# Directory Attributes

## Admin Consented Permission Attributes

To manage admin consented permissions, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The object type is `adminConsentedPermission`.

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for adminConsentedPermission.<br>This is the native identity attribute. This ID is a concatenation of `resourceId:value`<br>Where `resourceId` is the ID of SPN and `value` is the value for the adminConsentedPermssion within that SPN.<br>For example:<br>`2555d458-1b3c-4953-bcc4-a38409561c2f:AuditLog.Read.All` |
| displayName | String | This is the display name of the adminConstentedPermission.<br>Just like id, displayName is a concatenation of `value [on] resource-DisplayName`<br>For example:<br>If an SPN with a displayName of `Microsoft Graph` has a permission defined with the value as `AuditLog.Read.All`, then the displayName for adminConsentedPermission after concatenation would be `AuditLog.Read.All [on] Microsoft Graph` |
| spn\_description | String | This is the description for the SPN. |
| permission\_description | String | This is the description for the adminConsentedPermission. |
| type | String | The possible values are `User` and `Admin`. This denotes whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an admin consent should always be required. |
| isEnabled | boolean | Whether the adminConsentedPermission is enabled or disabled. |
| value | String | The value for the attribute. For example:<br>`AuditLog.Read.All` |

Use the following JSON request and REST API to add the `adminConsentedPermission` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
        "nativeObjectType": "adminConsentedPermission",
        "identityAttribute": "id",
        "displayAttribute": "displayName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "displayName",
                "type": "STRING",
                "schema": null,
                "description": "The display name for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "spn_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of service principal",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "permission_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "id",
                "type": "STRING",
                "schema": null,
                "description": "The unique identifier for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "type",
                "type": "STRING",
                "schema": null,
                "description": "Allowed types for admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "isEnabled",
                "type": "STRING",
                "schema": null,
                "description": "States whether the admin consented permission is enabled or not",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "value",
                "type": "STRING",
                "schema": null,
                "description": "Value of the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ]
}
```

## Administrative Units Attributes

### Object Type - administrativeUnit

<table class="span-table"> <tr> <td>Schema Attribute Name</td> <td>Type</td> <td>Description</td> </tr> <tr> <td>id</td> <td colspan="1" rowspan="8">String</td> <td>Fully qualified ID for the Administrative Unit.</td> </tr> <tr> <td>displayName</td> <td>Friendly name of the Administrative Unit.</td> </tr> <tr> <td>description</td> <td>This is the description of the Administrative Unit.</td> </tr> <tr> <td>isMemberManagementRestricted</td> <td>This is the description of Administrative Unit.</td> </tr> <tr> <td>membershipRule</td> <td>Membership Rule.</td> </tr> <tr> <td>membershipType</td> <td>MembershipType.</td> </tr> <tr> <td>membershipRuleProcessingState</td> <td>Membership Rule Processing State.</td> </tr> <tr> <td>visibility</td> <td>Visibility.</td> </tr> </table>

Use the following JSON request and the SailPoint REST API to add the `administrativeUnit` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
      "type": "administrativeUnit",
      "nativeObjectType": "administrativeUnit",
      "identityAttribute": "id",
      "displayAttribute": "displayName",
      "attributes": [
        {
          "name": "id",
          "type": "STRING",
          "schema": null,
          "description": "Fully qualified ID for the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "displayName",
          "type": "STRING",
          "schema": null,
          "description": "Friendly name of the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "description",
          "type": "STRING",
          "schema": null,
          "description": "Description of Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "isMemberManagementRestricted",
          "type": "BOOLEAN",
          "description": "Description of Administrative Unit"
        },
        {
          "name" : "membershipRule",
          "type" : "STRING",
          "description": "Membership Rule"
        },
        {
          "name" : "membershipType",
          "type" : "STRING",
          "description": "Membership Type"
        },
        {
          "name" : "membershipRuleProcessingState",
          "type" : "STRING",
          "description": "Membership Rule Processing State"
        },
        {
          "name" :"visibility",
          "type" : "STRING",
          "description" : "Visibility"
        }

]

}
```

## Application Role Attributes

### Object Type - applicationRole

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for Application Role.<br>This is the nativeIdentity attribute.<br>This id is a concatenation of:<br>`resourceId:appRoleId`<br>Where, `resourceId` is the ID of SPN, and `appRoleId` is the ID for the appRole within that SPN.<br>For example, `70b32868-8393-4c4e-99fc-916710f62412:6f445064-b311-4d3e-a869-e024e787d6a9` |
| displayName | String | This is the display name of the Application Role.<br>Just like id, displayName is a concatenation of:<br>`resource-DisplayName: appRole-DisplayName`<br>For example, if an SPN with displayName TestSPN, has an appRole defined with name Engineer, then the displayName for appRole after concatenation would be TestSPN:Engineer |
| spn\_description | String | This is the description for the SPN. |
| appRole\_description | String | This is the description for the appRole. |
| allowedMemberTypes | String<br>Multi | Displays the types of members that this role can be assigned to. For example, `Users,Groups,Applications` |
| isEnabled | boolean | Displays whether the appRoles is enabled or disabled. |
| value | String |  |

Use the following JSON request and the REST API to add the `ApplicationRole` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
    "nativeObjectType": "applicationRole",
    "name": "applicationRole",
    "identityAttribute": "id",
    "displayAttribute": "displayName",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "id",
            "type": "STRING",
            "schema": null,
            "description": "Unique Identifier for Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "displayName",
            "type": "STRING",
            "schema": null,
            "description": "Display Name of the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "spn_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Service Principal",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "appRole_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "allowedMemberTypes",
            "type": "STRING",
            "schema": null,
            "description": "Types of members that this role can be assigned to, for example: Users,Groups,Applications",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "isEnabled",
            "type": "BOOLEAN",
            "schema": null,
            "description": "Represents whether the Application Role is enabled or disabled.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "value",
            "type": "STRING",
            "schema": null,
            "description": "The value of the Application Role.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}
```

## Roles

To manage the Microsoft Entra role objects, ensure that the following attributes are present in the group schema.

| Attribute Name | Description |
| --- | --- |
| description | Specify the description of the Microsoft Entra role. |
| displayName | Specify the display name for the Microsoft Entra role. |
| id | Specify the unique identifier for the Microsoft Entra role. |
| isBuiltIn | Specify the flag indicating whether the role is part of the default set included in Microsoft Entra or a custom one. |
| isEnabled | Specify the flag indicating whether the role is enabled for assignment. If it is false, the role is not available for assignment. |
| rolePermissions | Specify the list of permissions included in the role. |

## Mail Contacts As Accounts Attributes

To manage mail contacts as accounts, ensure the following attributes are present in your account schema:

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| objectId | String | ID is normal GUID. So to identity this object as `mailContacts` you should save this as `microsoft.mailContact:88914ce6-7962-4465-8cb3-371268c1e64a` |
| displayName | String | Display name of the mail contact. |
| groups | String<br>Multivalued<br>Entitlement<br>Managed | List of groups that the mail contact is a member of. |
| mailContact\_department | String | The name for the department in which the contact works. |
| mailContact\_companyName | String | The name of the company that this mail contact belongs to. |
| mailContact\_givenName | String | First name of the mail contact. |
| mailContact\_jobTitle | String | Job title of the mail contact. |
| mailContact\_mail | String | The SMTP address of the contact. For example, `jeff@contoso.onmicrosoft.com` |
| mailContact\_mailNickname | String | Email alias (portion of the email address prepending the @ symbol) of the mail contact. |
| mailContact\_surname | String | Last name of the mail contact. |
| mailContact\_addresses | String | Post address of the mail contact.<br>Note<br>The contact can only have one physical address. |
| mailContact\_phones | String | List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax. |

### Sample JSON Request for Managing Mail Contacts As Accounts

```text
{
  "nativeObjectType": "account",
  "identityAttribute": "objectId",
  "displayAttribute": "userPrincipalName",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [],
  "configuration": {},
  "attributes": [
    {
      "name": "objectId",
      "type": "STRING",
      "schema": null,
      "description": "The unique identifier for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "STRING",
      "schema": null,
      "description": "The name displayed in the address book for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "groups",
      "type": "STRING",
      "schema": {
        "type": "CONNECTOR_SCHEMA",
        "id": "2c918085843dc5ce01845bebf6e43a8a",
        "name": "group"
      },
      "description": "Groups assigned to a user",
      "isMulti": true,
      "isEntitlement": true,
      "isGroup": true
    },
    {
      "name": "mailContact_phones",
      "type": "STRING",
      "schema": null,
      "description": "List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax.",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_department",
      "type": "STRING",
      "schema": null,
      "description": "The name for the department in which the contact works.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_companyName",
      "type": "STRING",
      "schema": null,
      "description": "The name of the company that this mail contact belongs to.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_givenName",
      "type": "STRING",
      "schema": null,
      "description": "First name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_surname",
      "type": "STRING",
      "schema": null,
      "description": "Last name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_jobTitle",
      "type": "STRING",
      "schema": null,
      "description": "Job title of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mailNickName",
      "type": "STRING",
      "schema": null,
      "description": "Email alias (portion of the email address prepending the @ symbol) of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mail",
      "type": "STRING",
      "schema": null,
      "description": "The SMTP address of the contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```

## Channel Attributes

To manage the channel management objects, ensure that the following attributes are present in the group schema.

<table> <thead> <tr> <th>Attribute Name</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>description</td> <td>Optional textual description for the channel.</td> </tr> <tr> <td>displayName</td> <td>Channel name as it will appear to the user in Microsoft Teams.<br>Combination of team display name: channel display name.</td> </tr> <tr> <td>id</td> <td>The channel's unique identifier.<br>Combination of team id: channel id</td> </tr> <tr> <td>isFavoriteByDefault</td> <td>Indicates whether the channel must automatically be marked favorite for all members of the team. Default: false.</td> </tr> <tr> <td>email</td> <td>The email address for sending messages to the channel. Read-only.</td> </tr> <tr> <td>webUrl</td> <td>A hyperlink that will go to the channel in Microsoft Teams.</td> </tr> <tr> <td>membershipType</td> <td>The type of the channel. Possible values are:<br><ul><li>standard: Channel inherits the list of members of the parent team.</li><li>private: Channel can have members that are a subset of all the members on the parent team.</li></ul></td> </tr> <tr> <td>createdDateTime</td> <td>Read only. Timestamp at which the channel was created.</td> </tr> <tr> <td>teamEmail</td> <td>The email address of the parent team.</td> </tr> <tr> <td>owners</td> <td>The list of owners of the private channel.<br>Properties: Multi-Valued</td> </tr> </tbody> </table>