# Schema Reference

This section describes the different schema attributes. The Microsoft Entra ID SaaS connector currently supports the following types of objects:

- Account: Account objects are used when building identities Link objects.
- Group: The group schema is used when building Account-Group objects that are used to hold entitlements shared across identities.
- Role: The Role schema is used when building Directory Role objects that are used to hold entitlements shared across identities.
- Management Group: The Management group schema is used to represent Azure Management Groups which are created to allow Azure customers to organize their subscriptions and apply governance controls such as Role Based Access Control and Policies.
- Subscription: The Subscription schema is used to represent Azure Subscription objects which represent a signed agreement between a supplier and customer that the customer would receive and provide payment for regular products or services.
- Resource Group: The Resource group schema is used to represent Azure Resource Groups which are container objects that hold related resources for an Azure solution.
- Azure Role Assignment: The Azure Role Assignment schema is used to represent custom group objects that consist of the following elements:

  - Security Principal (user, groups, service principal, managed identity)
  - Role Definition
  - Access Scope

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Microsoft Entra ID SaaS connector uses the following default correlation and object configurations.

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the Microsoft Entra ID SaaS source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| userPrincipalName | Equals | Work Email |
| mail | Equals | Work Email |

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| objectId | account |
| objectId | group |
| id | role |
| id | azureRoleAssignment |
| id | managementGroup |
| subscriptionId | subscription |
| id | resourceGroup |

### Default Account Attributes

The Microsoft Entra ID SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| accountEnabled | True if the user is enabled; otherwise, false. |
| city | City in which the user is located. |
| country | Country/region in which the user is located. |
| creationType | Indicates whether the user account is a local account for an Azure Active Directory B2C tenant. |
| department | Name for the department the user belongs to. |
| onPremisesSyncEnabled | Indicates whether a Microsoft Entra ID user is synchronized from an on-premises directory. |
| displayName | Name displayed in the address book for the user. |
| facsimileTelephoneNumber | Telephone number of the user's business fax machine. |
| givenName | First name of an user. |
| groups | Groups assigned to an user (Entitlement). |
| identities | Represents the identities that can be used to sign in to this user account, that can be either a local or social account.<br>Note<br>During account aggregation, the connector excludes identity records with `signInType` set to `userPrincipalName`. |
| immutableId | Property used to associate an on-premises Active Directory user account to their Microsoft Entra ID user account. |
| jobTitle | User’s job title. |
| lastDirSyncTime | Indicates the last time at which the user was synchronized with the on-premises directory. |
| signInActivity.lastNonInteractiveSignInDateTime | Indicates the last time a user signed in to the directory with an non-interactive authentication method.<br>The timestamp represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2022 is `2022-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastNonInteractiveSignInRequestId | Indicates the request identifier of the last non-interactive sign-in performed by this user.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSignInDateTime | Indicates the last time a user signed in to the directory with an interactive authentication method.<br>The timestamp represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2022 is `2022-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSignInRequestId | Indicates the request identifier of the last interactive sign-in performed by this user.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSuccessfulSignInDateTime | Indicates the date and time of the user's most recent successful sign-in activity.<br>The timestamp type represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSuccessfulSignInRequestId | Indicates the request identifier of the last successful sign-in activity.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| mail | The SMTP address for the user. For example, `john@contoso.onmicrosoft.com` |
| mailNickname | Mail alias for the user. |
| manager | Manager of the user. (Type: String).<br>The Microsoft Entra ID SaaS connector provides support for provisioning the `manager` attribute. For more information, refer to [Support for Provisioning Operations of manager Attribute](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#support-for-provisioning-operations-of-manager-attribute>). |
| mobile | Primary cellular telephone number for the user. |
| objectId | Unique identifier for the user. |
| onPremisesSecurityIdentifier | Contains the on-premises security identifier (SID) for the user that was synchronized from on-premises to the cloud. |
| otherMails | A list of additional email addresses for the user. |
| passwordPolicies | Specifies password policies for the user. |
| physicalDeliveryOfficeName | Office location in the user's place of business. |
| postalCode | ZIP OR postal code for the user's postal address. |
| preferredLanguage | Preferred written or spoken language for a person. |
| proxyAddresses | Proxy addresses.<br>For example, `["SMTP: bob@contoso.com", "smtp: bob@sales.contoso.com"]` |
| roles | Administrator Role assigned to user (Entitlement). |
| sipProxyAddress | Specifies the voice over IP (VOIP) session initiation protocol (SIP) address for the user. |
| state | State or province in the user's address. |
| sponsors | Sponsors of the user. The Microsoft Entra ID SaaS connector provides support aggregation and provisioning of sponsors attribute. For more information, refer to [Configuring Sponsors for Guest User ( B2B) and External Member (B2B)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#sponsors-for-guest-user-b2b-and-external-member-b2b>). |
| streetAddress | Street address of the user's place of business. |
| surname | Last name of the user. |
| telephoneNumber | Primary telephone number of the user's place of business. |
| usageLocation | A two letter country code indicating usage location. |
| userPrincipalName | User principal name (UPN) of the user. |
| userType | Type of the user. |
| azureRoleAssignments\* | Azure Role Assignments assigned to user (Only applicable for CIEM). |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Microsoft Entra ID SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| description | Description for the group. |
| dirSyncEnabled | Indicates whether this group was synced from the on-premises directory. |
| displayName | Display name for the group. |
| lastDirSyncTime | Indicates the last time at which the group was synced with the on-premises directory. |
| mail | SMTP address for the group. |
| mailEnabled | Specifies whether the group is mail-enabled |
| mailNickname | Mail alias for the group. |
| objectId | Group ID. |
| onPremisesSecurityIdentifier | Contains the on-premises security identifier (SID) for the group that was synchronized from on-premises to the cloud. |
| owners | Owner of the group. |
| proxyAddresses | Proxy addresses of the group. |
| securityEnabled | Specifies whether the group is a security group. |
| teamsEnabled | Specifies whether teams has been enabled for the group. |
| groupTypes | Type of the group. Blank for Security and /or Unified for Office 365 type of groups.<br>For example, Unified for Office 365 group. |

## Access Package Attributes

To manage access packages, ensure that the following attribute is present in the account schema:

| Attribute Name | Description |
| --- | --- |
| accessPackages | List of access packages assigned to the user.<br>Type: Entitlement, Multi-Valued |

To manage the Microsoft Entra access package objects, ensure that the following attributes are present in the group schema:

| Attribute Name | Description |
| --- | --- |
| id | Unique identifier of the Access Package. |
| displayName | Display name made by combining the Access Package name and Policy name. |
| description | Description of the Access Package. |
| policyDescription | Description of the Access Package's policy. |
| expiration | Expiration time for the Access Package's policy. |
| isHidden | Indicates whether the Access Package is hidden from end users on My Access portal. |
| catalog | Container where the Access Package resides. |
| Resource Roles | Indicates what all resources are present in the access package with the role. |

## Identity Profile Mapping

The Microsoft Entra ID SaaS connector supports the following attributes in Identity Profile Mapping by default:

| Identity Attribute | Schema Attribute |
| --- | --- |
| uid | objectId |
| email | userPrincipalName |
| displayName | displayName |
| firstname | givenName |
| lastname | surname |
| manager | manager |
| personalEmail | mail |
| workPhone | telephoneNumber |
| phone | mobile |
| title | jobTitle |
| department | department |

## Multi-Factor Authentication (MFA) Attributes

To manage multi-factor authentication user information, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> When using the phone authentication method, the values for the following attributes are expected to be provided with the country code as a prefix: `mfa_phoneNumber_mobile`, `mfa_phoneNumber_alternateMobile`, and `mfa_phoneNumber_office`. If the country code is not provided provisioning operations will result in failure. The value for these attributes should follow this format (there must be a space between the country code and the phone number):`<country code> <phone number>`
>
> Examples:
>
> - `<AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>`
> - `<AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>`
> - `<AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>`

> [!NOTE]
>
> Once you enable MFA for any user there will be one default authentication method set. This is usually the first method configured, but you can modify it later from the Azure portal. If you are trying to remove values for an attribute that belongs to the default authentication method, the Azure APIs will throw an error as the APIs do not expect to remove values for attributes that belong to the default authentication method. For example, if email is the default authentication method configured for an Azure user, the connector will not be able to remove the value for the `mfa_emailAddress` attribute.

<table> <thead> <tr> <th>Authentication Method</th> <th>Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Phone</td> <td>mfa_phoneNumber_mobile</td> <td>String</td> <td>Mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_alternateMobile</td> <td>String</td> <td>Alternate mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_office</td> <td>String</td> <td>Office phone number assigned to the user.</td> </tr> <tr> <td>Email</td> <td>mfa_emailAddress</td> <td>String</td> <td>Email address assigned to the user.</td> </tr> <tr> <td>Microsoft Authentication</td> <td>mfa_microsoftAuthenticatorAuthenticationMethod</td> <td>String: Multivalued</td> <td>Microsoft Authentication method assigned to the user.</td> </tr> <tr> <td>Other</td> <td>mfa_methodName<br>Where methodName is the authentication method name.<br>For example:<br><ul><li>mfa_fido2AuthenticationMethod</li><li>mfa_temporaryAccessPassAuthenticationMethod</li><li>mfa_softwareOathAuthenticationMethod</li><li>mfa_windowsHelloForBusinessAuthenticationMethod</li></ul></td> <td>String: Multivalued</td> <td>Other authentication method assigned to the user.</td> </tr> </tbody> </table>

## Service Plan

Object Type - servicePlan

<table class="span-table"> <tr> <td>Schema Attribute Name</td> <td>Type</td> <td>Description</td> </tr> <tr> <td>objectId</td> <td colspan="1" rowspan="8">String</td> <td>Unique identifier for the service plan which is a combination of skuId and servicePlanId separated by colon (:).</td> </tr> <tr> <td>skuId</td> <td>Unique identifier (GUID) for the License Pack.</td> </tr> <tr> <td>skuPartNumber</td> <td>The SKU part number of the License Pack. For example, <code>AAD_PREMIUM</code></td> </tr> <tr> <td>appliesTo</td> <td>Object types to which the license pack can be assigned. For example, <code>User, Company</code></td> </tr> <tr> <td>displayName</td> <td>Display name of service plan which is a combination of skuPartNumber and servicePlanName separated by colon (:).</td> </tr> <tr> <td>servicePlanId</td> <td>Unique identifier of the service plan.</td> </tr> <tr> <td>servicePlanName</td> <td>The name of the service plan.</td> </tr> <tr> <td>provisioningStatus</td> <td>The provisioning status of the service plan.</td> </tr> </table>

Use the following JSON request and the REST API to add the `servicePlan` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
  "name": "servicePlan",
  "nativeObjectType": "servicePlan",
  "identityAttribute": "objectId",
  "displayAttribute": "displayName",
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "attributes": [
    {
      "name": "objectId",
      "type": "string",
      "isMultiValued": false,
      "description": "Unique identifier for the service plan which is a combination of skuId and servicePlanId separated by colon (:).",
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuId",
      "type": "string",
      "description": "Unique identifier (GUID) for the License Pack",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuPartNumber",
      "type": "string",
      "description": "The SKU part number of the License Pack. For example, AAD_PREMIUM",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "appliesTo",
      "type": "string",
      "description": "Object types to which the license pack can be assigned. For example: User, Company",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "string",
      "description": "Display name of service plan which is a combination of skuPartNumber and servicePlanName separated by colon (:).",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanId",
      "type": "string",
      "description": "Unique identifier of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanName",
      "type": "string",
      "description": "The name of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "provisioningStatus",
      "type": "string",
      "description": "The provisioning status of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ],
  "created": "2019-12-24T22:32:58.104Z",
  "modified": "2019-12-31T20:22:28.104Z"
}​
```