# Azure Provisioning Policies

## Azure PIM Provisioning Policy

### Azure /Microsoft Entra ID Eligible/Active Roles

There is no requirement of addition/removal of the existing Create Profile (Provisioning Policy). However, while assigning/removing Azure /Microsoft Entra ID Eligible/Active Role assignment, additional request details can be provided through additional attributes such as the following:

<table> <thead> <tr> <th>Attribute</th> <th>Type</th> <th>Description</th> <th>Default</th> </tr> </thead> <tbody> <tr> <td>duration</td> <td>String (ISO 8601 duration)</td> <td>Specifies the duration for which the role needs to be assigned to the user from the current time.<br>For example, if a role needs to be assigned for six months, the duration should be provided as P180D.<br>ISO 8601 duration format must be used. For example:<br><ul><li>6 months: P180D</li><li>1 week: P7D</li><li>8 hours: PT8H</li><li>Permanent: permanent</li></ul></td> <td>For Eligible Role: P365D<br>For Active Role: P180D</td> </tr> <tr> <td>startDateTime</td> <td>Timestamp (ISO 8601, UTC)</td> <td>It specifies the start date and time from which the role needs to be assigned to the user. It is optional when duration is provided, but required when endDateTime is provided.<br>The timestamp type represents date and time information using ISO 8601 format and is always in UTC time.<br>For example, 2021-11-19T09:40:27.91Z</td> <td>-</td> </tr> <tr> <td>endDateTime</td> <td>Timestamp (ISO 8601, UTC)</td> <td>It specifies the end date and time for role assignment of the user. startDateTime must be provided along with this attribute.<br>The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2022-11-19T09:40:27.91Z.</td> <td>-</td> </tr> <tr> <td>justification</td> <td>String</td> <td>It specifies the reason for the role assignment/removal operation.</td> <td>Admin Action for &lt;user id&gt;</td> </tr> </tbody> </table>

### Azure PIM Active and Eligible Groups

The connector supports adding and removing PIM Active and Eligible group memberships. Additional request details can be provided through additional attributes such as the following:

| Attribute | Type | Description | Default |
| --- | --- | --- | --- |
| duration | String (ISO 8601) | Schedule duration for the membership. For example: P30D (30 days). | P365D (eligible) / P180D (active) |
| justification | String | Business justification for the request. | Admin Action for PIM group membership |
| accessId | String (member or owner) | Whether the principal is assigned as a member or owner of the group. |  |

### Sample Provisioning Requests

```text
{
    "ProvisioningPlan": {
        "AccountRequest": {
            "AttributeRequest": [
                {
                    "Value": {
                        "List": {
                            "String": [
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:c2f4ef07-c644-48eb-af81-4b1b4947fb11",
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:a2138dac-4907-4679-a376-736901ed8ad8"
                            ]
                        }
                    },
                    "Attributes": {
                        "Map": {
                            "entry": [
                                {
                                    "key": "duration",
                                    "value": "P10D"
                                },
                                {
                                    "key": "justification",
                                    "value": "Role Required to Manage Subscription"
                                }
                            ]
                        }
                    },
                    "name": "azureActiveRoles",
                    "op": "Add"
                },
                {
                    "Value": {
                        "List": {
                            "String": [
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:5e467623-bb1f-42f4-a55d-6e525e11384b",
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:4f8fab4f-1852-4a58-a46a-8eaf358af14a"
                            ],
                            "entry": {
                                "key": "justification",
                                "value": "Role Required to Manage Dev Resource Group"
                            }
                        }
                    },
                    "Attributes": {
                        "Map": {
                            "entry": [
                                {
                                    "key": "startDateTime",
                                    "value": "2021-11-19T09:40:27.91Z"
                                },
                                {
                                    "key": "endDateTime",
                                    "value": "2021-12-19T09:40:27.91Z"
                                }
                            ]
                        }
                    },
                    "name": "azureEligibleRoles",
                    "op": "Add"
                }
            ],
            "application": "Azure PIM",
            "nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX",
            "op": "Modify"
        },
        "nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX"
    }
}
```

## Account Profile for Service Principal

The following lists the create service principal profile attributes:

> [!NOTE]
>
> Attributes with *app* in the name are Application object properties and all others are Service Principal object properties.
>
> For example,
>
> - spn\_app\_owners is for directory objects that are owners of the *application*.
> - spn\_owners is for directory objects that are owners of this *service principal*.

| Attribute Name | Description |
| --- | --- |
| spn\_appDisplayName | The display name for the application. |
| spn\_homepage | This is the home page or landing page of the application. |
| spn\_loginUrl | Displays the URL where the service provider redirects the user to Microsoft Entra ID to authenticate. |
| spn\_logoutUrl | Displays the URL that will be used by Microsoft's authorization service to log out a user. |
| description | The description that is displayed in the address book for the user or service principal. |
| spn\_appRoles | The roles exposed by the application that this service principal represents. |
| spn\_app\_keyCredentials | The collection of password credentials associated with the application. |
| spn\_tags | The custom strings that can be used to categorize and identify the service principal. |
| spn\_passwordCredentials | The collection of password credentials associated with the application. |
| spn\_app\_owners | Directory objects that are owners of the application. |
| spn\_owners | Directory objects that are owners of this servicePrincipal. |
| spn\_app\_passwordCredentials | The collection of password credentials associated with the application. |
| spn\_appTemplateName | The name of the template that is used to create the application and service principal. |
| spn\_appTemplateId | The ID of the template that is used to create the application and service principal. |
| spn\_appId | The app ID of the multi-tenant application for which the service principal needs to be created. |

> [!NOTE]
>
> - When a create Service Principal request is executed, the connector creates the application object first and then the corresponding service principal object is created.
> - To create the applications from gallery templates, either **spn\_appTemplateName** or **spn\_appTemplateId** needs to be provided in the create request along with **spn\_appDisplayName**. For more information, refer to sample request [example 3](<#account-profile-for-service-principal>) and [example 4](<#account-profile-for-service-principal>).
> - To create the service principal for a multi-tenant application, **spn\_appId** needs to provided in the create request, For more information, refer to sample request [example 5](<#account-profile-for-service-principal>).

### Sample Create Service Principal Requests

> [!NOTE]
>
> For more information on the key credentials and password credentials, refer to [Update Policy for Service Accounts](<#update-policy-for-service-principals>).

#### Example 1

The following create request will create an Application object with the displayName as APAC Sales and its corresponding Service Principal object will also be created:

```text
 <ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Sales"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

The following create request will create an Application object with the displayName as APAC Production and its corresponding Service Principal object will also be requested, as well as adding group and appRole membership:

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Production"/>
        <AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 3

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template named Adobe Identity Management (SAML).

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateName" op="Add" value="Adobe Identity Management (SAML)" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 4

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template whose ID is 7ae7dbe9-8351-44c6-a0f0-e4642aa58b19 (The template ID can be retrieved using MS Graph api endpoints).

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateId" op="Add" value="7ae7dbe9-8351-44c6-a0f0-e4642aa58b19" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 5

The following create request will create service principal object corresponding to already existing application object who’s appId is 9c41360b-3dcb-4a9e-9bf4-095151f835b1.

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appId" value="9c41360b-3dcb-4a9e-9bf4-095151f835b1" />
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

For information on additional configuration attributes, refer to [Additional Configuration Parameters](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>).

## Update Policy for Service Principals

### For Key Credentials

For the already generated X.509 certificate, you need to generate the certificate key using PowerShell so that this key can be used for uploading the certificate on the Azure system.

Generate the Certificate Key Using PowerShell

1. Read the certificate's key using the following PowerShell command:

   `[convert]::ToBase64String((Get-Content C:\Users\admin\Desktop\YourCerFile.cer -Encoding byte)) | Out-File -FilePath "C:\Users\admin\Desktop\YourCerFile.key.txt" ##`
2. Replace the file path with the location of your certificate.
3. provide this generated key against `spn_app_keyCredentials` as highlighted in Example 1.

### For Password Credentials

For generating a new client secret for the service principal/application, you need to provide `displayName` as highlighted in Example 1.

Generate Client Secret Values

The provisioning request to add `spn_passwordCredentials` and `spn_app_passwordCredentials` generates the client ID and client secret for the Service Principal and corresponding Application. The secret an only be viewed once and is available as an API response. The added secrets are available as part the `ResourceObject` attributes that are returned after the provisioning request is returned successfully.

Client secrets added for Service Principals are added under the key `spnPasswordCreated`, while client secrets added for Applications are under the key `appPasswordsCreated` in the returned `ResourceObject`. Multiple passwords can be added as part of a single `AccountRequest`. The data type used to store the generated client ID and client secret in the `ResourceObject` is *Map*.

The format is as follows:

```text
<entry key="appPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>

<entry key="spnPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>
```

1. To fetch the generated client secret, the result of the corresponding `AccountRequest` needs to be analyzed to get the `ResourceObject` and perform the required operation to store and secure the secret information.

   For example, a the following is a snippet to view the `ResourceObject` from the provisioning result:

   `plan.getAccountRequests().get(0).getResult().getObject().toxml()`

The following are sample update service principal requests:

#### Example 1

The following modify request will add/update basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

```text
 <ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="displayName" op="Set" value="EMEA Sales"/>
        <AttributeRequest name="spn_homepage" op="Set" value="http://example.com"/>
        <AttributeRequest name="spn_loginUrl" op="Set" value="http://example.com/login"/>
        <AttributeRequest name="spn_logoutUrl" op="Set" value="http://example.com/logout"/>
        <AttributeRequest name="description" op="Set" value="This is a test application"/>
        <AttributeRequest name="spn_appRoles" op="Add" value="{"allowedMemberTypes":["User"],"description":"Just a test role","displayName":"Test Role","id":"f1c8de3d-1fea-4d7c-a8b0-29f63cac3454","isEnabled":true,"origin":"Application","value":"TestRole"}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMT...."}"/>
        <AttributeRequest name="spn_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMTA1MDg1..."}"/>
        <AttributeRequest name="spn_tags" op="Set" value="Test Applications"/>
        <AttributeRequest name="spn_passwordCredentials" op="Add" value="{displayName="Test SPN Password"}"/>
        <AttributeRequest name="spn_app_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Add" value="{displayName="Test APP Password 2"}"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

The following modify request will remove basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

```text
<ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="spn_appRoles" op="Remove" value="{id&quot;:&quot;f1c3de3d-1fea-4d7c-a8b0-29f63cac3454&quot;,&quot;isEnabled&quot;:true,&quot;origin&quot;:&quot;Application&quot;,&quot;value&quot;:&quot;TestRole&quot;}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;keyId&quot;:&quot;1beaebc0-83be-4cb3-b33a-0b2f03231638&quot;}"/>
        <AttributeRequest name="spn_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;key&quot;:&quot;82cf0d7c-457a-4592-b6a6-62889b526a3e&quot;}"/>
        <AttributeRequest name="spn_tags" op="Remove" value="Unit Test Description"/>
        <AttributeRequest name="spn_passwordCredentials" op="Remove" value="{&quot;keyId&quot;: &quot;8624a905-2e95-4906-b83e-ef9306531601&quot;}"/>
        <AttributeRequest name="spn_app_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Remove">
            <Value>
                <List>
                    <String>{&quot;keyId&quot;: &quot;5b76b745-3edf-4ce7-925e-114926ab8ec9&quot;}</String>
                    <String>{&quot;keyId&quot;: &quot;be899d38-e390-414d-aa9d-b9078b5615cb&quot;}</String>
                </List>
            </Value>
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```