate Access Packages | Application | EntitlementManagement.Read.All |
| Read Access Packages entitlements for Accounts | Application |  |
| Add and Remove Access Packages for Accounts | Application | EntitlementManagement.ReadWrite.All |

For more information on the required permissions, refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>).

### Supported Schema Attributes

To manage the Microsoft Entra ID SaaS access package objects, ensure that the attributes in [Access Package Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/index.html#access-package-attributes>) are present in the group schema.

To aggregate access packages assigned to the user during account aggregation, ensure the `accessPackages` attribute is present in account schema. This attribute lists the access packages assigned to the user.

> [!NOTE]
>
> The Microsoft Entra ID SaaS connector provisions `accessPackage` entitlements only through admin context. Therefore, the approval settings configured in the assignment policy does not get triggered.

### Configure Access Packages in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/access_package_management.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/access_package_management.png>)

1. Go to Feature Management.
2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off.
3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal.
4. Select **Save**.

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

# Supported Features

The Microsoft Entra ID SaaS connector supports the following features:

Refer to the following pages for details on each feature:

- [Account, Group, and Role Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html>)
- [Security, Authentication, and Compliance](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html>)
- [Privileged Access and Azure Cloud Governance](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html>)
- [Microsoft 365 and Collaboration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/microsoft_365.html>)
- [Service Principals and Managed Identities](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html>)
- [Machine Identity Governance](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html>)

## Account and Identity Management

| Feature | Description |
| --- | --- |
| [Account Management for User, User in Federated Domain, Guest User (B2B), and External Member (B2B)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#account-management-for-user-user-in-federated-domain-guest-user-b2b-and-external-member-b2b>) | Aggregate, create, update, enable, disable, and delete accounts for standard users, federated domain users, B2B guest users and external members. |
| [Password Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#password-management>) | Change the password for a user of the source when Password Management is enabled for your organization. |
| [Account Management for Local User (B2C)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#account-management-for-local-user-b2c>) | Aggregate and manage lifecycle operations for local B2C user accounts. |
| [Revoke Session After Disabling User Account](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#revoke-session-after-disabling-user-account>) | Sign the user out of their existing sessions when their account is disabled, so access ends immediately instead of when their existing sessions expire. |
| [Service Principal Account Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html#service-principal-account-management>) | Aggregate and provision enterprise application service principals as accounts. |
| [Azure Mail Contact Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#azure-mail-contact-management>) | Aggregate Azure mail contacts as read-only accounts in SailPoint. |
| [Last Login for Accounts](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#last-login-for-accounts>) | Collect last sign-in timestamps for accounts during aggregation. |
| [Managed Identity Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html#managed-identity-management>) | Manage Azure managed identities, including [user-assigned](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html#user-assigned-managed-identities>) and [system-assigned](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html#system-assigned-managed-identities>) identities. |
| [Service Plan Management (Managing Licenses)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#service-plan-management-managing-licenses>) | Assign and remove Microsoft 365 and other service plan licenses for user accounts. |

## Group, Role, and Entitlement Management

| Feature | Description |
| --- | --- |
| [Account - Group Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#account-group-management>) | Aggregate Microsoft Entra groups and manage group membership for accounts. |
| [Group Hierarchy Information](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#group-hierarchy-information>) | Aggregate nested group relationships and hierarchy data. |
| [Microsoft Entra Role Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#microsoft-entra-role-management>) | Aggregate built-in and custom Microsoft Entra directory roles and manage role assignments. |
| [Administrative Units](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#administrative-units>) | Aggregate and manage administrative units and scoped role assignments. |
| [Access Package Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#access-package-management>) | Aggregate and manage Entitlement Management access packages and assignments. |
| [Custom Security Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#custom-security-attributes>) | Manage custom security attributes defined in Microsoft Entra ID. |
| [Custom (Extension) Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#custom-extension-attributes>) | Manage extended attributes registered on the Azure client application. |
| [Privilege Classification](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/identity_management.html#privilege-classification>) | Classify privileged access for Microsoft Entra entitlements in SailPoint. |

## Privileged Access and Azure Cloud Governance

| Feature | Description |
| --- | --- |
| [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-privileged-identity-management-pim>) | Manage Privileged Identity Management for Microsoft Entra roles ([Azure PIM](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-pim-for-roles>)) and groups, including eligible and active assignments ([Azure PIM Groups](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-pim-for-groups>)). |
| [Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>) | Aggregate Azure management groups, subscriptions, resource groups, and role assignments.<br>Important |
| [Azure Government Endpoint Configuration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-government-endpoint-configuration>) | Configure Azure Resource Manager endpoints for cloud object aggregation and governance. |

## Security, Authentication, and Compliance

| Feature | Description |
| --- | --- |
| [Multi-Factor Authentication (MFA) Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#multi-factor-authentication-mfa-management>) | Manage MFA attributes such as phone numbers, email addresses, and Microsoft Authenticator settings. |
| [OAuth 2.0 Authentication](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#oauth-20-authentication>) | Authenticate using OAuth 2.0 grant types supported by the connector (client credentials and refresh token). |
| [Continuous Access Evaluation](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#continuous-access-evaluation>) | Support continuous access evaluation for real-time access revocation scenarios. |
| [Risky User Alert Feature](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#risky-user-alert-feature>) | Surface risky user detections from Microsoft Entra ID Identity Protection. |
| [Risky Service Principal Alert Feature](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/workload_identities.html#risky-service-principal-alert-feature>) | Surface risky service principal detections for workload identities in your tenant. |
| [Activity Insights](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/security.html#activity-insights>) | Collect account activity data from Microsoft Entra ID for Activity Insights. |

## Microsoft 365 and Collaboration

| Feature | Description |
| --- | --- |
| [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/microsoft_365.html#exchange-online-management>) | Manage Exchange Online mailbox settings and attributes for Microsoft Entra user accounts. |
| [Microsoft Teams](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/microsoft_365.html#microsoft-teams>) | Aggregate and manage Microsoft Teams as entitlements. |
| [Channel Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/microsoft_365.html#channel-management>) | Aggregate and manage Microsoft Teams channels as entitlements. |

## Aggregation Performance

The Microsoft Entra ID SaaS connector includes built-in parallel aggregation. It uses paging and processes retrieved accounts in parallel to improve account aggregation performance. For more information, refer to [Aggregation and Filter Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#aggregation-and-filter-settings>).

## Non-Human Identity Discovery

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

<table> <thead> <tr> <th>Feature</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html">Machine Identity Governance</a></td> <td><ul><li>Govern non-human identities such as AI agents and service accounts within SailPoint.</li><li>Activate and deactivate governed agents in SailPoint.</li></ul></td> </tr> <tr> <td><a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html#azure-ai-foundry-agents-management">Azure AI Foundry Agents Management</a></td> <td><ul><li>Aggregate Microsoft Foundry agents, tools, and access relationships through dataset aggregation.</li><li>Activate and deactivate new Azure AI Foundry agents.</li></ul></td> </tr> <tr> <td><a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html#microsoft-copilot-studio-agents-management">Microsoft Copilot Studio Agents Management</a></td> <td><ul><li>Aggregate Copilot Studio agents, tools, knowledge bases, file attachments, connected agents, and access relationships.</li><li>Activate and deactivate Microsoft Copilot Studio agents.</li></ul></td> </tr> <tr> <td><a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/machine_identity_governance.html#microsoft-agent-365-catalog-management">Microsoft Agent 365 Catalog Management</a></td> <td><ul><li>Aggregate Microsoft 365 Agent Catalog packages and their service principal relationships.</li><li>Activate and deactivate Microsoft Agent 365 agents.</li></ul></td> </tr> <tr> <td>SailPoint Non-Human Identity (NHI) Discovery</td> <td>Discover Microsoft non-human identities and AI agents, including app registrations, SAML certificates, hybrid and cloud Entra users, Copilot chats, and secrets stored in Azure Key Vault. For more information, refer to <a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions">Additional Permissions for SailPoint NHI Discovery</a>.</td> </tr> <tr> <td>Exposed Secret Scanning</td> <td>Continuously scan Microsoft Teams, SharePoint, and OneDrive for exposed secrets.</td> </tr> <tr> <td>Service Principal Posture Analysis</td> <td>Detect posture issues and anomalous behavior in service principals.</td> </tr> </tbody> </table>

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

# Machine Identity Governance

SailPoint addresses Machine Identity Governance by integrating non-human identities such as service accounts and bots into its unified SailPoint platform. This approach eliminates security silos by managing human and machine identities under a single governance framework. This comprehensive approach ensures that machine identities maintain the principle of least privilege, reducing the attack surface and enhancing organizational compliance across complex hybrid and multi-cloud environments.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

Microsoft Entra ID SaaS connector supports the following AI agents management:

## Azure AI Foundry Agents Management

> [!IMPORTANT]
>
> Microsoft has deprecated Classic Azure AI Foundry agents. Because of this, the Microsoft Entra SaaS connector now supports discovery (aggregation) of New Azure AI Foundry agents only. It no longer aggregates Classic Azure AI Foundry agents.

Azure AI Foundry Agent Service enables you to create AI agents that automate tasks and workflows. This platform provides:

- A framework for building agents that reason, act, and learn
- Access to diverse models, knowledge sources, and tools
- Real-world interaction capabilities through search, action connectors, and code execution

Applications range from simple task automation to complex, multi-agent workflows. The platform offers a unified experience for developers and IT administrators through:

- A web portal
- Software Development Kit (SDK)
- Application Programming Interfaces (APIs)
- Use these tools to build, deploy, and manage your AI agents efficiently.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Supported Features

- Aggregation of classic Azure AI Foundry agents
- Aggregation of new Azure AI Foundry agents

  For more information, refer to [Azure AI Foundry Agents Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/machine_identity_attributes.html#azure-ai-foundry-agents-attributes>).
- Activate and deactivate new Azure AI Foundry agents

### Required Permissions

| API / Role | Permission / Role Name | Type | Description / Purpose |
| --- | --- | --- | --- |
| Microsoft Graph API | Application.Read.All<br>OR<br>Directory.Read.All | Application | Read application data<br>Read directory data |
| Azure Service Management API | user\_impersonation | Delegated | Access Azure Resource Manager as organization users |
| Azure RBAC Role on your subscription | Reader | Role-based | View all resources, but does not allow you to make any changes. |
| Azure RBAC Role on your subscription | Cognitive Services Data Contributor (Preview) | Role-based | Allows to call data plane APIs, but not any control plane APIs for Microsoft Cognitive Services. This role is in preview and subject to change. |

### Assigning Reader and Cognitive Services Data Contributor (preview) Role in Azure for Your Subscription:

Follow these steps to assign the Cognitive Services Data Contributor (Preview) Role in Azure for your subscription :

1. Go to Azure Portal.
2. Select your active **Azure Subscription** under **Use** option.
3. Go to **Access Control (IAM)** for the subscription.
4. Select **\+ Add \> Add role assignment**.
5. Assign the Reader role:

   1. Under **Role**, select **Reader**.
   2. In the **Members** section, search for and select your **Registered Application**.
   3. Select **Review + assign** to apply the role.
6. Assign the Cognitive Services Data Contributor (Preview) role:

   1. Under **Role**, select **Cognitive Services Data Contributor (Preview)**.
   2. In the **Members** section, find and select your **Registered Application**.
   3. Click on **Review + assign** to apply the role.

This grants the necessary permissions to your Registered Application for Cognitive Services data access.

> [!IMPORTANT]
>
> If you have multiple subscriptions in your Azure tenant, repeat the role assignment process for each subscription from which you want to manage resources (agents).

### Enabling Machine Identity Governance

To enable Azure AI Foundry aggregation, follow these steps:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/agent_governance.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/agent_governance.png>)

1. Go to Microsoft Entra ID SaaS source configuration page within SailPoint.
2. Select **Machine Identity Governance Settings** tab.
3. Select **Enable Azure AI Foundry Agents**. This enables Agent Governance support for your environment.
4. Select **Save**.

### Supported Resources

For more information, refer to [Microsoft Foundry Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-foundry-resources>).

## Microsoft Copilot Studio Agents Management

Microsoft Copilot Studio Agents are part of the Microsoft Power Platform ecosystem, rather than standalone Azure resources. They operate across three integrated layers:

- **Experience Layer (Copilot Studio)**: Where the agent is designed and managed.
- **Data Layer (Dataverse)**: Where the agent's configuration and metadata are stored.
- **Identity Layer (Azure AD/Entra ID)**: Where the agent's identity is managed for secure authentication and service access.

Every Copilot belongs to a Power Platform environment. The environment determines where to store the agent and which Dataverse database belongs to that environment.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Supported Features

- Aggregation of Microsoft Copilot Studio agents
- Activate and deactivate Microsoft Copilot Studio agents

### Prerequisites

Make sure the service principal configured on the SailPoint platform for Microsoft Entra ID SaaS connector is added as an application user in every Power Platform environment where you want to manage Microsoft Copilot Studio agents.

Steps to add the service principal as an application user Power Platform Admin Center:

1. Sign in to the Power Platform Admin Center.
2. Go to **Manage**.
3. Select the environment.
4. Go to **Settings \> Users + permissions \> Application users**.
5. Select **New app user \> Add an app**.
6. Select the service principal used by the Entra ID SaaS connector, then select **Add**.

### Required Permissions

Copilot agents reside within Power Platform environments, and their metadata is stored in Dataverse. Consequently, your user account must have specific permissions within the Power Platform Admin Center to view or manage these agents.

#### Required Security Roles

| PI / Role | Permission / Role Name | Type | Description / Purpose |
| --- | --- | --- | --- |
| Security Role | Global Discovery Service Role | Role-based | Lets the app call the Global Discovery API and get the list of instances. |
| Custom Security Role | BotReader (custom role: Read = Organization on bot + botcomponent) | Role-based | Lets the app call the bots API and read agent metadata and components. |

#### Required Dataverse Privileges

To activate or deactivate Copilot Studio agents, the SailPoint application user in Power Platform requires the Write privilege on the Bot (Agent) and Bot Component tables in Dataverse, in addition to the read privileges required for aggregation.

<table class="span-table"> <tr> <td>Privilege</td> <td>Dataverse Table</td> <td>Level</td> <td>Required For</td> </tr> <tr> <td>Read (<code>prvReadbot</code>)</td> <td>Bot / Agent</td> <td colspan="1" rowspan="4">Organization</td> <td>Aggregation (read agents)</td> </tr> <tr> <td>Write (<code>prvWritebot</code>)</td> <td>Bot / Agent</td> <td>Activate and deactivate agents</td> </tr> <tr> <td>Read (<code>prvReadbotcomponent</code>)</td> <td>Bot Component</td> <td>Aggregation (read components)</td> </tr> <tr> <td>Write (<code>prvWritebotcomponent</code>)</td> <td>Bot Component</td> <td>Enable and disable agents</td> </tr> </table>

**Steps to configure these privileges in the Power Platform Admin Center:**

1. Sign in to the [Power Platform Admin Center](<https://admin.powerplatform.microsoft.com/>).
2. Select your environment and go to **Settings \> Users + Permissions \> Security Roles**.
3. Open the **BotReader** security role assigned to the SailPoint application user. If this role doesn't exist, create it.
4. On the Custom Tables tab, find the Agent (`bot`) and Agent Component (`botcomponent`) tables.
5. Set the Write column to Organization level for both tables.
6. Select **Save**.
7. Go to **Application Users**, select the SailPoint app, select **Manage Security Roles**, and confirm the updated role is assigned.

### Enabling Machine Identity Governance

To enable Copilot Studio agents aggregation, follow these steps:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/copilot_agent.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/copilot_agent.png>)

1. Go to Microsoft Entra ID SaaS source configuration page within SailPoint.
2. Select **Machine Identity Governance Settings** tab.
3. Select **Enable Microsoft Copilot Studio Agents**. This enables Copilot agent aggregation in your environment.
4. Select **Save**.

### Supported Resources

For more information, refer to [Microsoft Copilot Studio Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-resources>).

## Microsoft Agent 365 Catalog Management

Microsoft Agent 365 provides a unified catalog of Microsoft 365 Copilot agents across multiple platforms. The Microsoft Entra ID SaaS connector aggregates catalog packages from this catalog as machine identities through the Microsoft Agent 365 dataset.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Supported Features

- Aggregation of Microsoft Agent 365 catalog packages
- Activate and deactivate (enable and disable) catalog packages for Azure AI Foundry, Microsoft 365 Copilot Agent Builder platforms, and other platforms

  > **Note**
  >
  > Copilot Studio agents appear in the Microsoft Agent 365 catalog for visibility, but block and unblock operations are not supported for Copilot Studio catalog packages. To manage Copilot Studio agents, select **Enable Microsoft Copilot Studio Agents** instead. For more information, refer to [Microsoft Copilot Studio Agents Management](<#microsoft-copilot-studio-agents-management>).

### Prerequisites

- To enable Microsoft Agent 365 requires a Microsoft Agent 365 tenant license.
- The Microsoft Agent 365 catalog configuration requires a refresh token grant type. Provide a refresh token with the required permissions to aggregate and manage Microsoft Agent 365 agents.

  > **Note**
  >
  > Note Configure the refresh token based on your source [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#connection-settings>):
  >
  > - If source connection settings uses the Refresh Token grant type - No action needed. The connector automatically uses the refresh token from your main connection settings.
  > - If source connection settings uses the Client Credentials grant type - You must generate a separate refresh token and enter it in the **Refresh Token** field under **Machine Identity Governance Settings**.

  For more information, refer to [Generating a Refresh Token](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#generating-a-refresh-token>).

### Required Permissions

The Microsoft Graph API requires delegated permissions and a refresh token to aggregate and manage Microsoft Agent 365 catalog packages. In your Microsoft Entra app registration, add the following delegated API permissions:

| API | Permission | Type | Description / Purpose |
| --- | --- | --- | --- |
| Microsoft Graph | CopilotPackages.ReadWrite.All | Delegated | Aggregate and manage (block and unblock) Microsoft Agent 365 catalog packages. Admin consent is required. |
| Microsoft Graph | offline\_access | Delegated | Issues a refresh token for persistent access. |
| Microsoft Graph | User.Read | Delegated | Required for the sign-in flow to obtain the initial refresh token. |

> [!IMPORTANT]
>
> Grant admin consent for `CopilotPackages.ReadWrite.All` before configuring Microsoft Agent 365 in the source.

### Enabling Machine Identity Governance

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/microsoft_agent_365_catalog.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/microsoft_agent_365_catalog.png>)

1. In SailPoint, go to your Microsoft Entra ID SaaS source configuration page.
2. Select the **Machine Identity Governance Settings** tab.
3. Select **Enable Microsoft Agent 365** if your tenant is licensed for Microsoft Agent 365. When enabled, all platform checkboxes below are checked by default, and the connector aggregates packages from every platform:

   - Manage Azure AI Foundry Agents
   - Manage Microsoft Copilot Studio Agents
   - Manage Microsoft 365 Copilot Agents
   - Manage Other Platform Agents

   Clear any checkbox to stop aggregating packages from that platform.
4. (Optional) If your source uses the Client Credentials grant type, enter a separately generated refresh token in the **Refresh Token** field.
5. Select **Save**.

> [!NOTE]
>
> - If the platform checkboxes appear unchecked on an existing source, follow these steps to reset them:
>
>   1. Turn off **Enable Microsoft Agent 365** and select **Save**.
>   2. Turn it back on and select **Save** again.
>
>   This resets all platform checkboxes to their default (checked) state.
> - If you do not have an Microsoft Agent 365 tenant license, choose one of these options based on what you use:
>
>   - Enable Azure AI Foundry Agents. For more information, refer to [Azure AI Foundry Agents Management](<#azure-ai-foundry-agents-management>)
>   - Enable Microsoft Copilot Studio Agents. For more information, refer to [Azure AI Foundry Agents Management](<#azure-ai-foundry-agents-management>) and [Microsoft Copilot Studio Agents Management](<#microsoft-copilot-studio-agents-management>).

### Supported Resources

For more information, refer to [Microsoft Agent 365 Catalog Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-agent-365-catalog-resources>).

# Microsoft 365 and Collaboration

## Exchange Online Management

Microsoft Entra can be used to manage Exchange online mailboxes, distribution lists, and mail-enabled security groups. The Microsoft Entra ID SaaS connector uses Exchange Online PowerShell Module to support this feature.

Exchange Online Management supports the following operations:

- Aggregation of Exchange Online Mailbox attributes for users
- Aggregation of Shared Mailbox as an entitlement for users
- Aggregation of Exchange Online attributes for groups
- Modification of Exchange Online Mailbox attributes
- Adding and Removing Shared Mailboxes from users
- Adding and Removing Exchange Distribution Lists and Mail-Enabled Security groups from users

> [!NOTE]
>
> The Exchange Online attributes and Shared Mailbox can be aggregated only during a full aggregation. If you want to aggregate both of them during update operation and delta aggregation, ensure to add the entry `performGetObjectForEXOAttributes` in the source XML.

<table class="span-table"> <tr> <td>Objects/Attributes</td> <td>Aggregation</td> <td>Modification</td> <td>Add/Remove User</td> </tr> <tr> <td>Exchange Online Mailbox attributes for users</td> <td colspan="1" rowspan="5">Yes</td> <td>Yes</td> <td>N/A</td> </tr> <tr> <td>Shared Mailbox as an entitlement for users</td> <td>N/A</td> <td>Yes</td> </tr> <tr> <td>Exchange Online attributes for groups</td> <td>N/A</td> <td>N/A</td> </tr> <tr> <td>Distribution List</td> <td>N/A</td> <td>Yes</td> </tr> <tr> <td>Mail-Enabled Security Group</td> <td>N/A</td> <td>Yes</td> </tr> </table>

### Basic Authentication

> [!IMPORTANT]
>
> - Basic authentication in Exchange Online is deprecated by Microsoft. For more information, refer to [deprecation of basic authentication in Exchange Online](<https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online>) in Microsoft documentation.
> - It is recommended to utilize [Certificate Based Authentication](<#exchange-online-management>) for Exchange Online management.

1. Create a user in Microsoft Entra ID with the Exchange Administrator role.
2. Select **Manage Exchange Online** on Application Configuration page.
3. Provide the username and password of the user you created.

> [!NOTE]
>
> The connector uses PowerShell sessions to manage Exchange Online Mailboxes. Due to restrictions on the number of concurrent PowerShell sessions allowed by Microsoft, there may be a delay or occasional failures when the connector processes Exchange Online requests.

### Certificate Based Authentication

- The following additional API permission needs to be added to the already registered Microsoft Entra ID Enterprise Application. Refer to the [Prerequisites](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#prerequisites>) section regarding application registration and [API permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>), if necessary.

  - Permission `Exchange.ManageAsApp`, for Office 365 Exchange Online
  - The steps to assign API permissions to an application are listed here: [Assign API permissions to the application.](<https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-2-assign-api-permissions-to-the-application>)
- Assign the following roles to the application:

  - Exchange Administrator
  - The steps to assign roles to an application are listed here: [Assign Microsoft Entra roles to the application.](<https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-5-assign-azure-ad-roles-to-the-application>)
- To ensure modern authentication:

  - A certificate key-pair needs to be generated on any host machine. This will be used by the Exchange PowerShell module to connect to the Exchange Online.
  - The certificate must be uploaded to the registered Microsoft Entra ID Enterprise Application under Certificates and Secrets.
- The steps to generate a self-signed certificate are listed here:

  1. Generate the .cer and .pfx files using either of the below mentioned process.

     > **Note**
     >
     > Please save the password used for generating the .pfx file, as this will be required later at Step 3.

     - [Generate a self-signed certificate](<https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-3-generate-a-self-signed-certificate>). Or,
     - Generate a self-signed certificate using OpenSSL.

       > **Note**
       >
       > Make use of latest OpenSSL version on the system, Recommended version is OpenSSL 3.1.2.x onwards.

       - Using OpenSSL with a password-protected private key from the PowerShell admin console, enter the following command:

         ```text
         openssl req -newkey rsa:2048 -x509 -keyout privateKey.key -out public-certificate.pem -days 3650
         ```
       - Convert the above key pair to the .pfx file using the following command:

         ```text
         openssl pkcs12 -export -out certificateEntra.pfx -inkey privateKey.key -in public-certificate.pem
         ```
  2. Convert the .pfx file to base64 encoded string.

     - Get the .pfx file content by using the following command:

       ```text
       $pfx_cert = Get-Content '<path of the .pfx file>' -Encoding Byte
       ```

       For example-

       ```text
       $pfx_cert = get-content "C:\Harshal-WorkSpace\mycert.pfx" -Encoding byte
       ```
     - Convert the .pfx file content to base64 by using the following command:

       ```text
       $base64 = [System.Convert]::ToBase64String($pfx_cert)
       ```
     - Export the base64 content to a text file by using the following command:

       ```text
       Add-Content "<path to the txt file to store the content>" $base64
       ```

       For Example-

       ```text
       Add-Content "C:\Harshal-WorkSpace\outputFileBytesBase64.txt" $base64
       ```
  3. Upload the credentials

     - Upload the .cer certificate created at Step 1 on the Microsoft EntraID portal.
     - Enter the results of the base64 certificate content from generated text file in Step 2 in the SailPoint Microsoft Entra source UI Exchange Certificate field.
     - Enter the private key password (provided while generating the self-signed certificate) in Microsoft Entrust Source UI Exchange Private Key Password field.
- The steps to attach the self-signed certificate to the Microsoft Entra application are listed here:

  - [Attach the certificate to the Microsoft Entra application](<https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-4-attach-the-certificate-to-the-azure-ad-application>)

### Schema Configurations

You must add Exchange attributes that you want to aggregate to the account or group scheme with the prefix **EXO\_**.

For example, to aggregate `EmailAddresses` attribute, add it to the schema as follows:

- Name: EXO\_EmailAddresses
- Type: String
- Property: Multivalued
- To aggregate shared mailbox attributes as an Entitlement, add `sharedMailbox` as an account attribute.
- Example Name: `sharedMailbox`
- Type: String
- Property: Multivalued, Entitlement, Managed

### Aggregate Exchange Online Groups

By default, the Microsoft Entra ID SaaS connector aggregates Mail-Enabled Security groups. To aggregate Distribution List groups, on the **Aggregation Settings** page, enable the `Aggregate All Groups` configuration parameter.

> [!NOTE]
>
> Aggregation of Distribution List group with basic group details does not need Exchange Online configuration.

### Add/Remove Exchange Distribution Groups from Users

When adding a user to, or removing a user from, a Mail-Enabled Security group, the user configured in the Manage Exchange Online configuration must be the owner of the group. The Distribution does not have the same restriction, but SailPoint recommends that the user in the Manage Exchange Online configuration is the owner of the group.

### Provisioning Policy Changes

To update the Exchange Mailbox attribute value, the attribute must be added to provisioning policy with the prefix **EXO\_**.

For example, to update the `Alias` attribute, it must be added in provisioning policy as follows:

- Name: EXO\_EmailAddresses
- Type: String
- Type Setting: Multivalued: true, Review Required: true

> [!NOTE]
>
> - It is important to add with proper attribute type and property, which meets exchange attribute definition for successful update operation.
> - Attributes to be added in provisioning policy must be present in account schema.

### Shared Mailbox As Entitlement

> [!NOTE]
>
> `sharedMailbox` is fetched only during account aggregation when the promote managed attribute is true by default in SailPoint. All `sharedMailbox` that are assigned to users are aggregated during account aggregation as entitlements. Unassigned `sharedMailbox` on the Microsoft side are not aggregated. There is no support of entitlement aggregation for sharedMailbox.

An Exchange user can be a member of a Shared Mailbox. Along with membership, the user obtains permission on the mailbox. This permission has to be selected while adding the user to the shared mailbox. The following permissions are categorized as Recipient and Mailbox:

- Recipient: SendAs
- Mailbox: ChangeOwner, ChangePermission, DeleteItem, ExternalAccount, FullAccess, ReadPermission

In order to provide flexibility to select the permission to be assigned, mailbox entitlements are created one per permission per mailbox as shown in the following example:

`User Mark Taylor has SendAs, FullAccess and ReadPermission permissions on shared mailbox called O365Support. After account aggregation following entitlements would be created:`

`O365Support: SendAs`

`O365Support: FullAccess`

`O365Support: ReadPermission`

## Microsoft Teams

Microsoft Teams, also referred to simply as Teams, is a unified communication and collaboration platform that combines persistent workplace chat, video meetings, file storage (including collaboration on files), and application integration.

Teams are built on the top Microsoft 365 groups. The Microsoft 365 group forms the directory object representing Teams. All identity and access controls for Teams are performed on the Microsoft 365 group. Because the Microsoft Entra ID connector deals with directory objects, Microsoft Teams are represented as part of Microsoft 365 Groups.

As Microsoft Entra ID connector deals with directory objects, Microsoft Teams are represented as Microsoft 365 Groups.

On the **Feature Management** page, the **Manage Microsoft 365 Groups** checkbox must be selected as it is aggregated as Microsoft 365 Group.

| Attribute Name | Action | Group Schema |
| --- | --- | --- |
| teamsEnabled | Distinguish Teams group | Type: Boolean |
| Owners | NA | Property: Multi-Valued<br>Data Type: string<br>Description: Owners of the group |

## Channel Management

Microsoft Teams, also referred to as Teams, is a unified communication and collaboration platform that combines persistent workplace chat, video meetings, file storage (including collaboration on files), and application integration.

Channels are dedicated sections within a team to keep conversations organized as per organization requirements.

Basic criteria for any user to be able to be part of the channel is to be part of the team. If the user is not part of the team, then they cannot be added to the channel. Access to the channel varies based on the type of channel:

- **Standard Channel**: By default, any user who is member of the Team gets membership to the standard channel.
- **Private Channel**: Owner/ Admin of the channel needs to add the team member to the channel. By default, the channel is not accessible to anyone other than the owner/ admin.

Addition of a user to the team gives access to the standard channel, and removal of a user from the team leads to automatic removal from all channels including private channels to which user has access to.

This feature provides support for the following operations:

- Aggregation of channels as separate group object.
- Aggregation of user membership to channels.
- Add or remove users from private channels.

> [!NOTE]
>
> - Before enabling Teams Governance, ensure that Manage Microsoft 365 Groups is enabled.
> - Enabling the Teams Governance feature can have impact on aggregation performance due to API limitations to fetch channel memberships.

### Administrator Permissions

| Permission | Permission Type | Purpose |
| --- | --- | --- |
| Channel.ReadBasic.All | Application | Aggregate Channels |
| ChannelMember.ReadWrite.All | Application | Add or Remove Channel Members |
| ChannelMember.ReadWrite.All | Delegated | Add or Remove Channel Members |

### Supported Schema Attributes

To manage the channel management objects, ensure that the attributes present in [Channel Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/directory_attributes.html#channel-attributes>) are present in the group schema.

# Security, Authentication, and Compliance

## Multi-Factor Authentication (MFA) Management

Microsoft Entra Multi-Factor Authentication (MFA) adds additional security over only using a password when a user signs in. The user can be prompted for additional forms of authentication, such as to respond to a push notification, enter a code from a software or hardware token, or respond to an SMS or phone call.

The Microsoft Entra ID SaaS connector supports the MFA Attribute Management, which can help you manage MFA related information required for authentication, such as mobile numbers, alternate mobile numbers, office phone numbers, email addresses, and the Microsoft authenticator app.

The following operations are supported for Multi-Factor Authentication Management:

- Aggregate MFA related information for the user (applicable for all authentication methods).
- For the Phone and Email authentication methods you can add, update, and remove MFA related information.
- For other authentication methods (for example, Microsoft Authenticator or Fido2) you can remove MFA related information.

### Administrator Permissions

| Purpose | Permission Type | Permissions |
| --- | --- | --- |
| Aggregate MFA Related Information for the User | Application | UserAuthenticationMethod.Read.All |
| Add, Update, and Remove MFA Related Information for the User | Application | UserAuthenticationMethod.ReadWrite.All |

### Supported Schema Attributes

To aggregate MFA related information for the user during account aggregation, ensure that the MFA attributes are present in the account schema. For more information, refer to [Multi-Factor Authentication (MFA) Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/index.html#multi-factor-authentication-mfa-attributes>).

> [!NOTE]
>
> When retrieving MFA information, the API is called concurrently per user, which may trigger "429 Too Many Requests" errors. To prevent this, add the following entry to your source XML to restrict multi-threading:
>
> `<entry key="max-thread-mfa-attributes" value="1"/>`

## OAuth 2.0 Authentication

The Microsoft Entra ID SaaS connector supports OAuth2.0 authentication with the following grant types:

- Client Credentials
- Refresh Token/Auth Code
- JWT Certificate Credentials

### Client Credentials

The default grant type is client credentials-based authentication. This grant type requires the following:

- Obtain your Client ID and Client Secret from Microsoft Entra by registering the application.
- Assign the required Microsoft Graph API permission to the application. For more information, refer to Microsoft Graph API.
- The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Microsoft Entra must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.
- Assign the required permissions to the application:

  | Permission | Type | Purpose |
  | --- | --- | --- |
  | Directory.ReadWrite.All | Application | Read, Update, Delete Group, and Add Membership<br>Read, Update, Change Password, and Delete User |
  | User.Invite.All | Application | Invite B2B Users |

### Refresh Token/Auth Code or JWT Certificate Credentials

- **Refresh Token/Auth Code**: Refresh Token/Auth Code grant type is a client credentials-based authentication protocol. In addition to client credentials, it uses a Refresh Token to perform authentication.
- **JWT Certificate Credentials**: JWT Certificate Credentials supports Authentication based on JWT assertion prepared from Certificate and private key.

For the Refresh Token/Auth Code or JWT Certificate Credentials grant type client credentials-based authentication, the following are the required configurations:

- Obtain your Client ID and Client Secret from Microsoft Entra by registering the application.
- Assign the required Microsoft Graph API permission to application. For more information, refer to Microsoft Graph API.
- The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.

  | Permission | Type | Purpose |
  | --- | --- | --- |
  | Directory.ReadWrite.All | Delegated | Read, Update, Delete Group, and Add Membership<br>Read User and Update User |
  | User.Invite.All | Delegated | Invite B2B Users |
  | Directory.AccessAsUser.All | Delegated | Change Password, and Delete User |

  > **Note**
  >
  > Assign granular level application permission for each operation if you do not want to assign full directory level permission.
- (*For Refresh Token/Auth Code only*) Generate a Refresh Token. For more information, refer to Generating Refresh Token.
- (*For JWT Certificate Credentials only*) The Certificate (self-signed or CA signed) must be uploaded. It must be of type X.509 Certificate and the Private Key must be encrypted with RSA and registered at the Microsoft Entra portal. Perform the following steps to register the certificate with the Microsoft identity platform:

  For the full procedure, including the OpenSSL commands, refer to [Creating OAuth 2.0 JWT Certificate Credentials](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#creating-oauth-20-jwt-certificate-credentials>).

  1. Log in to Microsoft Entra Portal.
  2. In the Entra app registrations for client application, select the client application.
  3. Select **Certificates &amp; secrets**.
  4. Select the **Upload certificate** and select the certificate file that is to be uploaded.
  5. Select **Add**.
  6. Obtain values for the following configurations:

     - **Private Key**: Obtain the private key text file.
     - **Private Key Password**
     - **Certificate**: Obtain the text file of the same certificate which was uploaded on the Microsoft Entra portal.

## Continuous Access Evaluation

Continuous access evaluation enables the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

When this feature is enabled on this connector, any long running operations, such as account aggregation, fail if a Continuous Access Evaluation (CAE) event (for example, a service principal disable or delete event) is triggered for the configured service principal during that operation.

To configure this feature:

1. Go to **Connection Settings**.
2. Select the **Use Continuous Access Evaluation** checkbox.
3. Select **Save**.

## Risky User Alert Feature

With the security reports in Microsoft Entra, you can gauge the probability of compromised user accounts in your environment. A user flagged for risk is an indicator for a user account that might have been compromised. The risky user represents the probability that a given identity or account is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources.

This feature supports the following operations:

- Account Aggregation
- Get Object

> [!NOTE]
>
> By default, this feature is not enabled for new connectors. If your Microsoft Entra instance requires support of the Risky User Alert feature, you must enable the feature by adding attributes to the account schema.

### Prerequisite

The tenant must have a Microsoft Entra P2 license.

### Administrator Permissions

To fetch risky user details using MS Graph APIs, the following API permissions must be assigned:

| OAuth2.0 Authentication | Type | Permission | Purpose |
| --- | --- | --- | --- |
| Client Credentials | Application | IdentityRiskEvent.Read.All<br>IdentityRiskyUser.Read.All | Aggregate or Get Risky user related information |
| Refresh Token / AuthCode<br>JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All<br>IdentityRiskyUser.Read.All | Aggregate or Get Risky user related information |

### Supported Schema Attributes

To manage the risky user alert feature, ensure that the following attributes are present in the account schema

> [!NOTE]
>
> The Account schema cannot be extended for other risk related attributes.

#### Risky User Alert Supported Attributes

| Attribute Name | Description |
| --- | --- |
| riskLevel | Level of the detected risky user. |
| riskState | State of the user's risk. |
| riskDetail | Details of the detected risk. |
| riskLastUpdatedDateTime | The date and time that the risky user was last updated. |

## Activity Insights

Activity Insights supports activity from Microsoft Entra ID SaaS and its associated accounts. This allows you to gather account information and activity data from Microsoft Entra ID.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](<https://documentation.sailpoint.com/saas/help/ai/activity_insights/index.html>).

### Prerequisites

You must have an Microsoft Entra P1/P2 license to use this feature.

### Required Permissions

To apply specific permissions correctly, you must select the appropriate grant types.

- For Application Permissions

  Select the Client Credentials and JWT Certificate Credentials grant types.
- For Delegated Permissions

  Select the Refresh Token grant type.

  > **Note**
  >
  > These scopes must be granted as delegated and require administrator consent.

Refer to the following table for a complete list of the required permissions that must be assigned to the administrator.

<table class="span-table"> <tr> <td>Permission</td> <td>Type</td> <td>Purpose</td> </tr> <tr> <td>User.Read.All</td> <td colspan="1" rowspan="4">Application/ Delegated</td> <td>/users<br>Allows the app to read all users' full profiles in Microsoft Entra ID, including display name, email, UPN, and assigned licenses</td> </tr> <tr> <td>LicenseAssignment.Read.All (or Organization.Read.All / Directory.Read.All)</td> <td>/subscribedSkus<br>Allows the app to read all license assignment information including subscribed SKUs and service plan details</td> </tr> <tr> <td>AuditLog.Read.All</td> <td>/auditLogs/signIns<br>Allows the app to read all audit log data, including sign-in logs for interactive, non-interactive, service principal, and managed identity sign-ins</td> </tr> <tr> <td>Application.Read.All</td> <td>/servicePrincipals<br>Allows the app to read all application registrations and service principals, including their role assignments and group memberships</td> </tr> </table>

### Configure Activity Insights

To configure Activity Insights, refer to [Activity Insights Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#activity-insights-settings>).

## Custom Security Attributes

Custom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources. For more information, refer to [Custom security attributes in Microsoft Entra](<https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview>).

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the custom security attributes that are defined in Azure. Creation of local user (B2C) also supports custom attributes.

### Supported Operations

- Aggregation of assigned custom security attributes for MS Entra ID users.
- Aggregation of assigned custom security attributes for Service Principals.
- Aggregation of assigned custom security attributes for User-Assigned Managed Identities.
- Aggregation of assigned custom security attributes for System-Assigned Managed Identities.
- Assign, update, remove, and delete custom security attributes for MS Entra ID users.
- Assign, update, remove, and delete custom security attributes for MS Entra Service Principals and Managed Identities.

> [!NOTE]
>
> The connector only aggregate (read-only) Custom Security Attribute values for service principals or managed identities. Provisioning is supported only for MS Entra ID users and MS Entra Service Principals.

### Required Permissions

Assign below permissions to the Microsoft Entra ID source to manage custom security attributes:

| Purpose | Permissions |
| --- | --- |
| To aggregate assigned custom security attributes | Attribute Assignment Reader |
| To assign, update, delete, and remove custom security attributes | Attribute Assignment Administrator |

### Adding Custom Security Attributes

To aggregate custom security attributes, you must update the Account Schema with the custom attribute names. Ensure the custom security attribute name matches the Attribute set and Attribute name defined on the Microsoft Entra ID system. Refer to the following table to define the attributes in the Account Schema:

| Attribute Type | Example | Custom Attribute Format |
| --- | --- | --- |
| Single-valued and Multivalued | \- | `customSecurityAttributes_<Attribute set name>_<Attribute name >` |
| Multiple Attribute Sets | Attribute 1:<br>Attribute set = Engineering<br>Attribute = Project<br>Attribute data type = Collection of Strings<br>Attribute value = \["Baker","Cascade"\] | `customSecurityAttributes_Engineering_Project (Data Type – String, isMulti - True)` |
| Multiple Attribute Sets | Attribute 2:<br>Attribute set = Engineering<br>Attribute = ProjectDate<br>Attribute data type = String<br>Attribute value = "2022-10-01" | `customSecurityAttributes_Engineering_ProjectDate (Data Type – String)` |
| Multiple Attribute Sets | Attribute 3:<br>Attribute set = Marketing<br>Attribute = EmployeeId<br>Attribute data type = String<br>Attribute value = "QN26904" | `customSecurityAttributes_Marketing_EmployeeId (Data Type – String)` |

### Managing Custom Security Attributes

To manage the assignments (such as assigning, updating, and removing custom security attributes for MS Entra ID Users) in addition to adding attributes in Account Schema, you need to also add the attributes in a similar format to Create Account section within the SailPoint user interface.

The following table lists the appropriate options to manage identities.

To manage identities, go to **Feature Management \> Managed Identities Settings**. From there, enable the appropriate option.

| Identity Type | Setting to Enable |
| --- | --- |
| User-Assigned Managed Identities | Manage User-Assigned Managed Identities as Accounts |
| System-Assigned Managed Identities | Manage System-Assigned Managed Identities as Accounts |
| Microsoft Entra Service Principals | Manage Microsoft Entra Service Principals as Accounts |

> [!NOTE]
>
> Ensure to select the **Aggregate Custom Security Attributes** checkbox to aggregate custom attributes for these identities, when required.

# Service Principals and Managed Identities

## Service Principal Account Management

To access resources that are secured by the Microsoft Entra tenant, the entity that requires access must be represented by a security principal. This requirement is true for both users (user principal) and applications (service principal). The security principal defines the access policy and permissions for the user/ application in the Microsoft Entra tenant. With this feature, the connector supports managing such service principals for enterprise applications as accounts.

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.

> [!NOTE]
>
> To gauge the probability of compromised service principals (workload identities) accounts in your environment. Refer to [Risky Service Principal Alert Feature](<#risky-service-principal-alert-feature>) for more information.

### Supported Operations

The following operations are supported for the azure service principal:

<table class="span-table"> <tr> <td>Operations</td> <td>Service Principal</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="6">Yes</td> </tr> <tr> <td>Get Account</td> </tr> <tr> <td>Create</td> </tr> <tr> <td>Update</td> </tr> <tr> <td>Enable and Disable Users</td> </tr> <tr> <td>Add and Remove Entitlements<br><ul><li>Add and Remove Roles</li><li>Add and Remove User's Group Membership</li><li>Add and Remove Application Role Memberships (<code>appRoleAssignments</code>)</li><li>Add and Remove RBAC Role Memberships (<code>azureRoleAssignments</code>)<br>Note <br>For more details and the required prerequisites, refer to <a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management">Group Management for Azure Cloud Objects</a>.</li><li>Add and Remove Admin Consented Delegated Permissions (<code>spn_adminConsentedPermissions</code>)</li><li>Remove User Consented Delegated Permissions (<code>spn_userConsentedPermissions</code>)</li></ul></td> </tr> </table>

### Administrator Permissions

| Purpose | Type | Permissions |
| --- | --- | --- |
| Aggregation of Service Principals | Application | Application.Read.All |
| Create and Update Service Principals | Application | Application.ReadWrite.All |
| Add and Remove Owners | Application | Application.ReadWrite.OwnedBy |
| Add and Remove Application Roles for Service Principals | Application | AppRoleAssignment.ReadWrite.All |
| Aggregation of Application Roles | Application | Application.Read.All |
| Aggregation and Add/Remove Microsoft Entra ID Group and Roles for Service Principals |  | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Service Principals |  | Refer to [Group Attributes for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/pim_cloud_objects.html#group-attributes-for-azure-cloud-objects>). |
| Aggregation of Admin/User Consented Permissions for Service Principals | Application | DelegatedPermissionGrant.Read.All |
| Add/Remove Admin Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All |
| Remove User Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All |

### Supported Schema Attributes

To aggregate service principal related information for the user during account aggregation, ensure that the service principal attributes are present in the account schema. For more information, refer to [Service Principal as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>).

### Supported Provisioning Attributes

To provision service principal related information, ensure that the attributes in [Account Profile for Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/azure_policies.html#account-profile-for-service-principal>) are present in your provisioning policy.

### Configure Microsoft Entra Service Principals As Accounts in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/feat_man.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/feat_man.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list.
3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'`

   > **Note**
   >
   > Advanced queries are not supported.

   Example filters:

   - For a filter to match the Enterprise Application default view on the Azure portal use the following:

     `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')`
4. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal.
5. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal.
6. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra ID Group memberships for Service Principal.
7. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals.
8. Select **the Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals.

   > **Note**
   >
   > This is for delegated permissions.
9. Select **Save**.

### Risky Service Principal Alert Feature

With the security reports in Microsoft Entra, you can gauge the probability of compromised service principals (workload identities) accounts in your environment. A service principal flagged for risk is an indicator of a service principal account that might have been compromised. The risky service principal represents the probability that a given service principal (workload identity) is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources.

> [!NOTE]
>
> - Before utilizing Risky Service Principal Alert feature, ensure that Service Principals are configured as accounts in the source. For more information, refer to [Service Principal Account Management](<#service-principal-account-management>).
> - By default, this feature is not enabled for new connectors. If your Microsoft Entra instance requires support of the Risky Service Principal Alert feature, you must enable the feature by adding attributes to the Account Schema in the SailPoint user interface.

#### Supported Operations

This feature supports the following operations:

- Account Aggregation (Service Principal Aggregation)
- Get Object (Get Service Principal)

#### Prerequisites

The tenant must have a Microsoft Entra P2 license.

#### Administrator Permissions

To fetch risky service principal details using MS Graph APIs, the following API permissions must be assigned:

| OAuth2.0 Authentication | Type | Permission | Purpose |
| --- | --- | --- | --- |
| Client Credentials | Application | IdentityRiskEvent.Read.All<br>IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information |
| Refresh Token / AuthCode<br>JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All<br>IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information |

#### Supported Schema Attributes

To manage the risky service principal alert feature, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The account schema cannot be extended for other risk related attributes.

| Attribute Name | Description |
| --- | --- |
| spn\_riskLevel | Level of the detected risky service principal. |
| spn\_riskState | State of the service principal's risk. |
| spn\_riskDetail | Details of the detected risk. |
| spn\_riskLastUpdatedDateTime | The date and time when the risky service principal was last updated. |

## Managed Identity Management

Managed identities for Azure resources offer a secure and convenient way for Azure services to authenticate to other Azure services that support Microsoft Entra ID authentication, without the need to manage or store credentials in the code.

### User-Assigned Managed Identities

Managed identities for Azure resources provide Azure services with an automatically managed identity in Microsoft Entra ID. These identities can be used to authenticate to any Azure service that supports Microsoft Entra ID authentication, without having credentials in the code. SailPoint supports managing only user-assigned managed identities as they have an independent lifecycle.

The following operations are supported for user-assigned managed identity objects:

- Aggregation of user-assigned managed identities in account aggregation.
- Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities.
- Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities.
- Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license).

#### Prerequisites

If you want to configure your source to aggregate managed identities, you need to modify the account schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as `Account Name`.

#### Correlation for Managed Identities

The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](<https://community.sailpoint.com/knowledge/Service-Accounts-Best-Practices>).

#### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator<br>OR<br>Role: Reader<br>Scope: Tenant Root Group (to fetch from all subscriptions) |
| Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>). |
| Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-pim-for-roles>). |

**To assign the Reader role at Tenant Root Group:**

1. Sign in to [https://portal.azure.com](<https://portal.azure.com>) and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. Select the **Tenant Root Group**.
3. On the left-hand side of the screen, select **Access Control (IAM)**.
4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource.

#### Supported Schema Attributes

To aggregate user-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [User-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#user-assigned-managed-identity-attributes>).

#### Configure User-Assigned Managed Identities in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/az_ad_feat2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/az_ad_feat2.png>)

1. Go to **Feature Management**.
2. Select the **Manage User-Assigned Managed Identities as Accounts** checkbox if you want to manage Azure Role Assignments (RBAC) for user-assigned managed identities.

   > **Note**
   >
   > To automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing user-assigned managed identities . For more information, refer to [User-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#user-assigned-managed-identity-attributes>).
3. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for user-assigned managed identities.
4. Select **Save**.

### System-Assigned Managed Identities

SailPoint supports managing system-assigned managed identities, but with limited capabilities due to the tight coupling between the identity and the Azure resource lifecycle.

The following operations are supported for system-assigned managed identity objects:

- Aggregation of system-assigned managed identities in account aggregation.
- Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities.
- Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities.
- Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities. (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license).

> [!NOTE]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment or [Service Principal Account Management](<#service-principal-account-management>)), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.

#### Prerequisites

If you want to configure your source to aggregate managed identities, ensure to modify the Account Schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as Account Name.

#### Correlation for Managed Identities

The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](<https://community.sailpoint.com/knowledge/Service-Accounts-Best-Practices>).

#### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator<br>OR<br>Role: Reader<br>Scope: Tenant Root Group (to fetch from all subscriptions) |
| Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>). |
| Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-pim-for-roles>). |

**To assign the Reader role at Tenant Root Group:**

1. Sign in to [https://portal.azure.com](<https://portal.azure.com>) and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. Select the **Tenant Root Group**.
3. On the left-hand side of the screen, select **Access Control (IAM)**.
4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource.

#### Supported Schema Attributes

To aggregate system-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [System-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#system-assigned-managed-identity-attributes>).

#### Configure System-Assigned Managed Identities in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/system_assigned_identities.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/system_assigned_identities.png>)

1. Go to **Feature Management**.
2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for system-assigned managed identities.
3. Select the **Include System-Assigned Managed Identities** checkbox to manage system-assigned identities.
4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for system-assigned managed identities.
5. Select **Save**.

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Exception Occurred in Iterate Objects - populateRiskyUsersDetails

This error occurs when the Risky User feature is disabled in Microsoft Entra ID.

**Resolution**: Choose one of the following solutions to complete account aggregation:

Option 1: Delete these four attributes from the connector's Account Schema:

- riskLevel
- riskState
- riskDetail
- riskLastUpdatedDateTime

Option 2: Grant the necessary permission to read Risky User Alerts in Entra ID.

## Provisioning Fails With a 409 Conflict Error for License Assignment Requests

When a provisioning plan includes requests to add multiple assignedLicence values for a single user, the operation fails returning an API error code of 409. This occurs because the Microsoft cannot process simultaneous license assignment requests for the same user, treating it as a concurrency conflict.

**Resolution:** To resolve this issue, you can configure the connector to automatically retry the failed license assignment request. This allows a brief delay for the Microsoft tenant to process the initial request before the connector attempts the operation again. For more information, refer to [Configuring Errors and Retries](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html?h=retry+error#errors-and-retries>).

## Attributes Are Not Updated With Null Values During Provisioning

**Resolution:** Specify the attributes whose values you want to set as null to the source under the `supportNullValueForAttributes` using PATCH method.

In the following example, the `department` and `jobTitle` attributes are specified, indicating that these attributes should be updated with null values during provisioning.

```text
[
  {
    "op": "add",
    "path": "/connectorAttributes/supportNullValueForAttributes",
    "value": [
            "department",
            "jobTitle"
        ]
  }
]
```

## Numeric Value Displayed for SPN Account Names

When managing users and Service Principal Names (SPNs) as accounts under a single source, if the `displayName` attribute of the Account Schema is set to `UserPrincipalName`, you may encounter numeric values for SPN accounts instead of readable names. **Resolution**: To display the correct SPN displayName, ensure that the `mapSPNDisplayNameToUPN` is added to the source XML using PATCH and set the value to `true`. For example,

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/mapSPNDisplayNameToUPN",
        "value": true
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## 400 Bad Request on Microsoft Graph API Filter

**Resolution**: Replace `dirSyncEnabled` with `onPremisesSyncEnabled` to check if a user is synced from on-premises directory.

For example, `onPremisesSyncEnabled eq true`

## Aggregation Fails With AxiosError Timeout of 120000ms

`AxiosError: timeout of 120000ms exceeded`

**Resolution**: To resolve HTTP request timeout errors during aggregation, increase the connector timeout duration by adding the `httpRequestTimeout` attribute to the source configuration using the REST API. The attribute is an integer specified in seconds. The default value is `120` seconds. For example,

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/httpRequestTimeout",
        "value": 180
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Create Account Fails With Command Inactive for 10m0s

Account creation can fail when the create command stays inactive for 10 minutes. The parsed error can also report HTTP 400 because another object already uses the same userPrincipalName. The post-create getObject call re-fetches large amounts of data, such as Privileged Identity Management (PIM) data, from Microsoft Graph. That call can fail or slow account creation even after the user account is provisioned.

```text
[ConnectorError] command inactive for 10m0s std:account:create
```

```text
Another object with the same value for property userPrincipalName already exists.
```

**Resolution**: Add the `skipGetObjectOnCreateAccount` attribute to the source using the REST API and set the value to `true`. When this attribute is `true`, account creation returns the attributes from the create request and does not call getObject after the account is created.

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/skipGetObjectOnCreateAccount",
        "value": true
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the connector-runtime. These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the connector-runtime using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```