Account, Group, and Role Management

Account Management for User, User in Federated Domain, Guest User (B2B), and External Member (B2B)

This section describes the supported features for user, user in federated domain, guest user (B2B), and external member (B2B).

The following table lists various operations supported by connector for different Users:

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Account Management for Local User (B2C)

Azure Active Directory B2C is primarily for businesses and developers that create customer-facing applications. With Azure Active Directory B2C, users can use Microsoft Entra as the full-featured identity system for their application, while letting customers sign in with an identity they already have established (like Facebook or Gmail).

B2C is intended for inviting customers of your mobile and web applications, whether individuals, institutional or organizational customers into your Microsoft Entra.

Supported identities are Consumer users with local application accounts (any email address or user name) or any supported social identity with direct federation. A new/separate Microsoft Entra application must be created to manage B2C tenants.

Revoke Session After Disabling User Account

Disabling a user account prevents future authentication attempts, but existing active sessions can remain valid until token expiration. With this feature enabled, the Microsoft Entra ID SaaS connector automatically revokes active sign-in sessions during the disable account workflow, cutting off access immediately.

Supported Operations

• Revoke active user sign-in sessions when their account is disabled.

Administrator Permissions

To revoke sign-in sessions, assign the following Microsoft Graph API application permissions to your Entra ID app registration:

Configuring Account Disable Settings

To configure Account Disable Settings:

1. Go to Feature Management.
2. Under Account Disable Settings, select Revoke Session after Disabling User Account to sign the user out of all existing sessions when their account is disabled.
3. Select Save.

Last Login for Accounts

The Microsoft Entra ID SaaS connector can retrieve the last login date and time for individual users. This information can enable governance workflows to certify access and remove long-standing access if it's no longer needed.

The connector uses the MS Graph API to retrieve the last login account data.

Prerequisites

You must have an Microsoft Entra P1/P2 license to use this feature.

Administrator Permissions

To retrieve the last login account data, the MS Graphs API requires you to assign it the AuditLog.Read.All API permission.

Supported Operations

The connector retrieves last login information during the following operations:

• Account aggregation
• Get account

Required Attributes

This feature requires the following login information:

Attributes Related to Interactive Authentication Method

• signInActivity.lastSignInDateTime: To retrieve the last time a user logged into the directory with an interactive authentication method.
• signInActivity.lastSignInRequestId: To retrieve the request identifier of the last interactive sign-in performed by this user.

Attributes Related to Non-Interactive Authentication Method

• signInActivity.lastNonInteractiveSignInDateTime: To retrieve the last time a client signed in to the directory on behalf of a user.
• signInActivity.lastNonInteractiveSignInRequestId: To retrieve the request identifier of the last non-interactive sign-in performed by this user.

Other Supported Attributes

The following attributes are also supported along with the above listed attributes:

• signInActivity.lastSuccessfulSignInDateTime:To retrieve the date and time of the user’s most recent successful sign-in activity.
• signInActivity.lastSuccessfulSignInRequestId: To retrieve the request ID of the last successful sign-in.

Azure Mail Contact Management

Mail contacts (also known as organizational contacts) are managed by an organization's administrators. Additionally, mail contacts are generally synchronized from Exchange Online. With this feature, the connector supports managing mail contacts as accounts.

Supported Operations

The following operations are supported for Azure Mail Contact:

Administrator Permissions

Supported Schema Attributes

To aggregate mail contacts as accounts, ensure that the mail contact attributes are present in the account schema. For more information, refer to Mail Contacts as Accounts Attributes.

Supported Provisioning Attributes

To provision mail contacts related information, refer to Create/Modify/Delete Mail Contact Profile Attributes.

Configure Mail Contacts As Accounts

1. Go to Feature Management.
2. If it is not already selected, select Manage Exchange Online to view the rest of the fields.
3. Select Mail Contact Governance to manage mail contacts as accounts.
4. In the Mail Contact Filter field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, startswith(displayName,'MailContact1')

Service Plan Management (managing Licenses)

The Microsoft Entra ID SaaS connector supports assigning different Azure services licenses to the users. The connector uses individual plan to assign licenses. For the requirements and the group-based licensing considerations, refer to Service Plan Management (managing Licenses).

Service Plan now has separate group schema attributes. For a detailed list of the attributes, refer to Service Plan.

The following operations are supported for the Service Plan object type:

• Aggregation
• View details of Service Plan (like object properties, members, and so on)
• Assign and Revoke access request for Service Plan (entitlement attribute: assignedPlans)

Custom (extension) Attributes

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the extended attributes that are registered on the client application on Azure.

To aggregate custom attributes, you must update the schema for account or entitlement with the custom attribute names. The custom attribute name must match the custom attribute name on the managed Microsoft Entra ID system.

Use the following format for single-valued and multivalued string type custom attributes:

extension_<clientID>_<CustomAttributeName>

Managing Complex Extension Attributes

To manage complex extension attributes, as shown below:

"onPremisesExtensionAttributes": {
             "extensionAttribute1": "Value1",
             "extensionAttribute2": "Value2",
            "extensionAttribute3": "Value3",
            "extensionAttribute4": "Value4",
            "extensionAttribute5": "Value5",
            "extensionAttribute6": "Value6",
            "extensionAttribute7": "Value7",
            "extensionAttribute8": "Value8",
            "extensionAttribute9": "Value9",
            "extensionAttribute10": "Value10",
            "extensionAttribute11": "Value11",
            "extensionAttribute12": "Value12",
            "extensionAttribute13": "Value13",
            "extensionAttribute14": "Value14",
            "extensionAttribute15": "Value15"

Add these attributes in the Account Schema and Create Account sections in the SailPoint user interface. To add, use the following format:

onPremisesExtensionAttributes_extensionAttribute1

onPremisesExtensionAttributes_extensionAttribute2

onPremisesExtensionAttributes_extensionAttribute3

onPremisesExtensionAttributes_extensionAttribute4

onPremisesExtensionAttributes_extensionAttribute5

onPremisesExtensionAttributes_extensionAttribute6

onPremisesExtensionAttributes_extensionAttribute7

onPremisesExtensionAttributes_extensionAttribute8

onPremisesExtensionAttributes_extensionAttribute9

onPremisesExtensionAttributes_extensionAttribute10

onPremisesExtensionAttributes_extensionAttribute11

onPremisesExtensionAttributes_extensionAttribute12

onPremisesExtensionAttributes_extensionAttribute13

onPremisesExtensionAttributes_extensionAttribute14

onPremisesExtensionAttributes_extensionAttribute15

Account - Group Management

The Microsoft Entra ID SaaS connector supports managing following group types as an entitlement and as separate group objects. These different types of groups are created for different purpose which are described as follows:

• Microsoft 365 groups (formerly Office 365 groups) are used for collaboration between internal and external users of the company.
• Distribution Lists (Distribution groups) are used for sending notifications to a group of people.
• Security groups are used for granting access to resources such as SharePoint sites.
• Mail-enabled security groups are used for granting access to resources such as SharePoint, and emailing notifications to those users.

The following table describes different conditions or configurations depending on which connector will aggregate different types of groups:

For more information on enabling Aggregate All Groups, refer to Account - Group Management.

For more information on enabling provisioning for Distribution Lists and Mail-Enabled Security Groups, refer to Exchange Online Management.

For more information on enabling Office 365 Groups, refer to Feature Management.

Group Hierarchy Information

This feature shows read-only group hierarchy information. For more information on enabling this feature, refer to Aggregation Settings.

Microsoft Entra Role Management

Microsoft Entra ID SaaS roles allow you to grant granular permissions to your admins, abiding by the principle of least privilege. Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, and applications.

Microsoft Entra supports two types of roles definitions:

• Built-in roles - Built-in roles are out of box roles that have a fixed set of permissions. These role definitions cannot be modified.
• Custom roles - To round off the edges and meet your sophisticated requirements, Microsoft Entra also supports custom roles.

Microsoft Entra roles object type supports the following operations:

• Aggregation of built-in and custom roles as separate group object
• Aggregation of user membership to roles during account aggregation
• Add / Remove built-in and custom roles to Microsoft Entra users

Administrator Permissions

Supported Schema Attributes

To manage the Microsoft Entra role objects, ensure that the attributes present in Roles Attributes are present in the group schema.

Administrative Units

An administrative unit is a Microsoft Entra resource that serves as a container for other Microsoft Entra resources. It can contain only users, groups, or devices. A user can be a member of multiple administrative units.

Supported Operations

This feature supports the following operations:

• Manage administrative units as entitlements.
• Create a user with a single or multiple administrative units.
• Add/Remove administrative units from users.
• Delete administrative units from users.

Administrator Permissions

To fetch administrative units details, the following API permissions must be assigned:

Supported Schema Attributes

To manage the administrative units, ensure administrative units attributes are present in the group schema. For more information, refer to Administrative Units Attributes.

Configure Administrative Unit

1. Go to Feature Management.
2. Select Manage Administrative Units to manage administrative units.

Access Package Management

An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization.

Microsoft Entra ID SaaS access package management can help you manage access to Groups & Teams, Applications, and SharePoint Online sites as a bundle.

The following operations are supported for the Microsoft Entra ID SaaS access packages object type:

• Aggregation of custom access package objects (a combination of access package and policy) as a separate group type.
• Aggregation of user membership to access packages during account aggregation.
• Add and Remove access packages entitlements to users.

Administrator Permissions

For more information on the required permissions, refer to Required Permissions.

Supported Schema Attributes

To manage the Microsoft Entra ID SaaS access package objects, ensure that the attributes in Access Package Attributes are present in the group schema.

To aggregate access packages assigned to the user during account aggregation, ensure the accessPackages attribute is present in account schema. This attribute lists the access packages assigned to the user.

Configure Access Packages in Source

1. Go to Feature Management.
2. Select Manage Access Packages to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off.
3. Select the Manage Hidden Access Packages checkbox to manage access packages hidden from end users in the My Access portal.
4. Select Save.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

For more information, refer to Managing Privilege Classification.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.