Azure Provisioning Policies

Azure PIM Provisioning Policy

Azure /Microsoft Entra ID Eligible/Active Roles

There is no requirement of addition/removal of the existing Create Profile (Provisioning Policy). However, while assigning/removing Azure /Microsoft Entra ID Eligible/Active Role assignment, additional request details can be provided through additional attributes such as the following:

Attribute	Type	Description	Default
duration	String (ISO 8601 duration)	Specifies the duration for which the role needs to be assigned to the user from the current time. For example, if a role needs to be assigned for six months, the duration should be provided as P180D. ISO 8601 duration format must be used. For example: 6 months: P180D 1 week: P7D 8 hours: PT8H Permanent: permanent	For Eligible Role: P365D For Active Role: P180D
startDateTime	Timestamp (ISO 8601, UTC)	It specifies the start date and time from which the role needs to be assigned to the user. It is optional when duration is provided, but required when endDateTime is provided. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2021-11-19T09:40:27.91Z	-
endDateTime	Timestamp (ISO 8601, UTC)	It specifies the end date and time for role assignment of the user. startDateTime must be provided along with this attribute. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2022-11-19T09:40:27.91Z.	-
justification	String	It specifies the reason for the role assignment/removal operation.	Admin Action for <user id>

Azure PIM Active and Eligible Groups

The connector supports adding and removing PIM Active and Eligible group memberships. Additional request details can be provided through additional attributes such as the following:

Attribute	Type	Description	Default
duration	String (ISO 8601)	Schedule duration for the membership. For example: P30D (30 days).	P365D (eligible) / P180D (active)
justification	String	Business justification for the request.	Admin Action for PIM group membership
accessId	String (member or owner)	Whether the principal is assigned as a member or owner of the group.

Sample Provisioning Requests

{
    "ProvisioningPlan": {
        "AccountRequest": {
            "AttributeRequest": [
                {
                    "Value": {
                        "List": {
                            "String": [
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:c2f4ef07-c644-48eb-af81-4b1b4947fb11",
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:a2138dac-4907-4679-a376-736901ed8ad8"
                            ]
                        }
                    },
                    "Attributes": {
                        "Map": {
                            "entry": [
                                {
                                    "key": "duration",
                                    "value": "P10D"
                                },
                                {
                                    "key": "justification",
                                    "value": "Role Required to Manage Subscription"
                                }
                            ]
                        }
                    },
                    "name": "azureActiveRoles",
                    "op": "Add"
                },
                {
                    "Value": {
                        "List": {
                            "String": [
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:5e467623-bb1f-42f4-a55d-6e525e11384b",
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:4f8fab4f-1852-4a58-a46a-8eaf358af14a"
                            ],
                            "entry": {
                                "key": "justification",
                                "value": "Role Required to Manage Dev Resource Group"
                            }
                        }
                    },
                    "Attributes": {
                        "Map": {
                            "entry": [
                                {
                                    "key": "startDateTime",
                                    "value": "2021-11-19T09:40:27.91Z"
                                },
                                {
                                    "key": "endDateTime",
                                    "value": "2021-12-19T09:40:27.91Z"
                                }
                            ]
                        }
                    },
                    "name": "azureEligibleRoles",
                    "op": "Add"
                }
            ],
            "application": "Azure PIM",
            "nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX",
            "op": "Modify"
        },
        "nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX"
    }
}

Account Profile for Service Principal

The following lists the create service principal profile attributes:

Note

Attributes with app in the name are Application object properties and all others are Service Principal object properties.

For example,

spn_app_owners is for directory objects that are owners of the application.
spn_owners is for directory objects that are owners of this service principal.

Attribute Name	Description
spn_appDisplayName	The display name for the application.
spn_homepage	This is the home page or landing page of the application.
spn_loginUrl	Displays the URL where the service provider redirects the user to Microsoft Entra ID to authenticate.
spn_logoutUrl	Displays the URL that will be used by Microsoft's authorization service to log out a user.
description	The description that is displayed in the address book for the user or service principal.
spn_appRoles	The roles exposed by the application that this service principal represents.
spn_app_keyCredentials	The collection of password credentials associated with the application.
spn_tags	The custom strings that can be used to categorize and identify the service principal.
spn_passwordCredentials	The collection of password credentials associated with the application.
spn_app_owners	Directory objects that are owners of the application.
spn_owners	Directory objects that are owners of this servicePrincipal.
spn_app_passwordCredentials	The collection of password credentials associated with the application.
spn_appTemplateName	The name of the template that is used to create the application and service principal.
spn_appTemplateId	The ID of the template that is used to create the application and service principal.
spn_appId	The app ID of the multi-tenant application for which the service principal needs to be created.

Note

When a create Service Principal request is executed, the connector creates the application object first and then the corresponding service principal object is created.
To create the applications from gallery templates, either spn_appTemplateName or spn_appTemplateId needs to be provided in the create request along with spn_appDisplayName. For more information, refer to sample request example 3 and example 4.
To create the service principal for a multi-tenant application, spn_appId needs to provided in the create request, For more information, refer to sample request example 5.

Sample Create Service Principal Requests

Note

For more information on the key credentials and password credentials, refer to Update Policy for Service Accounts.

Example 1

The following create request will create an Application object with the displayName as APAC Sales and its corresponding Service Principal object will also be created:

 <ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Sales"/>
    </AccountRequest>
</ProvisioningPlan>

Example 2

The following create request will create an Application object with the displayName as APAC Production and its corresponding Service Principal object will also be requested, as well as adding group and appRole membership:

<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Production"/>
        <AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>

Example 3

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template named Adobe Identity Management (SAML).

<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateName" op="Add" value="Adobe Identity Management (SAML)" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>

Example 4

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template whose ID is 7ae7dbe9-8351-44c6-a0f0-e4642aa58b19 (The template ID can be retrieved using MS Graph api endpoints).

<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateId" op="Add" value="7ae7dbe9-8351-44c6-a0f0-e4642aa58b19" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>

Example 5

The following create request will create service principal object corresponding to already existing application object who’s appId is 9c41360b-3dcb-4a9e-9bf4-095151f835b1.

<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appId" value="9c41360b-3dcb-4a9e-9bf4-095151f835b1" />
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>

For information on additional configuration attributes, refer to Additional Configuration Parameters.

Update Policy for Service Principals

For Key Credentials

For the already generated X.509 certificate, you need to generate the certificate key using PowerShell so that this key can be used for uploading the certificate on the Azure system.

Generate the Certificate Key Using PowerShell

Read the certificate's key using the following PowerShell command:

[convert]::ToBase64String((Get-Content C:\Users\admin\Desktop\YourCerFile.cer -Encoding byte)) | Out-File -FilePath "C:\Users\admin\Desktop\YourCerFile.key.txt" ##
Replace the file path with the location of your certificate.
provide this generated key against spn_app_keyCredentials as highlighted in Example 1.

For Password Credentials

For generating a new client secret for the service principal/application, you need to provide displayName as highlighted in Example 1.

Generate Client Secret Values

The provisioning request to add spn_passwordCredentials and spn_app_passwordCredentials generates the client ID and client secret for the Service Principal and corresponding Application. The secret an only be viewed once and is available as an API response. The added secrets are available as part the ResourceObject attributes that are returned after the provisioning request is returned successfully.

Client secrets added for Service Principals are added under the key spnPasswordCreated, while client secrets added for Applications are under the key appPasswordsCreated in the returned ResourceObject. Multiple passwords can be added as part of a single AccountRequest. The data type used to store the generated client ID and client secret in the ResourceObject is Map.

The format is as follows:

<entry key="appPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>

<entry key="spnPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>

To fetch the generated client secret, the result of the corresponding AccountRequest needs to be analyzed to get the ResourceObject and perform the required operation to store and secure the secret information.

For example, a the following is a snippet to view the ResourceObject from the provisioning result:

plan.getAccountRequests().get(0).getResult().getObject().toxml()

The following are sample update service principal requests:

Example 1

The following modify request will add/update basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

 <ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="displayName" op="Set" value="EMEA Sales"/>
        <AttributeRequest name="spn_homepage" op="Set" value="http://example.com"/>
        <AttributeRequest name="spn_loginUrl" op="Set" value="http://example.com/login"/>
        <AttributeRequest name="spn_logoutUrl" op="Set" value="http://example.com/logout"/>
        <AttributeRequest name="description" op="Set" value="This is a test application"/>
        <AttributeRequest name="spn_appRoles" op="Add" value="{"allowedMemberTypes":["User"],"description":"Just a test role","displayName":"Test Role","id":"f1c8de3d-1fea-4d7c-a8b0-29f63cac3454","isEnabled":true,"origin":"Application","value":"TestRole"}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMT...."}"/>
        <AttributeRequest name="spn_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMTA1MDg1..."}"/>
        <AttributeRequest name="spn_tags" op="Set" value="Test Applications"/>
        <AttributeRequest name="spn_passwordCredentials" op="Add" value="{displayName="Test SPN Password"}"/>
        <AttributeRequest name="spn_app_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Add" value="{displayName="Test APP Password 2"}"/>
    </AccountRequest>
</ProvisioningPlan>

Example 2

The following modify request will remove basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

<ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="spn_appRoles" op="Remove" value="{id&quot;:&quot;f1c3de3d-1fea-4d7c-a8b0-29f63cac3454&quot;,&quot;isEnabled&quot;:true,&quot;origin&quot;:&quot;Application&quot;,&quot;value&quot;:&quot;TestRole&quot;}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;keyId&quot;:&quot;1beaebc0-83be-4cb3-b33a-0b2f03231638&quot;}"/>
        <AttributeRequest name="spn_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;key&quot;:&quot;82cf0d7c-457a-4592-b6a6-62889b526a3e&quot;}"/>
        <AttributeRequest name="spn_tags" op="Remove" value="Unit Test Description"/>
        <AttributeRequest name="spn_passwordCredentials" op="Remove" value="{&quot;keyId&quot;: &quot;8624a905-2e95-4906-b83e-ef9306531601&quot;}"/>
        <AttributeRequest name="spn_app_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Remove">
            <Value>
                <List>
                    <String>{&quot;keyId&quot;: &quot;5b76b745-3edf-4ce7-925e-114926ab8ec9&quot;}</String>
                    <String>{&quot;keyId&quot;: &quot;be899d38-e390-414d-aa9d-b9078b5615cb&quot;}</String>
                </List>
            </Value>
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.