Directory Attributes

Admin Consented Permission Attributes

To manage admin consented permissions, ensure that the following attributes are present in the account schema:

Note

The object type is adminConsentedPermission.

Schema Attribute Name	Type	Description
id	String	This is the unique identifier for adminConsentedPermission. This is the native identity attribute. This ID is a concatenation of `resourceId:value` Where `resourceId` is the ID of SPN and `value` is the value for the adminConsentedPermssion within that SPN. For example: `2555d458-1b3c-4953-bcc4-a38409561c2f:AuditLog.Read.All`
displayName	String	This is the display name of the adminConstentedPermission. Just like id, displayName is a concatenation of `value [on] resource-DisplayName` For example: If an SPN with a displayName of `Microsoft Graph` has a permission defined with the value as `AuditLog.Read.All`, then the displayName for adminConsentedPermission after concatenation would be `AuditLog.Read.All [on] Microsoft Graph`
spn_description	String	This is the description for the SPN.
permission_description	String	This is the description for the adminConsentedPermission.
type	String	The possible values are `User` and `Admin`. This denotes whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an admin consent should always be required.
isEnabled	boolean	Whether the adminConsentedPermission is enabled or disabled.
value	String	The value for the attribute. For example: `AuditLog.Read.All`

Use the following JSON request and REST API to add the adminConsentedPermission schema to an existing connector:

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

{
        "nativeObjectType": "adminConsentedPermission",
        "identityAttribute": "id",
        "displayAttribute": "displayName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "displayName",
                "type": "STRING",
                "schema": null,
                "description": "The display name for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "spn_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of service principal",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "permission_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "id",
                "type": "STRING",
                "schema": null,
                "description": "The unique identifier for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "type",
                "type": "STRING",
                "schema": null,
                "description": "Allowed types for admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "isEnabled",
                "type": "STRING",
                "schema": null,
                "description": "States whether the admin consented permission is enabled or not",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "value",
                "type": "STRING",
                "schema": null,
                "description": "Value of the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ]
}

Administrative Units Attributes

Object Type - administrativeUnit

Schema Attribute Name	Type	Description
id	String	Fully qualified ID for the Administrative Unit.
displayName		Friendly name of the Administrative Unit.
description		This is the description of the Administrative Unit.
isMemberManagementRestricted		This is the description of Administrative Unit.
membershipRule		Membership Rule.
membershipType		MembershipType.
membershipRuleProcessingState		Membership Rule Processing State.
visibility		Visibility.

Use the following JSON request and the SailPoint REST API to add the administrativeUnit schema to an existing connector:

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

{
      "type": "administrativeUnit",
      "nativeObjectType": "administrativeUnit",
      "identityAttribute": "id",
      "displayAttribute": "displayName",
      "attributes": [
        {
          "name": "id",
          "type": "STRING",
          "schema": null,
          "description": "Fully qualified ID for the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "displayName",
          "type": "STRING",
          "schema": null,
          "description": "Friendly name of the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "description",
          "type": "STRING",
          "schema": null,
          "description": "Description of Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "isMemberManagementRestricted",
          "type": "BOOLEAN",
          "description": "Description of Administrative Unit"
        },
        {
          "name" : "membershipRule",
          "type" : "STRING",
          "description": "Membership Rule"
        },
        {
          "name" : "membershipType",
          "type" : "STRING",
          "description": "Membership Type"
        },
        {
          "name" : "membershipRuleProcessingState",
          "type" : "STRING",
          "description": "Membership Rule Processing State"
        },
        {
          "name" :"visibility",
          "type" : "STRING",
          "description" : "Visibility"
        }

]

}

Application Role Attributes

Object Type - applicationRole

Schema Attribute Name	Type	Description
id	String	This is the unique identifier for Application Role. This is the nativeIdentity attribute. This id is a concatenation of: `resourceId:appRoleId` Where, `resourceId` is the ID of SPN, and `appRoleId` is the ID for the appRole within that SPN. For example, `70b32868-8393-4c4e-99fc-916710f62412:6f445064-b311-4d3e-a869-e024e787d6a9`
displayName	String	This is the display name of the Application Role. Just like id, displayName is a concatenation of: `resource-DisplayName: appRole-DisplayName` For example, if an SPN with displayName TestSPN, has an appRole defined with name Engineer, then the displayName for appRole after concatenation would be TestSPN:Engineer
spn_description	String	This is the description for the SPN.
appRole_description	String	This is the description for the appRole.
allowedMemberTypes	String Multi	Displays the types of members that this role can be assigned to. For example, `Users,Groups,Applications`
isEnabled	boolean	Displays whether the appRoles is enabled or disabled.
value	String

Use the following JSON request and the REST API to add the ApplicationRole schema to an existing connector:

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

{
    "nativeObjectType": "applicationRole",
    "name": "applicationRole",
    "identityAttribute": "id",
    "displayAttribute": "displayName",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "id",
            "type": "STRING",
            "schema": null,
            "description": "Unique Identifier for Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "displayName",
            "type": "STRING",
            "schema": null,
            "description": "Display Name of the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "spn_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Service Principal",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "appRole_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "allowedMemberTypes",
            "type": "STRING",
            "schema": null,
            "description": "Types of members that this role can be assigned to, for example: Users,Groups,Applications",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "isEnabled",
            "type": "BOOLEAN",
            "schema": null,
            "description": "Represents whether the Application Role is enabled or disabled.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "value",
            "type": "STRING",
            "schema": null,
            "description": "The value of the Application Role.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}

Roles

To manage the Microsoft Entra role objects, ensure that the following attributes are present in the group schema.

Attribute Name	Description
description	Specify the description of the Microsoft Entra role.
displayName	Specify the display name for the Microsoft Entra role.
id	Specify the unique identifier for the Microsoft Entra role.
isBuiltIn	Specify the flag indicating whether the role is part of the default set included in Microsoft Entra or a custom one.
isEnabled	Specify the flag indicating whether the role is enabled for assignment. If it is false, the role is not available for assignment.
rolePermissions	Specify the list of permissions included in the role.

Mail Contacts As Accounts Attributes

To manage mail contacts as accounts, ensure the following attributes are present in your account schema:

Schema Attribute Name	Type	Description
objectId	String	ID is normal GUID. So to identity this object as `mailContacts` you should save this as `microsoft.mailContact:88914ce6-7962-4465-8cb3-371268c1e64a`
displayName	String	Display name of the mail contact.
groups	String Multivalued Entitlement Managed	List of groups that the mail contact is a member of.
mailContact_department	String	The name for the department in which the contact works.
mailContact_companyName	String	The name of the company that this mail contact belongs to.
mailContact_givenName	String	First name of the mail contact.
mailContact_jobTitle	String	Job title of the mail contact.
mailContact_mail	String	The SMTP address of the contact. For example, `jeff@contoso.onmicrosoft.com`
mailContact_mailNickname	String	Email alias (portion of the email address prepending the @ symbol) of the mail contact.
mailContact_surname	String	Last name of the mail contact.
mailContact_addresses	String	Post address of the mail contact. Note The contact can only have one physical address.
mailContact_phones	String	List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax.

Sample JSON Request for Managing Mail Contacts As Accounts

{
  "nativeObjectType": "account",
  "identityAttribute": "objectId",
  "displayAttribute": "userPrincipalName",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [],
  "configuration": {},
  "attributes": [
    {
      "name": "objectId",
      "type": "STRING",
      "schema": null,
      "description": "The unique identifier for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "STRING",
      "schema": null,
      "description": "The name displayed in the address book for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "groups",
      "type": "STRING",
      "schema": {
        "type": "CONNECTOR_SCHEMA",
        "id": "2c918085843dc5ce01845bebf6e43a8a",
        "name": "group"
      },
      "description": "Groups assigned to a user",
      "isMulti": true,
      "isEntitlement": true,
      "isGroup": true
    },
    {
      "name": "mailContact_phones",
      "type": "STRING",
      "schema": null,
      "description": "List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax.",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_department",
      "type": "STRING",
      "schema": null,
      "description": "The name for the department in which the contact works.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_companyName",
      "type": "STRING",
      "schema": null,
      "description": "The name of the company that this mail contact belongs to.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_givenName",
      "type": "STRING",
      "schema": null,
      "description": "First name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_surname",
      "type": "STRING",
      "schema": null,
      "description": "Last name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_jobTitle",
      "type": "STRING",
      "schema": null,
      "description": "Job title of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mailNickName",
      "type": "STRING",
      "schema": null,
      "description": "Email alias (portion of the email address prepending the @ symbol) of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mail",
      "type": "STRING",
      "schema": null,
      "description": "The SMTP address of the contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}

Channel Attributes

To manage the channel management objects, ensure that the following attributes are present in the group schema.

Attribute Name	Description
description	Optional textual description for the channel.
displayName	Channel name as it will appear to the user in Microsoft Teams. Combination of team display name: channel display name.
id	The channel's unique identifier. Combination of team id: channel id
isFavoriteByDefault	Indicates whether the channel must automatically be marked favorite for all members of the team. Default: false.
email	The email address for sending messages to the channel. Read-only.
webUrl	A hyperlink that will go to the channel in Microsoft Teams.
membershipType	The type of the channel. Possible values are: standard: Channel inherits the list of members of the parent team. private: Channel can have members that are a subset of all the members on the parent team.
createdDateTime	Read only. Timestamp at which the channel was created.
teamEmail	The email address of the parent team.
owners	The list of owners of the private channel. Properties: Multi-Valued

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.