# SailPoint Microsoft Entra ID Connector Documentation

> Microsoft Entra ID Connector Documentation

# Documentation

# Azure Provisioning Policies

## Azure PIM Provisioning Policy

### Azure /Microsoft Entra ID Eligible/Active Roles

There is no requirement of addition/removal of the existing Create Profile (Provisioning Policy). However, while assigning/removing Azure /Microsoft Entra ID Eligible/Active Role assignment, additional request details can be provided through additional attributes such as the following:

<table> <thead> <tr> <th>Attribute</th> <th>Type</th> <th>Description</th> <th>Default</th> </tr> </thead> <tbody> <tr> <td>duration</td> <td>String (ISO 8601 duration)</td> <td>Specifies the duration for which the role needs to be assigned to the user from the current time.<br>For example, if a role needs to be assigned for six months, the duration should be provided as P180D.<br>ISO 8601 duration format must be used. For example:<br><ul><li>6 months: P180D</li><li>1 week: P7D</li><li>8 hours: PT8H</li><li>Permanent: permanent</li></ul></td> <td>For Eligible Role: P365D<br>For Active Role: P180D</td> </tr> <tr> <td>startDateTime</td> <td>Timestamp (ISO 8601, UTC)</td> <td>It specifies the start date and time from which the role needs to be assigned to the user. It is optional when duration is provided, but required when endDateTime is provided.<br>The timestamp type represents date and time information using ISO 8601 format and is always in UTC time.<br>For example, 2021-11-19T09:40:27.91Z</td> <td>-</td> </tr> <tr> <td>endDateTime</td> <td>Timestamp (ISO 8601, UTC)</td> <td>It specifies the end date and time for role assignment of the user. startDateTime must be provided along with this attribute.<br>The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2022-11-19T09:40:27.91Z.</td> <td>-</td> </tr> <tr> <td>justification</td> <td>String</td> <td>It specifies the reason for the role assignment/removal operation.</td> <td>Admin Action for &lt;user id&gt;</td> </tr> </tbody> </table>

### Azure PIM Active and Eligible Groups

The connector supports adding and removing PIM Active and Eligible group memberships. Additional request details can be provided through additional attributes such as the following:

| Attribute | Type | Description | Default |
| --- | --- | --- | --- |
| duration | String (ISO 8601) | Schedule duration for the membership. For example: P30D (30 days). | P365D (eligible) / P180D (active) |
| justification | String | Business justification for the request. | Admin Action for PIM group membership |
| accessId | String (member or owner) | Whether the principal is assigned as a member or owner of the group. |  |

### Sample Provisioning Requests

```text
{
    "ProvisioningPlan": {
        "AccountRequest": {
            "AttributeRequest": [
                {
                    "Value": {
                        "List": {
                            "String": [
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:c2f4ef07-c644-48eb-af81-4b1b4947fb11",
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:a2138dac-4907-4679-a376-736901ed8ad8"
                            ]
                        }
                    },
                    "Attributes": {
                        "Map": {
                            "entry": [
                                {
                                    "key": "duration",
                                    "value": "P10D"
                                },
                                {
                                    "key": "justification",
                                    "value": "Role Required to Manage Subscription"
                                }
                            ]
                        }
                    },
                    "name": "azureActiveRoles",
                    "op": "Add"
                },
                {
                    "Value": {
                        "List": {
                            "String": [
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:5e467623-bb1f-42f4-a55d-6e525e11384b",
                                "/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:4f8fab4f-1852-4a58-a46a-8eaf358af14a"
                            ],
                            "entry": {
                                "key": "justification",
                                "value": "Role Required to Manage Dev Resource Group"
                            }
                        }
                    },
                    "Attributes": {
                        "Map": {
                            "entry": [
                                {
                                    "key": "startDateTime",
                                    "value": "2021-11-19T09:40:27.91Z"
                                },
                                {
                                    "key": "endDateTime",
                                    "value": "2021-12-19T09:40:27.91Z"
                                }
                            ]
                        }
                    },
                    "name": "azureEligibleRoles",
                    "op": "Add"
                }
            ],
            "application": "Azure PIM",
            "nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX",
            "op": "Modify"
        },
        "nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX"
    }
}
```

## Account Profile for Service Principal

The following lists the create service principal profile attributes:

> [!NOTE]
>
> Attributes with *app* in the name are Application object properties and all others are Service Principal object properties.
>
> For example,
>
> - spn\_app\_owners is for directory objects that are owners of the *application*.
> - spn\_owners is for directory objects that are owners of this *service principal*.

| Attribute Name | Description |
| --- | --- |
| spn\_appDisplayName | The display name for the application. |
| spn\_homepage | This is the home page or landing page of the application. |
| spn\_loginUrl | Displays the URL where the service provider redirects the user to Microsoft Entra ID to authenticate. |
| spn\_logoutUrl | Displays the URL that will be used by Microsoft's authorization service to log out a user. |
| description | The description that is displayed in the address book for the user or service principal. |
| spn\_appRoles | The roles exposed by the application that this service principal represents. |
| spn\_app\_keyCredentials | The collection of password credentials associated with the application. |
| spn\_tags | The custom strings that can be used to categorize and identify the service principal. |
| spn\_passwordCredentials | The collection of password credentials associated with the application. |
| spn\_app\_owners | Directory objects that are owners of the application. |
| spn\_owners | Directory objects that are owners of this servicePrincipal. |
| spn\_app\_passwordCredentials | The collection of password credentials associated with the application. |
| spn\_appTemplateName | The name of the template that is used to create the application and service principal. |
| spn\_appTemplateId | The ID of the template that is used to create the application and service principal. |
| spn\_appId | The app ID of the multi-tenant application for which the service principal needs to be created. |

> [!NOTE]
>
> - When a create Service Principal request is executed, the connector creates the application object first and then the corresponding service principal object is created.
> - To create the applications from gallery templates, either **spn\_appTemplateName** or **spn\_appTemplateId** needs to be provided in the create request along with **spn\_appDisplayName**. For more information, refer to sample request [example 3](<#account-profile-for-service-principal>) and [example 4](<#account-profile-for-service-principal>).
> - To create the service principal for a multi-tenant application, **spn\_appId** needs to provided in the create request, For more information, refer to sample request [example 5](<#account-profile-for-service-principal>).

### Sample Create Service Principal Requests

> [!NOTE]
>
> For more information on the key credentials and password credentials, refer to [Update Policy for Service Accounts](<#update-policy-for-service-principals>).

#### Example 1

The following create request will create an Application object with the displayName as APAC Sales and its corresponding Service Principal object will also be created:

```text
 <ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Sales"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

The following create request will create an Application object with the displayName as APAC Production and its corresponding Service Principal object will also be requested, as well as adding group and appRole membership:

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appDisplayName" op="Add" value="APAC Production"/>
        <AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 3

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template named Adobe Identity Management (SAML).

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateName" op="Add" value="Adobe Identity Management (SAML)" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 4

The following create request will create an Application object with the displayName as Adobe Identity Management-App and its corresponding Service Principal object making use of the template whose ID is 7ae7dbe9-8351-44c6-a0f0-e4642aa58b19 (The template ID can be retrieved using MS Graph api endpoints).

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appTemplateId" op="Add" value="7ae7dbe9-8351-44c6-a0f0-e4642aa58b19" />
        <AttributeRequest name="spn_appDisplayName" op="Add" value="Adobe Identity Management-App"/>
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 5

The following create request will create service principal object corresponding to already existing application object who’s appId is 9c41360b-3dcb-4a9e-9bf4-095151f835b1.

```text
<ProvisioningPlan>
    <AccountRequest op="Create">
        <AttributeRequest name="spn_appId" value="9c41360b-3dcb-4a9e-9bf4-095151f835b1" />
<AttributeRequest name="appRoleAssignments" op="Add" value="6f749413-fc45-4a47-a69b-0e100e0fbda1:00000000-0000-0000-0000-000000000000"/>
        <AttributeRequest name="groups" op="Add" value="2402e965-2000-4545-b371-0db81b6db745"/>
    </AccountRequest>
</ProvisioningPlan>
```

For information on additional configuration attributes, refer to [Additional Configuration Parameters](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>).

## Update Policy for Service Principals

### For Key Credentials

For the already generated X.509 certificate, you need to generate the certificate key using PowerShell so that this key can be used for uploading the certificate on the Azure system.

Generate the Certificate Key Using PowerShell

1. Read the certificate's key using the following PowerShell command:

   `[convert]::ToBase64String((Get-Content C:\Users\admin\Desktop\YourCerFile.cer -Encoding byte)) | Out-File -FilePath "C:\Users\admin\Desktop\YourCerFile.key.txt" ##`
2. Replace the file path with the location of your certificate.
3. provide this generated key against `spn_app_keyCredentials` as highlighted in Example 1.

### For Password Credentials

For generating a new client secret for the service principal/application, you need to provide `displayName` as highlighted in Example 1.

Generate Client Secret Values

The provisioning request to add `spn_passwordCredentials` and `spn_app_passwordCredentials` generates the client ID and client secret for the Service Principal and corresponding Application. The secret an only be viewed once and is available as an API response. The added secrets are available as part the `ResourceObject` attributes that are returned after the provisioning request is returned successfully.

Client secrets added for Service Principals are added under the key `spnPasswordCreated`, while client secrets added for Applications are under the key `appPasswordsCreated` in the returned `ResourceObject`. Multiple passwords can be added as part of a single `AccountRequest`. The data type used to store the generated client ID and client secret in the `ResourceObject` is *Map*.

The format is as follows:

```text
<entry key="appPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>

<entry key="spnPasswordsCreated">
    <value>
        <Map>
            <entry key="<Client ID Friendly Name>::<Client ID>" value="<Client Secret>"/>
        </Map>
    </value>
</entry>
```

1. To fetch the generated client secret, the result of the corresponding `AccountRequest` needs to be analyzed to get the `ResourceObject` and perform the required operation to store and secure the secret information.

   For example, a the following is a snippet to view the `ResourceObject` from the provisioning result:

   `plan.getAccountRequests().get(0).getResult().getObject().toxml()`

The following are sample update service principal requests:

#### Example 1

The following modify request will add/update basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

```text
 <ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="displayName" op="Set" value="EMEA Sales"/>
        <AttributeRequest name="spn_homepage" op="Set" value="http://example.com"/>
        <AttributeRequest name="spn_loginUrl" op="Set" value="http://example.com/login"/>
        <AttributeRequest name="spn_logoutUrl" op="Set" value="http://example.com/logout"/>
        <AttributeRequest name="description" op="Set" value="This is a test application"/>
        <AttributeRequest name="spn_appRoles" op="Add" value="{"allowedMemberTypes":["User"],"description":"Just a test role","displayName":"Test Role","id":"f1c8de3d-1fea-4d7c-a8b0-29f63cac3454","isEnabled":true,"origin":"Application","value":"TestRole"}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMT...."}"/>
        <AttributeRequest name="spn_keyCredentials" op="Add" value="{"type":"AsymmetricX509Cert","usage":"Verify","key":"MIIC4jCCAcqgAwIBAgIQY7nIg+dBqrdGxTg6pJQ3GTANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9ERVNLVE9QLURWNDFHU0wwHhcNMjIwMTA1MDg1..."}"/>
        <AttributeRequest name="spn_tags" op="Set" value="Test Applications"/>
        <AttributeRequest name="spn_passwordCredentials" op="Add" value="{displayName="Test SPN Password"}"/>
        <AttributeRequest name="spn_app_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Add" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Add" value="{displayName="Test APP Password 2"}"/>
    </AccountRequest>
</ProvisioningPlan>
```

#### Example 2

The following modify request will remove basic attributes for SPN, appRoles, keyCredentials, and some application properties such as owners:

```text
<ProvisioningPlan>
    <AccountRequest op="Modify" nativeIdentity="23070dd0-52a0-4692-ab8c-c21fc9c72505:aa0df863-3e47-42b0-a562-274677c63189">
        <AttributeRequest name="spn_appRoles" op="Remove" value="{id&quot;:&quot;f1c3de3d-1fea-4d7c-a8b0-29f63cac3454&quot;,&quot;isEnabled&quot;:true,&quot;origin&quot;:&quot;Application&quot;,&quot;value&quot;:&quot;TestRole&quot;}"/>
        <AttributeRequest name="spn_app_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;keyId&quot;:&quot;1beaebc0-83be-4cb3-b33a-0b2f03231638&quot;}"/>
        <AttributeRequest name="spn_keyCredentials" op="Remove" value="{&quot;type&quot;:&quot;AsymmetricX509Cert&quot;,&quot;usage&quot;:&quot;Verify&quot;,&quot;key&quot;:&quot;82cf0d7c-457a-4592-b6a6-62889b526a3e&quot;}"/>
        <AttributeRequest name="spn_tags" op="Remove" value="Unit Test Description"/>
        <AttributeRequest name="spn_passwordCredentials" op="Remove" value="{&quot;keyId&quot;: &quot;8624a905-2e95-4906-b83e-ef9306531601&quot;}"/>
        <AttributeRequest name="spn_app_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_owners" op="Remove" value="dd315fd1-1af4-43a7-a050-c5ab968c6dde"/>
        <AttributeRequest name="spn_app_passwordCredentials" op="Remove">
            <Value>
                <List>
                    <String>{&quot;keyId&quot;: &quot;5b76b745-3edf-4ce7-925e-114926ab8ec9&quot;}</String>
                    <String>{&quot;keyId&quot;: &quot;be899d38-e390-414d-aa9d-b9078b5615cb&quot;}</String>
                </List>
            </Value>
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```

# Configuring Microsoft Entra ID for Integration

This section describes the various configurations to be performed to support the following features:

## Microsoft Graph API

Microsoft recommends the use of Microsoft Graph API instead of the Azure Active Directory Graph API. Microsoft has stopped addition of new feature in the Azure Active Directory API. The Microsoft Entra ID connector has been enhanced to use the Microsoft Graph API completely.

- To enable using the latest attributes and features supported by Microsoft Graph API, set the value of `useMSGraphAPI` attribute to `true`.
- The default Microsoft Graph API version is "v1.0". To use another version, specify the version in the in `msgraph-api-version` attribute in the connector configuration. For example, you can set the API version by adding `msgraph-api-version` with a value of `"v1.0"`.

For more information, refer to [Additional Configuration Parameters](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>).

## SAML Request Body

The SAML Request Body must consists of the following:

- SAML Request must have MicrosoftOnline as the intended audience
- Username in the request must be replaced by the **username** placeholder
- Password in the request must be replaced by **password** placeholder

The following is an example of a SAML Request Body:

**Authorization Endpoint**: `https://<YOUR_DOMAIN>/adfs/services/trust/2005/usernamemixed`

**SAML Request**:

```text
<s:Envelope xmlns:s='http://www.w3.org/2003/05/soap-envelope'
xmlns:a='http://www.w3.org/2005/08/addressing'
xmlns:u='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'>
  <s:Header><a:Action s:mustUnderstand='1'>http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
  </a:Action>
<a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo>
        <a:To s:mustUnderstand='1'>https://<YOUR_DOMAIN>/adfs/services/trust/2005/usernamemixed</a:To>
          <o:Security s:mustUnderstand='1'
          xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
            <o:UsernameToken u:Id='uuid-<user’s object id>'>
        <o:Username>$username$</o:Username>
        <o:Password>$password$</o:Password></o:UsernameToken>
    </o:Security>
    </s:Header>
    <s:Body>
            <trust:RequestSecurityToken xmlns:trust='http://schemas.xmlsoap.org/ws/2005/02/trust'>
            <wsp:AppliesTo xmlns:wsp='http://schemas.xmlsoap.org/ws/2004/09/policy'>
            <a:EndpointReference>
            <a:Address>urn:federation:MicrosoftOnline</a:Address>
            </a:EndpointReference>
            </wsp:AppliesTo>
            <trust:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</trust:KeyType>
            <trust:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</trust:RequestType>
            </trust:RequestSecurityToken>
  </s:Body>
</s:Envelope>
```

## Assigning ServicePrincipal

While providing the role id from policy, if you have configured a policy for specifying role id, then this role id is used for provisioning of all ServicePrincipals in a request. Therefore, you must provision one ServicePrincipal in one request.

While providing an access to a ServicePrincipal, it is mandatory to provide an access role for the user. These access roles may differ depending upon the **ServicePrincipal** type. SailPoint uses one of the access roles it receives for each ServicePrincipal during the aggregation of ServicePrincipals.

> [!NOTE]
>
> The `servicePrincipalRoleId` attribute must be added in Update Account Policy while assigning ServicePrincipals from Request Access.

## Assigning Application Permissions

This section provides details about assigning application permissions from Portal and using PowerShell.

### Assigning Application Permission from Portal

- Select **API permissions** section registered App in Microsoft Entra ID console. Select **Add a permission**.
- On the **Request API permissions** page a list of supported APIs is listed.

  - **Microsoft Graph** can be found under Commonly used Microsoft APIs.
- Select the type of permission as **Delegated** or **Application** under **What type of permissions does your application require?**
- Under **Select permissions**, select the required permissions.
- Select **Add permissions**.

In Grant consent, select **Grant** Admin Consent for your configuration and directory. On the pop-up dialog box, select **Yes**.

### Assigning Application Role Using PowerShell

The following are the prerequisite for the PowerShell commands.

- Microsoft Online Services Sign-In Assistant for IT Professionals RTW
- [Azure Active Directory Module for Windows PowerShell](<https://learn.microsoft.com/en-us/powershell/entra-powershell/installation?view=entra-powershell&amp;tabs=powershell%2Cv1&amp;pivots=windows#prerequisites-on-windows>)

> [!NOTE]
>
> These prerequisites are not required for the Microsoft Entra ID connector to function. These can be installed on any system for temporary use to provide required role to the application on Azure.

After installing the prerequisites, open **Azure Active Directory Module for Windows PowerShell** console and execute the following commands:

- `Connect-msolservice`, press enter, provide Azure administrator credentials.
- Execute `Get-MsolServicePrincipal | ft DisplayName, AppPrincipalId -Autosize`
- Locate your application name and copy the **ObjectId** value.
- Execute`$ClientObjID = '<copied objectId of the application in the previous step>'`
- Execute `$webApp = Get-MsolServicePrincipal -AppPrincipalId $ClientObjID`
- Execute `Add-MsolRoleMember -RoleName "Global Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $webapp.ObjectId`

## Service Plan Management (managing Licenses)

The Microsoft Entra ID connector supports assigning different Azure services licenses to the users. The connector provides options to assign license either by individual plan or as a whole license pack.

- **Assigning license plan**: Office 365 license pack consist of licenses for individual services. For example, Exchange Online or SharePoint Online.
- The connector models the `assignedPlans` attribute from account schema as an entitlement. It can be requested as an entitlement during Create or Update operations for Identities.
- **Assigning license pack**: To assign license pack, set the `assignedLicenses` attribute from account schema as Managed, Entitlement, or Multi-Valued, so that it is requestable as an entitlement.

> [!NOTE]
>
> - It is recommended that `assignedPlans` or `assignedLicenses` must be promoted as an entitlement to avoid conflicts.
> - To provision the licenses or plans to user, set the user’s `usageLocation` property correctly.

> [!IMPORTANT]
>
> - If you use group-based licensing, licenses are assigned or removed based on group membership. To avoid concurrency errors, do not mark the `assignedPlans` attribute in the account schema as an entitlement.
> - When `assignedPlans` are managed by a group, do not use `assignedPlans` as entitlements in the account schema.

Service Plan now has separate group schema attributes. For a detailed list of the attributes, refer to [Service Plan](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#service-plan>).

The following operations are supported for the Service Plan object type:

- Aggregation
- View details of Service Plan (like object properties, members and so on)
- Assign and Revoke access request for Service Plan (entitlement attribute - `assignedPlans` or `assignedLicenses`)

## Generating a Refresh Token

Perform the following steps to generate the Refresh Token:

1. Obtain the authorization code using the following request. This process involves user consent.

   ```text
   client_id=<clinetId>
   &response_type=code
   &redirect_uri=<redirect_uri>
   &response_mode=query
   &scope=offline_access%20https://graph.microsoft.com/.default
   &state=<randomnumber>
   ```

   Parameters details:

   | Parameter | Description |
   | --- | --- |
   | client\_id | Client ID of the registered application. |
   | response\_type | For authorization code the value must be code. |
   | redirect\_uri | This should be redirect uri configured while registering the application. This should be pointed to localhost and any unused port. |
   | response\_mode | To get the code to in string parameter on your redirect URI, it should be query. |
   | scope | Here multiple scopes can be added for defining the required API. |

   The default added scope is [https://graph.microsoft.com/.default](<https://graph.microsoft.com/.default>).

   The refreshToken parameter is also required for configuration. The **offline\_access** scope must be added.

   | Parameter | Description |
   | --- | --- |
   | state | This can be any random number. Same value will be returned along with authorization code. |

   The Response in browser address bar would be displayed as follows:

   `https://localhost:44320/?code=OAQABAAIAAAAm-06blBE1TpVMil8KPQ41U9-...&state=1234566&session_state=9557b1f1-0fd8-4e12-a39f-213cfcd12153`

   Copy the code present between **code=** and &amp;state.

   > **Note**
   >
   > The received Authorization Code can be used only once and is valid for a short duration.
2. Obtain the Refresh Token as follows using the Auth Code obtained in the above step:

   The Auth Code received from the previous steps must be passed in the following request along with other parameters in following request:

   ```text
       POST https://login.microsoftonline.com/{{Your Domain name}}/oauth2/v2.0/token
        Content-Type: application/x-www-form-urlencoded
   client_id=<clinet id >
   &scope=offline_access%20https://graph.microsoft.com/.default
       &code=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr...
       &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
       &grant_type=authorization_code
       &client_secret=JqQX2PNo9bpM0uEihUPzyrh
   ```

   Following are the newly added parameters:

   | Parameter | Description |
   | --- | --- |
   | code | Authorization code obtained in previous steps. |
   | grant\_type | As you intend to redeem the Auth Code it should be **authorization\_code**. |
   | client\_secret | Client Secret of the registered application. |

   **Response**:

   ```text
   {
       "token_type": "Bearer",
       "scope": "https://graph.windows.net/Directory.Read.All
       https://graph.windows.net/User.Read https://graph.windows.net/.default",
       "expires_in": 7199,
       "ext_expires_in": 7199,
       "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlNzWnNCT
       mhaY0YzUTlTNHRycFFCVEJ5TlJSSSIsImtpZCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlJSSSJ9
       .eyJhdWQiOiJodHRwczovL2dyYXBoLndpbmRvd3MubmV0Iiwia...",
       "refresh_token": "OAQABAAAAAAAm-06blBE1TpVMil8KPQ410LOG6EPVxGfgH8rHUXApUs5fPFtel9FsKTXo2oN8Rw
       _ngEOpKNt1hfufYyJJnG39XxfscpcW...."
   }
   ```

   Copy the **Refresh Token** received in the response.

## Support for Provisioning Operations of `manager` Attribute

The Microsoft Entra ID connector supports the `manager` attribute for the following:

- **Account Aggregation** (Full and Delta): On Account Aggregation, the `manager` attribute for a user populates for a non-null (blank) value on the Microsoft Entra managed system. Add the `manager` attribute in the account schema with the string type. For more information on adding attributes to the account schema, refer to [Editing an Account Schema](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>).
- **Provisioning**: The `manager` attribute is supported for the Add, Remove, and Set operations where the value of the manager can be set as either `objectId` or the `userPrincipalName`. Add the `manager` attribute in the Provisioning policy. The blank value in the **Set** operation is applicable to remove the `manager` value at the Microsoft Entra managed system.

## Sponsors for Guest User (B2B) and External Member (B2B)

The sponsor feature helps manage B2B users in your directory by tracking who is responsible for each guest user. While entitlement management can monitor guests from certain domains, it does not cover guests outside of these specific areas. With the sponsor feature, you can assign a person or group to every guest user, which helps track who invited them and promotes accountability.

The Sponsors field on the user object identifies the person or group tasked with managing and overseeing the user's lifecycle, ensuring they have the correct access to resources. Being a sponsor does not confer administrative powers to the sponsor user or group. However, it can be utilized for approval processes in entitlement management and for custom solutions, but it provides no other built-in directory powers.

### Supported Features

Aggregation and provisioning of `sponsors` for Guest User (B2B) and External Member (B2B).

### Adding Sponsors to the Source

To use this feature, you must manually add the sponsor attributes to the Account Schema for the Microsoft Entra source.

| Attribute | Type | Read/Write | Description |
| --- | --- | --- | --- |
| sponsors | String (multi-valued) | Read-only | Returns each sponsor as a JSON object containing `displayName` and `id`. Useful for display purposes. |
| sponsors.users | String (multi-valued) | Read + Write | Returns and accepts the UPN of each user-type sponsor. For example, `someone@example.com`. |
| sponsors.groups | String (multi-valued) | Read + Write | Returns and accepts the Object ID of each group-type sponsor. |

> [!NOTE]
>
> To provision sponsors, use `sponsors.users` for user-type sponsors and `sponsors.groups` for group-type sponsors. The `sponsors` attribute is read-only and cannot be used for provisioning.

For more information, refer to [Editing an Account Schema](<https://documentation.sailpoint.com/saas/help/accounts/schema.html#editing-an-account-schema>).

### Provisioning

When provisioning a Microsoft Entra user as a sponsor, add the `sponsors.users` attribute to the Account Schema and provide the user's User Principal Name (UPN). For example, `someone@example.com`.

When provisioning a Microsoft Entra group as a sponsor, add the `sponsors.groups` attribute to the Account Schema and provide the group's Object ID.

Both attributes support Add, Remove, and Set operations. A Set operation on `sponsors.users` replaces only the user-type sponsors, leaving any group sponsors intact, and vice versa for `sponsors.groups`.

# Connecting SailPoint and Microsoft Entra ID

To connect SailPoint with Microsoft Entra ID, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
6. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
6. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Select **Save**.

## Connection Settings

Provide the information required to connect to the Microsoft Entra instance based on the selected **Grant Type** for OAuth 2.0 authentication:

### Client Credentials

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/client_credentials.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/client_credentials.png>)

1. In the **Client ID** field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.
2. In the **Client Secret** field, enter the Microsoft Entra ID API Client Secret.
3. In the **Domain Name** field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.
4. (*Optional*) Select the **Manage B2C Tenant** checkbox to manage identities in the Azure Active Directory B2C Tenant.

   > **Note**
   >
   > Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.
5. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
6. Select **Save**.

### SAML Bearer Assertion

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/saml_bearer_assertion.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/saml_bearer_assertion.png>)

1. In the **Client ID** field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.
2. In the **Client Secret** field, enter the Microsoft Entra ID API Client Secret.
3. Enter the **Username** for authorization.
4. Enter the **Password** of the user for authorization.
5. In the **Authorization Endpoint** field, enter the endpoint URL of authorization server.
6. In the **Request Body** field, enter the request body for SAML assertion.

   For more information on SAML Request Body, refer to [SAML Request Body](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/configuring_for_integration.html#saml-request-body>).
7. In the **Domain Name** field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.
8. (*Optional*) Select **Manage B2C Tenant** checkbox to manage identities in the Azure Active Directory B2C Tenant.

   > **Note**
   >
   > Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.
9. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
10. Select **Save**.

### Refresh Token

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/refresh_token.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/refresh_token.png>)

1. In the **Client ID** field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.
2. In the **Client Secret** field, enter the Microsoft Entra ID API Client Secret.
3. Enter the valid **Refresh Token**.
4. In the **Domain Name** field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.
5. (*Optional*) Select **Manage B2C Tenant** checkbox to manage identities in the Azure Active Directory B2C Tenant.

   > **Note**
   >
   > Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.
6. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
7. Select **Save**.

### JWT Certificate Credentials

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/jwt_cert_credentials.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/jwt_cert_credentials.png>)

To generate the JWT certificate credentials, refer to [Creating OAuth 2.0 JWT Certificate Credentials](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#creating-oauth-20-jwt-certificate-credentials>).

1. In the **Client ID** field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.
2. In the **Certificate** field, provide the unique alpha-numeric value of certificate used to sign the JWT assertion.
3. Enter the **Private Key** text used for encrypting the JWT assertion.
4. Enter the **Private Key Password** that is used for decrypting the private key.
5. In the **Domain Name** field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.
6. (*Optional*) Select **Manage B2C Tenant** checkbox to manage identities in the Azure Active Directory B2C Tenant.

   > **Note**
   >
   > Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.
7. (*Optional*) Select the **Use Continuous Access Evaluation** checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
8. Select **Save**.

## Aggregation, Filter, and Partitioning Settings

This section contains the configuration parameters for aggregation, filter, and partitioning settings.

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

For more information on the key factors to consider when choosing between Full Aggregation and Delta Aggregation, refer to [FAQs](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/faqs.html>).

### Aggregation Settings

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_agg1_new.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_agg1_new.png>)

1. Select the **Aggregate All Groups** checkbox to aggregate Security, Microsoft 365, Distribution List, and Mail Enabled Security Groups. If this option is cleared, only Security Groups are aggregated.
2. Select the **Delta Aggregation** checkbox to aggregate delta changes for accounts and groups.
3. (*Applicable for B2C tenant only*) Select the **Aggregate B2C Membership** checkbox to fetch B2C user memberships for all users.
4. Select **Exclude Inherited App Role Assignments** to exclude inherited appRoleAssignments during account aggregation. Only application roles assigned directly to the account are aggregated. Application roles inherited through group membership are excluded. Group memberships continue to be aggregated.

   By default, both inherited and direct appRoleAssignments are aggregated.
5. Enter the value of **Page Size** for the number of objects to be fetched in a single page when iterating over large data sets.

### Filter Settings

When configuring the filters, consider that the connector prioritizes account filters over group filters during aggregation. For example, the connector aggregates groups, which fall outside of the group filter, if the group is associated with an account included within the account filter.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/filter_settings.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/filter_settings.png>)

> [!NOTE]
>
> - If the filter (either Group Filter or User Filter) uses any advanced query filter (per the [Microsoft documentation](<https://learn.microsoft.com/en-us/graph/aad-advanced-queries>)), then Advanced User Filter and Advanced Group Filter should also be selected.
> - The connector supports advanced query filters like `endsWith`, `NOT`, and `NE` during aggregation. The Azure API does not support the advanced query filters while also using an expanded attribute such as `manager` in the URL. When using the advanced filters, ensure that you remove the `manager` attribute from the account schema and remove the `owners` attribute from the group schema.
> - If you're using the advanced filters you must add the `supportsAdvancedAccountFilter` attribute to the source XML using the [SailPoint REST API](<https://developer.sailpoint.com/docs/api/v3/update-source/>). The connector will then automatically add the required header (ConsistencyLevel:eventual) in the header and add `&$count=true`
>
>   key: `supportsAdvancedAccountFilter`
>
>   value: `true`

1. Set the **User Filters** to define the scope of Accounts applied during account aggregation. For example, to aggregate those Microsoft Entra ID users who are active, use `accountEnabled eq true`. For more information on filters, refer to the [Microsoft documentation](<https://docs.microsoft.com/en-us/graph/query-parameters>).
2. Select **Advanced User Filter** to include advanced filter queries such as endsWith, NOT, and NE during aggregation processes.

   To use the extension attributes from `onPremisesExtensionAttributes` e.g. `extensionAttribute1` , `extensionAttribute4` etc. as user filter, please use the below syntax: `onPremisesExtensionAttributes/extensionAttribute1 eq '21'`

   User Filters

   > **Screenshot**
   >
   > [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/advance_user_filter.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/advance_user_filter.png>)

   > **Note**
   >
   > Select the “Advanced User Filter” checkbox as it is advanced query filter.
3. Set the **Group Filters** to define the scope of Groups applied during group aggregation. Group filters apply during entitlement aggregation. For example, to only aggregate Microsoft Entra ID groups whose display name is starting with letter A, use `startswith(displayName,'A')`. For more information on filters, refer to the [Microsoft documentation](<https://docs.microsoft.com/en-us/graph/query-parameters>).
4. Select **Advanced Group Filter** to include advanced filter queries such as endsWith, NOT, and NE during group aggregation processes.
5. Select the **Group Membership Filters** to define the scope of the group memberships included in account aggregation. These filters apply during the account aggregation and are only applicable to memberships belonging to `objectType = group`. These are only applicable to the Security, Office 365, Mail Enabled Security, and Distributed type of group memberships. For more information on filters, refer to the [Microsoft documentation](<https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http>).

   > **Note**
   >
   > You can provide filters as mentioned in the examples below, and the connector ensures the formation of an appropriate advanced filter query. This field supports advanced filter queries such as `endsWith`, `NOT`, and `NE`.

   For example,

   - To aggregate only group memberships with group display name starting with 'A', use `startswith(displayName,'A')`.
   - To aggregate only group memberships with groups not belonging to on-premises AD (or to only include cloud group memberships), use `onPremisesSyncEnabled ne true`.
   - To exclude dynamic group memberships during account aggregation , use `NOT groupTypes/any(c:c eq 'DynamicMembership')`

   > **Important**
   >
   > SailPoint recommends excluding membership information is not a best practice from a governance and security standpoint. You should have full visibility into users and devices, including their groups, assigned permissions, and how these configurations impact access to resources. The group membership filter should be used carefully and only when necessary, ensuring that access is managed and only the right individuals have access to sensitive information or resources.
6. In the **Directory Roles Filter** field, when the entitlement schema "roles" is present in the source, enter filter statements to ensure that only the specified roles are aggregated during entitlement aggregation. For example, `isBuiltIn eq true`. For more information on filtering conditions and values, refer to the [Microsoft documentation](<https://learn.microsoft.com/en-us/graph/api/rbacapplication-list-roledefinitions?view=graph-rest-1.0&amp;tabs=http#optional-query-parameters>).
7. In the **Application Role Filter** field, enter any filter statements to apply during entitlement aggregation. An application role is an entitlement object that captures the details related to the AppRoles defined within the scope of enterprise applications. For example:

   - For a filter to match the Enterprise Application default view on the Azure portal use the following:

     `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')`
   - For a filter to exclude Microsoft's built-in service principals use the following:

     `appOwnerOrganizationId ne f8cdef31-a31e-4b4a-93e4-5f571e91255a&$top=100`
8. Select **Save**.

### Partitioning Settings

Partitioning enables your system to process data in parallel across multiple threads and can improve aggregation performance.

> [!IMPORTANT]
>
> SailPoint recommends to use aggregation without partitioning, if you want to enable PIM. This is because, aggregation with partitioning enabled, the connector has to fetch the PIM memberships by triggering individual APIs for each user, which takes time and may affect aggregation performance.
>
> On the other hand, aggregation without partitioning, the connector fetches all the PIM memberships of the user using caching mechanism, making the process more efficient. So, whenever PIM is enabled, it is suggested to use full aggregation without partitioning.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/partitioning_settings.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/partitioning_settings.png>)

1. Select **Enable Partitioning** if you want to process data in parallel across multiple threads.
2. In the **Partitioning Scheme** field, enter user filters to define your aggregation partitions. Enter a supported user filter and then press Enter. You can add multiple filters using this method. The filter you define in Partitioning Scheme should evenly distribute all users to be managed across partitions.

   This is a multi-valued attribute. The value consists of different search filters for the attributes that can be filtered (for example, `accountEnabled`, `city`, `displayName`, `mail`, `usageLocation`, etc.). The partitioning scheme is a list of user filters where each user filter represents one user partition, and the partitioning scheme defines the scope of accounts applied during account aggregation. For more information, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http>) on using query parameters.

   The following are some example Partitioning Scheme entries based on how you want to configure the partitions:

   - The following examples show you configurations based off of alphabetical inputs:

     - `startswith(displayName, 'A')`
     - `startswith(displayName, 'B')`
     - `startswith(displayName, 'C')`
     - `startswith(givenName, 'Smith')`
   - You can also define schemes using other attributes:

     - `accountEnabled eq true`
     - `userPrincipalName eq 'Paul@contoso.onmicrosoft.com'`
3. Enter the **Number of Partitioning Threads** the connector should use to concurrently execute your defined partitions. By default, it is set to 2 partitioning threads. If the VA is configured for multiple CPU cores, you can configure a higher number of partition threads to increase the performance.

   > **Note**
   >
   > The Number of Partitioning Threads should equal the number of CPU cores on VA\*2.
4. Select **Save**.

> [!NOTE]
>
> Due to PowerShell limitations, partitioning aggregation does not aggregate Exchange Online attribute details and Shared Mailbox as an entitlement.

## Additional Configurations

### Additional Settings

This section provides the details about the additional configuration parameters required to customize the connector behavior.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/additional_settings.png>)

1. Enter the list of errors in **Retry Error List** which must be retried if occurred during the provisioning operation. Press Enter after each error string to add it to the list.
2. Enter the value for **Max Retry Count** which indicates the number of times the read operation must be performed on the errors that appear. The default value is 5.
3. If you want to provision a specific role, you can specify this using create policy or Native Rules.
4. Enter the list of errors in **Aggregation Retry Error List** which must be retried if occurred during aggregation or get operation. Press Enter after each error string to add it to the list.
5. Select **Save**.

### Additional Configuration Parameters

You must add the following attributes in the connector using the SailPoint REST API. Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>).

| Parameter | Description |
| --- | --- |
| createAppTemplateSPNDelay | (Only applicable for create service principals and applications that are created making use of gallery templates).<br>The time, in seconds, to wait after the create service principal and application, and before making the update for basic SAML configuration. The default is 24 seconds.<br>For example, `<entry key="createAppTemplateSPNDelay" value="30"/>` |
| performGetObjectForEXOAttributes | To enable / disable reading of exchange online attributes from exchange system (real time exchange online attribute values) during explicit get object call for specified user, set the value of `performGetObjectForEXOAttributes` attribute to true.<br>Note<br>This configuration parameter is applicable only for get object call. Enabling this configuration parameter will degrade performance of get object calls. |
| createAccountTimelag | Time in seconds to wait after create account and before calling get account. The default is 20 seconds. |
| fetchB2CMembership | (*Applicable for B2C tenant only*) If set to true B2C user memberships is fetched for all users. The default value is false. |
| createGroupTimelag | Time in seconds to wait between creating and fetching a group. The default is 5 seconds.<br>Add the `createGroupTimelag` attribute using SailPoint REST API and set it as required. |
| useMSGraphAPI | Enables use of Microsoft Graph API for all connector operations.<br>To use the latest attributes and features supported by Microsoft Graph API, add the `useMSGraphAPI` attribute using the REST API and set it to true. |
| msgraph-api-version | The Microsoft Graph API version is configurable.<br>You must add the `msgraph-api-version` attribute in the source using the REST API.<br>The value of the attribute must be a valid version stated by Microsoft for MS Graph APIs. |
| skipEncodingImmutableId | Enable to skip encoding of `ImmutableID` while creating a federated user. Enable this feature by using the REST API to set the `skipEncodingImmutableID` parameter to `true`. The default value is `false`. |
| skipPIMMembershipOnCreateAccount | By setting `skipPIMMembershipOnCreateAccount` to `true`, you prevent the connector from fetching PIM membership details during account creation, which significantly reduces the overall time required for the account creation process.<br>The default value for this parameter is `false`. |
| fetchServicePlan | To disable fetching of service plans during account and group aggregation, set the value of `fetchServicePlan` to `false` using the REST APIs. For example:<br>`curl -L -X PATCH 'https://.api.identitynow.com/v3/sources/:id' \-H 'Content-Type: application/json-patch+json' \-H 'Accept: application/json' \-H 'Authorization: Bearer ' \--data-raw '[ {       "op": "add",        "path": "/connectorAttributes/fetchServicePlan",        "value": false  }]` |
| sleepBetweenAssignedPlans | Time in seconds to wait between adding or removing `assignedPlans`. The default is 3 seconds.<br>Add the `sleepBetweenAssignedPlans` attribute using the REST API and set it as required. |

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Frequently Asked Questions

This Frequently Asked Questions (FAQs) section provides answers to the most commonly asked questions about the Microsoft Entra ID connector in SailPoint.

## What are the key factors to consider when deciding between Full Aggregation and Delta Aggregation in SailPoint?

**Answer**: Full Aggregation retrieves all records from the source and evaluates them for changes. This approach is efficient for bulk data loads, as it fetches all users in large pages, with each response containing complete user details.

Delta Aggregation is an aggregation method that only loads data that has changed, been added, or been removed from the source. It uses a delta token to fetch only the modified users and then retrieves their details in small batches (for example, 15 at a time). However, not all connectors support Delta Aggregation.

Consider the following performance factors:

- If both methods take a similar amount of time (approximately 4 hours for 4,000-6,000 users), Full Aggregation is preferable, as it ensures all records are evaluated for changes.
- If only a small subset of users has changed (for example, around 1,000 users, taking about 30 minutes), and the source supports Delta Aggregation, this method is more efficient, as it only processes the modified data.

Use Full Aggregation for large changes or when the connector does not support Delta Aggregation. Use Delta Aggregation for fewer changes and when the connector supports it, as it can significantly reduce the processing time and API calls required.

# Feature Management

This section describes the various features that you can enable or disable for your configuration. Feature management enables you to select or deselect features on demand as your need for their services arises.

This page is broken into different functional areas. Configure each area per your requirements.

## Manage Microsoft 365 Groups and Microsoft Teams

Configure these settings if you want to manage Microsoft 365 groups and enable aggregation and provisioning of Microsoft Teams channels.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat1.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat1.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft 365 Groups** if you want to manage Office 365 Groups.

   > **Important**
   >
   > If you are utilizing Data Access Services (DAS) to manage access to cloud applications like Microsoft 365, you must enable the **Manage Microsoft 365 Groups**. This ensures that DAS can properly synchronize and manage Microsoft 365 groups, which control access to various collaborative resources within the Microsoft 365 ecosystem.
3. Select **Enable Teams Governance** if you want to enable aggregation and provisioning of channels.
4. In the **Channel Filter** field, enter any filter statements used to define the scope for channels. For example if you want to add standard channels and private channels the filter would be, `membershipType eq 'standard' or membershipType eq 'private'`
5. Select **Save**.

## Cloud Resource Management

Configure this feature if your application is intended to manage Azure Management Objects. This includes Management Groups, Subscriptions, Resource Groups, Role assignments, and User-Assigned Managed Identities. For additional permissions, refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>).

> [!IMPORTANT]
>
> You must have a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access.
>
> To display cloud resource data through SailPoint CIEM, you must also configure the SailPoint CIEM Azure source. Refer to [Connecting Azure and SailPoint CIEM](<https://documentation.sailpoint.com/saas/help/ciem/azure/connect_azure.html>) to learn more.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat2_2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat2_2.png>)

1. Go to **Feature Management**.
2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for user-assigned managed identities.
3. Select the **Include User-Assigned Managed Identities** checkbox to manage user-assigned identities. For more information, refer to [User-Assigned Managed Identities Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/workload_identities.html#user-assigned-managed-identities>).

   > **Note**
   >
   > To automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing user-assigned managed identities . For more information, refer to [User-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#user-assigned-managed-identity-attributes>).
4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for user-assigned managed identities.
5. Select **Save**.

## Manage Microsoft Entra Service Principals As Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/manage_service_principals1.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/manage_service_principals1.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.

   > **Note**
   >
   > To automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing azure Service Principal as account . For more information, refer to [Service Principal as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>).
3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'`

   > **Note**
   >
   > Advanced queries are not supported.

   Example filters:

   - For a filter to match the Enterprise Application default view on the Azure portal use the following:

     `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')`
4. Select the **Manage Azure PIM Role Memberships** checkbox to manage Azure PIM Active Role memberships for Service Principal.
5. Select the **Manage Microsoft Entra PIM Role Memberships** checkbox to manage Microsoft Entra ID PIM Active Role memberships for Service Principal.
6. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal.
7. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal.
8. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra Group memberships for Service Principal.
9. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals.
10. Select **the Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals.

    > **Note**
    >
    > This is for delegated permissions.
11. Select **Save**.

## Manage Exchange Online

1. Go to **Feature Management**.
2. Select **Manage Exchange Online** to enable aggregation and provisioning of Exchange mailbox attributes. This includes Shared Mailboxes, User Mailbox properties, Distribution Lists, and Mail-Enabled Security Groups. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.
3. Select one of the following from the **Authentication Method** dropdown list:

   - **Basic Authentication**

     > **Screenshot**
     >
     > [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat3.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat3.png>)

     1. Select **Basic Authentication** from the dropdown list.
     2. Enter the **Username** (UserPricipalName) of a user that has the Exchange Administrator role.
     3. Enter the **Password** associated with the username.
     4. Select **Save**.
   - **Certificate Based Authentication**

     > **Screenshot**
     >
     > [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat3.1.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat3.1.png>)

     > **Note**
     >
     > IQService configuration is mandatory to support this feature.

     1. Select **Certificate Based Authentication** from the drop dropdown list.
     2. Enter the **Certificate Thumbprint** of the certificate that is installed on the IQService machine used for Exchange Online operation that is also uploaded on the respective Microsoft Entra ID application.
     3. Select **Save**.
4. Select **Mail Contact Governance** to manage mail contacts as accounts. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. For more information, refer to [Azure Mail Contact Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/identity_management.html#azure-mail-contact-management>).
5. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')`

## Manage Azure Privileged Identity Management

Privileged Identity Management (PIM) enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

For more information, refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-privileged-identity-management-pim>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat4_new.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat4_new.png>)

1. Go to **Feature Management**.
2. Select the **Enable Privileged Identity Management** checkbox to define the scope of the Microsoft Entra PIM roles (Microsoft Entra as well as Azure). For more information on privileged identity management, refer to the [Microsoft documentation](<https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure>).
3. In the **Microsoft Entra PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Microsoft Entra PIM roles aggregated during entitlement aggregation. For example, `isBuiltIn eq true`

   For more information on filtering conditions and values, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/graph/api/rbacapplication-list-roledefinitions?view=graph-rest-1.0&amp;tabs=http#optional-query-parameters>).
4. In the **Azure PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Azure PIM roles aggregated during entitlement aggregation. For example, `type eq 'CustomRole'`

   For more information on filtering conditions and values, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions-list#rest-api>).
5. In the **Microsoft Entra PIM Active and Eligible Groups Filter** field, enter a filter to define the scope of the Azure PIM groups aggregated during entitlement aggregation. For example, `securityEnabled eq true`

   > **Important**
   >
   > User-defined filter expressions in this field cannot be combined with the connector's internal group type filter, which restricts groups to Office 365 and Security types. The internal filter is always applied. Any value you enter in this field functions as an additional standalone filter on the PIM group catalog and does not combine with the internal filter.

   For more information on filtering conditions and values, refer to the [Microsoft Documentation](<https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0&amp;tabs=http#filter-by-group-types>).
6. Select **Save**.

## Access Package Management Settings

An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization. For more information, refer to [Access Package Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/identity_management.html#access-package-management>).

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/access_package_management.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/access_package_management.png>)

1. Go to Feature Management.
2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off.
3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal.
4. Select **Save**.

## Administrative Unit Management Settings

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/admin_units.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/admin_units.png>)

1. Go to **Feature Management**.
2. Select **Manage Administrative Units** to manage administrative units.
3. Select **Save**.

## Account Disable Settings

To configure Account Disable Settings:

> [!NOTE]
>
> **Screenshot**
>
> [![Revoke Session after Disabling User Account](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/revoke_sessions.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/revoke_sessions.png>)

1. Go to **Feature Management**.
2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled.
3. Select **Save**.

> [!NOTE]
>
> - For existing sources, this is disabled by default. When required, ensure to enable this option.

For more information about this feature, including the required permissions, refer to [Revoke Session After Disabling User Account](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/identity_management.html#revoke-session-after-disabling-user-account>).

# Integrating SailPoint with Microsoft Entra ID

(Formerly Azure Active Directory)

> [!IMPORTANT]
>
> - If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.
> - **Microsoft Entra ID** is the new name for the Azure Active Directory connector. This guide refers to the connector as Microsoft Entra ID except where Azure Active Directory is still utilized, such as in some user interface configurations. When configuring a new connector, it will still be displayed as Azure Active Directory in the **source type** list.

The SailPoint Microsoft Entra ID connector manages the users and groups in Microsoft Entra. Microsoft Entra is the directory for all cloud based organizational Microsoft Directory services including Microsoft Office 365.

The SailPoint Microsoft Entra ID connector:

- Can also be used to provision users into a federated domain in Microsoft Entra ID.
- Uses Retry-After value to retry API request. It uses exponential back-off if Retry-After value is not returned by API.
- Uses Microsoft Graph APIs to manage users, groups and licenses.

Azure is Microsoft’s cloud solution platform, which provides plenty of cloud services such as IaaS, PaaS, or SaaS. Azure uses Microsoft Entra as its authentication source to provide access on different services to users. Azure has management container objects which are used to group resources and manage access to them.

The Microsoft Entra ID connector provides support for access management of Azure Management Objects along with managing of the Microsoft Entra Management Objects.

Microsoft Entra ID connector supports deleting accounts.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

Refer to [Supported Features](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/index.html>) for the features the connector supports.

## Prerequisites

Refer to [Prerequisites and Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html>).

# Before and After Scripts for IQService

The IQService supports function customization by allowing integrating Before/After scripts implemented in languages like PowerShell and Batch. Scripts can be used to automate any required actions that cannot be automated using current source functions. Scripts called before processing the request are referred to as Native Before Scripts and scripts called after processing the request are referred to as Native After Scripts.

SailPoint provides most of the provisioning functionality for many systems through its connectors. Some systems provide a better integration interface from the Windows platform compared to other platforms. So connectors for these systems require IQService deployed on a Windows system. The IQService implementation performs the provisioning functions (such as Add User, Connect User to a Group) that are supported by the respective managed system. The IQService functions are called by the SailPoint source implementation.

In addition to the basic action, some organizations may require supplementary actions performed by each function from the Windows system. The IQService supports customization of the functions by allowing you to integrate Before and After scripts in any language. The following are some features of IQService Before and After scripts:

- Centralized configurations (in SailPoint) for setting up Before and After scripts
- Supports Object Oriented scripting
- Script refers SailPoint library to get the request and result classes
- Can be executed with specific context
- Script can modify requests and results

A script is a group of statements that perform one or more actions and manipulate request and result attributes. Scripts can be used to automate any required actions.

The scripts need to be defined in a rule and then configured for a source in SailPoint. Based on the rule type (Before or After), the connector sends the scripts to be executed before or after processing the request to IQService.

IQService supports executing Before and After Rules for Create, Modify, and Delete request operations.

> [!WARNING]
>
> To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

## Writing a Script

IQService divides scripts in the following categories:

- Scripts with Object Oriented support
- Scripts without Object Oriented support

### Scripts with Object Oriented Support

Scripting languages with Object Oriented capabilities (for example, PowerShell) are popular because of their simplistic nature and ease of use. These scripts can form objects of any type by referring to any library or assembly implemented in any language and call its methods.

Native scripts implemented in these languages have easier and more powerful access to request and result objects. IQService comes with a class library named `Utils.dll` which bundles all required classes to access the request and result objects. The inputs provided to the script are in the form of process environment variables. The following table describes the environment variables created by IQService:

| Name | Type | Before Script | After Script |
| --- | --- | --- | --- |
| Application | System.Collections.Hashtable | Read Only | Read Only |
| Request | SailPoint.Utils.objects.AccountRequest | Read/Write | Read Only |
| Result | SailPoint.Utils.objects.ServiceResult | Not Available | Read/Write |

The data in the environment variables is in XML. The script creates respective objects using `Utils.dll`. Once the object is modified, the script converts it to XML by calling the **toxml()** method of the object and then writes a file at the path passed as the only argument to the script to the XML.

The script returns a non-zero value if an error occurs. It writes the error message in the file at the path passed as the argument to the script. This failure is communicated to SailPoint as part of a result.

> [!NOTE]
>
> **Sample PowerShell Before Script**
>
> The following is a sample PowerShell Before script which modifies the value of an attribute and adds one new attribute to the request:
>
> ```text
> # Refer to SailPoint class library Requires PowerShell v2 installed on the system.
> Add-type -path utils.dll
> # Read the environment variables
> $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
>
> # Form the xml reader object
> $xmlReader = [System.xml.XmlTextReader]([SailPoint.Utils.xml.XmlUtil]::getReader($sReader));
>
> # Create SailPoint Request object
> $requestObject = New-Object SailPoint.Utils.objects.AccountRequest($xmlReader);
>
> # Loop through the attributes from the request for each ($attribute in $requestObject.AttributeRequests){
> if($attribute.Name -eq "description"){
> $attribute.value = "my description"; #change value of the attribute
> }
> }
>
> # Add a new attribute to request
> $attributeObject = New-Object SailPoint.Utils.objects.AttributeRequest;
> $attributeObject.Name = "otherMobile";
> $otherMobileValues = New-Object System.Collections.ArrayList;
> $otherMobileValues.Add("222-292-2929");
> $otherMobileValues.Add("333-292-2929");
> $attributeObject.Value= $otherMobileValues;
> $attributeObject.Operation = "Set";
> $requestObject.AttributeRequests.Add($attributeObject);
>
> # Write the request xml to file at the path passed as argument
> $requestObject.toxml()|out-file $args[0];
> ```

> [!NOTE]
>
> **Sample PowerShell After Script**
>
> - The following is a sample PowerShell After script which ensures that the request was processed successfully and creates a home directory at the path specified in the request:
>
>   ```text
>   # Refer to SailPoint class library. Requires PowerShell v2 installed on the system.
>   Add-type -path E:\SVN\trunk\src\WinRPCGateway\IQService\bin\Debug\utils.dll
>
>   # Read the environment variables
>   $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
>   $sResult = New-Object System.IO.StringReader([System.String]$env:Result);
>
>   # Form the xml reader objects
>   $xmlReader = [ System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));
>   $xmlReader_Result = [ System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sResult));
>
>   # Create SailPoint objects
>   $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);
>   $resultObject = New-Object Sailpoint.Utils.objects.ServiceResult($xmlReader_Result);
>
>   #Check if the request was processed successfully
>   if($resultObject.Errors.count -eq 0){
>
>   #Get Home directory path
>   foreach ($attribute in $requestObject.AttributeRequests){
>
>   #Create Home directory
>   if($attribute.Name -eq "TS_TerminalServicesHomeDirectory"){
>   new-item $attribute.Value -itemtype directory;
>   }
>   }
>   }
>   ```
> - The following script displays how to access any application configuration attribute in the script. The following example reads application attributes with the name, Office365Username and its associated password. It uses them to connect to Exchange Online and sets Mailbox properties:
>
>   ```text
>   # Refer to SailPoint class library.
>   Add-type -path C:\Program files\IQService\bin\Debug\utils.dll
>
>   # Read the environment variables
>   $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
>   $sResult = New-Object System.IO.StringReader([System.String]$env:Result);
>
>   # Form the xml reader objects
>   $xmlReader = [ System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));
>   $xmlReader_Result = [ System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sResult));
>
>   # Create SailPoint objects
>   $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);
>   $resultObject = New-Object Sailpoint.Utils.objects.ServiceResult($xmlReader_Result);
>
>   # Retrieve nativeIdentity from request object
>   $nativeIdentity = $requestObject.NativeIdentity
>
>   # Get xmlFactory object to retrieve application configuration
>   $xmlFactory = [sailpoint.Utils.xml.XmlFactory]::Instance;
>
>   # Read the environment variables
>   $sReader1 = $env:Application
>
>   # Retrieve application configuration object
>   $appObject = $xmlFactory.parseXml($sReader1)
>
>   #Retrieve application configuration entries named Office365username and password value from AzureAD application config
>   $office365AdminUsername = $appObject.Office365username
>
>   #Retrieve password attribute value
>   $o365Password = $appObject.password
>
>   #create Credential object
>   $secpasswd = ConvertTo-SecureString $o365Password -AsPlainText -Force
>   $cred = New-Object System.Management.Automation.PSCredential ($office365AdminUsername, $secpasswd)
>
>   #Connect to Office365
>   Import-Module msonline
>   Connect-MsolService -Credential $cred
>
>   #Connect Exchange-Online
>   $msoExchangeURL = "https://ps.outlook.com/powershell/"
>   $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $msoExchangeURL -Credential $cred -Authentication Basic -AllowRedirection
>   Import-PSSession $session
>
>   # Set mailbox properties
>   Set-MailBox -identity $nativeIdentity -UseDatabaseQuotaDefaults $false -IssueWarningQuota "200MB" -ProhibitSendQuota "250MB" -ProhibitSendReceiveQuota "280MB"
>   ```

### Scripts Without Object Oriented Support

Non-Object Oriented scripts do not refer to the class library or support a way of parsing XML. To have easy access to each attribute along with their operation and values, IQService creates process environment variables for each of the application and request attributes. It formats the names as `SP_<OPERATION>_<NAME>` for requests and `SP_APP_<NAME>` for applications. For native identity, the environment variable is `SP_NativeIdentity`. These types of scripts have limited access to results and get only **SUCCESS** or **FAIL** in the **Result** environment variable. So the After scripts implemented using these scripting languages cannot modify any attribute or result. Before scripts can add, modify, or remove any attribute from the request. The script needs to write the newly added or modified attribute to the file at the path passed as an argument to the script in the form `SP_<OPERATION>_<NAME>=<VALUE>`. To remove the attribute from the request, write `/~<ATTRIBUTE_NAME>` to the file. The value for the multivalued attribute is delimited by `/#/`.

The following is a sample batch After script which ensures that the request was processed successfully and creates a home directory at the path specified in the request:

```text
IF %Result% ==SUCCESS md %SP_Set_TS_TerminalServicesHomeDirectory%
```

## Creating a Rule

To add the script to a rule and use it, you need to create a rule. [Contact SailPoint Services](<https://community.sailpoint.com/knowledge/collection/working-with-services>) for assistance on creating rule as per requirement.

### Configuring the Rules in Source

Add the `nativeRules` attribute under the Attributes map with a list of rules that must be configured for a source in SailPoint using the REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

# Configuring TLS and Client Authentication for IQService

IQService, also referred to as the Integration Service, is a Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs.

It is a lightweight service that must be installed on any supported Windows server that has connectivity to the target systems you want to manage in SailPoint. IQService can be installed on any Windows operating system that meets the requirements specified in [Prerequisites](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/iqservice/install_config_iqservice.html#prerequisites>) of IQService.

> [!CAUTION]
>
> If you have IdentityIQ and SailPoint Human Fabric in your environment, install a separate instance of IQService for each system.

- **TLS Communication** - TLS Communication between IQService and the VA is supported and must be configured to secure this solution.
- **Client Authentication** - IQService can authenticate a client while connecting to it. IQService-based sources support Client Authentication, a feature which authenticates every incoming request from SailPoint before executing them. To ensure the authentication works correctly, IQService expects the client to send the credentials of a registered user with every request. Before processing a request, IQService first confirms that the user is registered with it and then authenticates the credentials with Windows.

> [!NOTE]
>
> Client Authentication is mandatory for operations that use the IQService when the TLS communication is enabled for IQService.
>
> SailPoint recommends using a privileged access user as the registered user for client authentication. You can also use the IQService Service Log On user for this purpose.

## Prerequisites

> [!NOTE]
>
> **For TLS Communication between the VA and IQService**
>
> - The IQService host's X.509 certificate with Extended Key Usage (EKU) used as Server Authentication must be available in the Personal Certificate Store of the host. The subject of the certificate should match the FQDN of the IQService host. An example subject is `iqservice.test.com`.
> - The matching private key must be present in the host's RSA key directory.
> - If the IQService host's X.509 certificate is not available, create a CSR (Certificate Signing Request) from the IQService host.
> - Submit the CSR to a trusted (internal or third party) certificate authority (CA) for signing. Ensure that the CA is on trusted root CA in the host.
> - The configuration of Client Authentication is *mandatory* when TLS communication is enabled for IQService.

> [!NOTE]
>
> **For Client Authentication**
>
> - To configure client authentication when the IQService host is added to any domain, you need to have a domain user whose credentials can be used to authenticate a connection between SailPoint and IQService.
> - If the IQService host is not added to any domain, the Windows local user from the IQService host can be used authenticate a connection between SailPoint and IQService instead of the domain user.
>
> > **Note**
> >
> > No specific additional user permissions are required.

> [!IMPORTANT]
>
> If you are updating your IQService instance to use a TLS port, ensure that you disable the existing non-TLS port. This is crucial to maintain secure communication and prevent potential security vulnerabilities arising from the simultaneous use of both TLS and non-TLS ports. For more information, refer to [Disabling Non-TLS Communication for an Existing IQService Instance](<#disabling-non-tls-communication-for-an-existing-iqservice-instance>).

## TLS Configuration Between VA and IQService

1. Download IQService from SailPoint via a source that requires it.

   1. Select **Download IQService**.
   2. Unzip the downloaded **IQService.zip** archive into the desired location. For example, `C:\SailPoint\IQService\`
2. Install IQService to communicate with SailPoint on the TLS port only.

   ```text
   IQService.exe -i -o <TLS Port Number>
   ```

   This command installs IQService with the name **IQService-Instance1** and the provided TLS port number.
3. On the managed source configuration, in the **Integration Service** panel, enable the **Enable Transport Layer Security (TLS)** checkbox.

## TLS Configuration Check List

### IQService Host

- The X.509 certificate is located in the Local Computer's Personal certificate store.
- A private key that matches the certificate is present in the Local Computer's store and is correctly associated with the certificate.

  For example, as displayed in the following screenshot, you can confirm if the certificate has a private key. A certificate with a private key (on the right, highlighted in green) has a different icon than a certificate without one (highlighted in red).

  [![TLS certificate with and without private key](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_config_iqservice.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_config_iqservice.png>)
- The Enhanced Key Usage extension includes the Server Authentication (1.3.6.1.5.5.7.3.1) object identifier.
- The IQService host's fully qualified domain name (FQDN) must be in the common name (CN) in the **Subject** field in the X.509 certificate, and it must be a DNS entry in the **Subject Alternative Name** extension in the X.509 certificate.

An example of IQService's FQDN is `iqservice.test.com`. Refer to the following examples.

> [!NOTE]
>
> **Common Name (CN) in the Subject field in X.509 certificate**
>
> [![Common Name in X.509 certificate Subject field](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_config_iqservice_2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_config_iqservice_2.png>)

> [!NOTE]
>
> **DNS entry in the Subject Alternative Name extension in the X.509 certificate**
>
> [![DNS entry in X.509 certificate Subject Alternative Name extension](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_config_iqservice_3.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_config_iqservice_3.png>)

- The X.509 certificate must be trusted by the IQService host. Trust is established by configuring the IQService host to trust the root CA to which the issuing CA chains. Refer to the following examples:

> [!NOTE]
>
> **X.509 certificate (Non trusted)**
>
> [![Non-trusted X.509 certificate](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/x509_non_trusted.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/x509_non_trusted.png>)

> [!NOTE]
>
> **X.509 certificate (Trusted)**
>
> [![Trusted X.509 certificate](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/x509_trusted.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/x509_trusted.png>)

### Virtual Appliance Configuration

The virtual appliance (VA) must trust the IQService X.509 certificate. Trust is established by configuring the VA to trust the root CA to which the issuing CA chains. To establish trust between the VA and the root CA:

1. Add the root CA cert in the `/home/sailpoint/certificates` directory of the VA.
2. Restart the CCG service.

[![TLS virtual appliance configuration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_va_config.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/tls_va_config.png>)

> [!NOTE]
>
> Ensure to export the full certificate chain and convert it into a single PEM / Base64 formatted file.

> [!NOTE]
>
> **Steps to Export and Convert the Certificate Chain**
>
> 1. Using the Microsoft Management Console (MMC), export the certificate chain as a `.p7b` file in DER/Binary format.
> 2. Use the following OpenSSL command to convert the `.p7b` file to a `.pem` file:
>
>    ```text
>    openssl pkcs7 -print_certs -in certchain.p7b -inform DER -out certificate.pem -outform PEM
>    ```
> 3. Place the output `.pem` file onto the VA. The CCG will then load the certificates from this file.
>
> ##### Handling Multiple Certificate Chains
>
> If you have multiple certificate chains (For example, one for VA to IQService communication and another for VA to AD communication), each chain must be placed in a separate PEM file.

## Configuration of IQService Client Authentication

1. On the IQService host, run the following command:

   ```text
   IQService.exe -a <Domain User/s>
   ```

   For example: `IQService.exe -a "Corp\John.Doe"`

   - The domain user must be in the `msDS-PrincipalName` format:

     ```text
     <domain>\<user>
     ```
   - If you are using a local user, it must be in the following format:

     ```text
     localuser
     ```
   - You must use the user name as an **IQService User** name in the same format.
2. Configure the **IQService User** and **IQService Password** on the IQService-based source.

   Ensure that the IQService user value set here is the same that you registered on earlier on IQService.

## Securing Communication Between IQService and AD Domain Controller or Target System

> [!NOTE]
>
> For IQService to connect using TLS and self-signed certificates, you must install the certificate in **Trusted Root Certification Authorities** on the IQService host. The configured IQService User must have all access/permissions to read all the installed Certificates.

1. Export the server certificate and copy the exported .cer file to the IQService host.
2. Double-click the .cer file and select **Install Certificate**.
3. Select **Next**.
4. Choose **Place all certificates in the following store** and select **Browse...**
5. Select **Show physical stores**.
6. Expand **Trusted Root Certification Authorities** and select **Local Computer**.
7. Select **OK**.
8. Select **Next**, then **Finish**.

## Disabling Non-TLS Communication for an Existing IQService Instance

If you are enabling TLS communication for an existing IQService instance that previously used non-TLS communication, you must ensure that non-TLS communication is disabled for that same instance. You can achieve this using one of the following methods:

**Method 1**

1. Set the existing non-TLS port to zero (0) or any negative number (such as -1, -2, -3 ) using the command line:

   ```text
   IQService.exe -p <zero or negative port number>
   ```

   For example,

   ```text
   IQService.exe -p 0
   ```

   ```text
   IQService.exe -p -1
   ```

   > **Note**
   >
   > Ensure to disable the non-TLS port for both the primary service and the secondary service (if configured).
2. After setting the port, restart the IQService.

**Method 2**

Optionally, you can delete the non-TLS port entry from the IQService instance registry configuration.

> [!WARNING]
>
> Directly editing the registry can cause serious, potentially unrecoverable errors if done incorrectly. Only modify fields that are specifically intended for modification.

Following are the steps to delete non-TLS port entry from IQService instance:

1. Locate the registry configuration for your IQService instance.

   You can find the registry path for the primary service at:

   ```text
   HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\<IQService-Instance>
   ```

   You can find the registry path for the secondary service at:

   ```text
   HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\<IQService-Instance>\Secondary
   ```

   Replace `<IQService-Instance>` with the name of your IQService instance.
2. Look for the port attribute.
3. Delete the port attribute entry.

After completing one of these methods, the IQService will only communicate using TLS, ensuring secure communication between the IQService and other components. To verify that the non-TLS port has been successfully disabled for your IQService instance, run the following command:

```text
IQService.exe -v
```

After running this command, the output should display only the Configured TLS Port information along with the corresponding TLS port number, such as `Configured TLS Port  : <TLS Port Number>`

## Troubleshooting

### TLS Communication

> [!NOTE]
>
> **Failed to connect to IQService. Please check TLS configuration for IQService.**
>
> **Resolution**:
>
> - Ensure that the certificate is placed at correct path in VA: `/home/sailpoint/certificates`
> - This error message might come if IQService is an older version or a non-TLS port is provided. Ensure your IQService is upgraded to latest IQService and TLS port is provided.

> [!NOTE]
>
> **java.security.cert.CertificateException: No subject alternative names present**
>
> **Resolution**:
>
> - Ensure that the certificate is properly placed in VA: `/home/sailpoint/certificates`.
> - Check communication between IQService host and VA.
> - Ensure that the DNS settings are correct. Alternatively add the appropriate mapping entry for IQService host in `hosts.yaml` file in the `/home/sailpoint` directory.
>
>   > **Note**
>   >
>   > For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](<https://documentation.sailpoint.com/saas/help/va/config_va.html#configuring-a-hostsyaml-file>).

> [!NOTE]
>
> **Connection Reset**
>
> **Resolution**: Verify the following:
>
> - This could be because IQService TLS is disabled and you have provided TLS port. Ensure that the **Enable Transport Layer Security (TLS)** checkbox is selected.
> - This could be because the hostname of the IQService server does not match the FQDN of the TLS certificate. Verify that the hostname matches the FQDN or the SubjectAlternateName DN is the same as the FQDN of the TLS certificate. If they are not the same, use the following commands to specify the certificate FQDN for IQService and then restart IQService:
>
>   ```text
>   iqservice.exe -m hostname.example.com
>   iqservice.exe -t
>   ```

> [!NOTE]
>
> **Connection refused**
>
> **Resolution** - Ensure your IQService service is running.

> [!NOTE]
>
> **Failed to connect to IQService. Please check TLS configuration for IQService.**
>
> **Resolution** - This could be because the IQService version is older. Ensure your IQService service is upgraded to latest version. Deselect the **Enable Transport Layer Security (TLS)** checkbox for non-TLS communication.

> [!NOTE]
>
> **Line: 1 Column:1: Content is not allowed in prolog.**
>
> **Resolution** - If you want to use the IQService TLS functionality, use the latest CCG version and IQService version. If you are not using the latest CCG version and IQService version, ensure that the **Enable Transport Layer Security (TLS)** checkbox is unchecked on source configuration.

> [!NOTE]
>
> **Unrecognized SSL message, plaintext connection?**
>
> **Resolution** - If you want to use the IQService TLS functionality, ensure that latest CCG version and IQService is deployed. If you are not using the latest CCG version and IQService version, ensure that the **Enable Transport Layer Security (TLS)** checkbox is unchecked on source configuration.

### Client Authentication

The following errors may be returned from IQService.

> [!NOTE]
>
> **No such user registered with IQService.**
>
> **Resolution**:
>
> - Ensure that you have registered and configured the IQService user and password on IQService host using the following command:
>
>   ```text
>   IQService -a username
>   ```
> - Ensure that you have provided the correct IQService user or password. Use the latest CCG version and IQService version.

> [!NOTE]
>
> **Client authentication failed with error - The user's password must be changed before signing in**
>
> **Resolution** - The IQService user's password could be expired. To resolve the issue, change the password for the IQService user.

> [!NOTE]
>
> **Client authentication failed with error - The user's account has expired**
>
> **Resolution** - Password could be expired for IQService user. To resolve the issue, change the password for IQService user.

> [!NOTE]
>
> **Client authentication failed with error - The referenced account is currently locked out and may not be logged on to.**
>
> **Resolution** - Ensure that the IQService user is not locked.

> [!NOTE]
>
> **Client authentication failed with error - This user can't sign in because this account is currently disabled**
>
> **Resolution**: Ensure that the IQService user is not disabled.

> [!NOTE]
>
> **Client authentication failed with error - Your account has time restrictions that keep you from signing in right now**
>
> **Resolution** - The reason could be IQService user has enabled logon hours and you are trying to perform an operation outside of their defined logon hours. Ensure that logon hours are correctly configured.

> [!NOTE]
>
> **The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.**
>
> **Resolution** - This is the error that displays if you are trying to perform client authentication with an old CCG version but the latest IQService version. You need to remove the user details from IQService using the command: `IQService -x username`. Also remove IQService user and password from source config.

# IQService Settings

IQService, also referred to as the Integration Service, is a native Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs.

**Operations supported through IQService**: [Before and After Scripts for IQService](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/iqservice/before_after_scripts.html>)

## IQService Installation

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_iq1.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_iq1.png>)

### Download IQService

To download the IQService installation complete the following:

1. Select the **Download IQService** button.

   > **Note**

   IQService has the built-in capability to auto update (this is the default). To enable the auto update capability, UpdateService must be configured alongside the IQService installation. Refer to [Configuring IQService Auto Update](<https://documentation.sailpoint.com/connectors/iqservice/help/updating_iqservice.html>).

   Download, install, and configure IQService by following the steps mentioned in the [Identity Security Cloud IQService Administrator's Guide](<https://documentation.sailpoint.com/connectors/iqservice/help/index.html>) for [Installing and Registering IQService.](<https://documentation.sailpoint.com/connectors/iqservice/help/install_register.html>)

   > **Note**

   You are only entitled to download components for which you have an active license with SailPoint and the availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Contact your Account Representative or CSM for more information.

## IQService Settings

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_iq2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_iq2.png>)

1. Provide the following connection settings for IQService:

   > **Note**
   >
   > To enable native before/after script execution for provisioning requests, configure the IQService Host and IQService Port fields.

   - **IQService Host** - FQDN/IP of the system where IQService is installed.
   - **IQService Port** - It is the port number used by the IQService; the default port is 5050.
   - **IQService User** - The user for client authentication.
   - **IQService Password** - The password of the user for client authentication.
2. Select the **Enable Transport Layer Security (TLS)** checkbox for TLS communication for IQService.

   For more information on TLS communication, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/iqservice/configuring_tls_and_client_authentication_for_iqservice.html>).
3. Select **Save**.

# Installing and Configuring IQService

IQService, also referred to as the Integration Service, is a native Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs.

It is a lightweight service that must be installed on any supported Windows Server that has connectivity to the target systems you want to manage in SailPoint.

## Prerequisites

> [!NOTE]
>
> **Software Requirements**
>
> | Operating Systems | .NET Framework |
> | --- | --- |
> | Microsoft Windows Server 2019; Microsoft Windows Server 2016 | .NET Framework version 4.8 Minimum; .NET Framework version required 4.5.2 Supports; .NET Framework version 4.7.1 |
>
> > **Note**
> >
> > IQService for SailPoint is compatible with lower versions of .NET Framework (4.5.2 onwards). SailPoint recommends using the latest version of .NET Framework 4.8 to align your environment with future releases of this service.

> [!NOTE]
>
> **Hardware Requirements**
>
> This is the minimum hardware requirement for a basic working instance of IQService with an average processing load when used with one application. The requirement proportionately increases with an increase in the request processing load and number of applications it serves.
>
> | Component | Recommended Hardware Requirement | Minimum Hardware Requirement |
> | --- | --- | --- |
> | CPU | 8-Core | 4-Core |
> | RAM | 16 GB | 8 GB |
> | Free Disk Space | 50 GB | 250 MB |

> [!NOTE]
>
> **Service Account**
>
> The service account defined in the SailPoint source that connects to IQService is used for provisioning operations, aggregation (terminal services attributes and Skype attributes), and server-less binding for respective target system.
>
> However, the account defined for the IQService Log On as an account in Windows is used for the before/after scripts where PowerShell is being used. If the source's service account is not used, then the PowerShell session is opened under the service account credentials of IQService.

## Installing IQService

1. Download the Integration Service from SailPoint via a source that requires it.

   > **Screenshot**
   >
   > [![Download IQService from the source](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/azure_iqservice_installation.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/azure_iqservice_installation.png>)
2. Run the following commands to install the IQService Windows service.

   - Install IQService for non-TLS communication with SailPoint:

     ```text
     IQService.exe -i
     ```

     This command installs an IQService instance named `IQService-Instance1` and uses port 5050 if available.
   - Install IQService for TLS communication with SailPoint:

     ```text
     IQService.exe -i -o <TLS Port Number>
     ```

     This command installs an IQService instance named `IQService-Instance1` on the specified TLS port.

     > **Note**
     >
     > For more details on the requirements and procedure to set up TLS Communication and Client Authentication, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/iqservice/configuring_tls_and_client_authentication_for_iqservice.html>).
   - Install IQService for both TLS and non-TLS communication with SailPoint:

     ```text
     IQService -i -p <Non-TLS Port> -o <TLS port>
     ```

     This command installs an IQService instance named `IQService-Instance1` on the specified TLS and Non-TLS ports.
3. Unzip the downloaded **IQService.zip** archive into the created or desired location. For example, `C:\SailPoint\IQService\`

   > **Note**
   >
   > Verify the DLLs are trusted by checking the properties of the DLL files.
4. Start the service either from the Services Applet or from the command line by running the following command:

   ```text
   IQService.exe -s
   ```

> [!NOTE]
>
> **IQService Commands**
>
> In addition to the commands -i to install and -s to start, other command line options with IQService include:
>
> | Command Line Options | Description |
> | --- | --- |
> | \-d | Run in console mode |
> | \-i | Install a service. Refer to [Registering IQService](<#registering-iqservice>) for more information. |
> | \-k | Stop the service |
> | \-p | Update the port (requires a service restart) |
> | \-r | Remove the service |
> | \-u | Uninstall the service. Removes the service components and clears the registry entries. |
> | \-s | Start the service |
> | \-t | Restart (stop/start) the service |
> | \-v | Print version information |
> | \-l \\\<level\> | Trace Level 0-3; 0=off 1=error 2=info 3=debug |
> | \-f \\\<filename\> | Trace the file name. Defaults to the system32 directory.<br>Enter the full path with a filename to log to a different path. For example: `iqservice -l 3 -f "C:\Sailpoint\IQService\iqtrace.log"` |
> | \-a | Registers a domain user for Client Authentication. Pass the domain user name in `msDS-PrincipalName` (domain\\user) format. Multiple users can be registered in a single command by separating them with a semicolon ( ; ).<br>This command appends users to existing registered users. For example: `-a "Acme\John.Smith; Acme\Joe.Phillips"`<br>Ensure that the exact same user name is configured on the source for this feature to work.<br>To list existing registered users, run the command with the `list` parameter.<br>For example: `-a list` |
> | \-x | Unregisters a user from the Client Authentication Users List. Pass the domain user name in `msDS-PrincipalName` (domain\\user) format. Multiple users can be registered in single command by separating them with a semicolon ( ; ).<br>For example: `-x "Acme\John.Smith; Acme\Joe.Phillips"`<br>To list existing registered users, run the command with the `list` parameter.<br>For example: `-x list` |
> | \-o \\\<Port Number\> | TLS port for communication between IQService and SailPoint. This port accepts communication over TLS only. |
> | \-j \\\<TLS Version\> | Enforce the specific TLS version for communication between IQService and SailPoint.<br>Supported values are:<br>\- `TLS1.2` (Default)<br>\- `TLS1.1`<br>\- `TLS1.0` |
> | \-m \\\<Subject CN\> | "Issued To" (CN of Subject) of the X.509 certificate. It is applicable to communication between IQService and SailPoint. This overrides the default lookup text for IQService to search for the X.509 certificate on the machine. By default, IQService looks for the X.509 certificate issued to FQDN of current machine.<br>For example: `-m example.com` |
> | \-? \| h: | This is for help output |

> [!NOTE]
>
> **Configuring Default TLS Version**
>
> The SailPoint IQService supports the `default` configuration for `tlsVersion`. To enable this configuration, execute the `IQService.exe -j` default command.
>
> With this configuration, the operating system selects the best available protocol. This configuration requires that `SystemDefaultTlsVersions` is enabled on the IQService machine. If it is not enabled, then IQService falls back to the highest commonly supported version from the predefined list of TLS versions.

## Registering IQService

The `IQService.exe -i` command installs and registers the service with the new registry path `HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\IQService-Instance1` with the following keys:

| Keys | Description |
| --- | --- |
| port | Port to listen |
| tracefile | Path to the tracefile |
| tracelevel | 0 (off)<br>3 (verbose) |
| maxTraceFiles | Maximum number of Trace log files that must get created before overwriting the older files |
| traceFileSize | Maximum file size of a trace file in bytes. A new file is created when the current file exceeds this limit |
| clientAuthUsers | If you configure IQService with client authentication, the IQService user is displayed with this key. |
| tlsPort | If you configure the TLS port, the IQService is set up for the communication over TLS. |

The IQService accesses only the IQService-related keys in the registry editor, and installs or uninstalls successfully.

## IQService Fallback Implementation

In information technology, the term fallback refers to a backup solution to prevent the total failure of a system. The fallback solution commonly has a reduced or limited functionality but is still capable of operating the most important functions for a certain period, to allow time for operation of the system to be brought fully online again. After the primary system is restored, the fallback solution is deactivated and normal operation is resumed.

IQService now allows you to install a secondary instance (fallback instance) of the primary service running on an IQService host machine. This secondary IQService instance takes over only when a primary IQService instance is down and not serving the requests coming from SailPoint.

In SailPoint, any request from user gets routed through VA (Cloud Connector Gateway). VA takes care of sending request to the appropriate request handler. Here if primary IQService instance is down, then the request processing is redirected to secondary IQService instance by the VA.

> [!NOTE]
>
> Once the primary IQService is restored or working as expected, the VA automatically starts redirecting requests to the primary IQService.

[![IQService fallback](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/iqservice_fallback.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/iqservice_fallback.png>)

The secondary service is not considered as a load balancer service or a high availability service. The secondary service works as a fallback service in case of failure of the primary IQService.

> [!NOTE]
>
> The secondary IQService is used to serve requests when the primary IQService is down during upgrades. The secondary IQService handles manages requests if the primary IQService instance crashes and can handle the next requests until the primary service is running. However, the primary IQService must not be stopped purposefully and you should not keep the secondary service running to handle requests from SailPoint. If the primary IQService is stopped by running the `IQService -k` command, the secondary IQService is also stopped.

### Installing the Secondary IQService Instance

The secondary IQService is automatically installed on the same host but with a different port (the installer uses another available port) as the primary IQService.

1. `IQService.exe -i` - This command installs two instances of IQService. During installation it creates a **IQService-Instance1-Secondary** directory inside the installation directory of IQService. It copies all files present in the installation directory to that directory. It is the installation directory for the **IQService-Instance1-Secondary** service.
2. `IQService.exe -i -b` - This command allows you to install only one instance of IQService. This command is recommended only you have a load balancer configured to take care of failures in the running service.
3. `IQService.exe -s` - If the secondary service is installed, this command starts both instances of IQService.
4. `IQService.exe -k` - If the secondary service is installed, this command stops both instances of IQService.
5. `IQService.exe -t` - If the secondary service is installed, this command restarts both instances of IQService.

> [!NOTE]
>
> When the Primary service is started, stopped, or restarted either from a command or through a services console, the operation is performed on both the instances.

After installation, you can configure different ports or TLS ports.

> [!NOTE]
>
> **Configuring the Secondary IQService Instance**
>
> | Command | Description |
> | --- | --- |
> | `IQService.exe -v` | Print version information |
> | `IQService.exe -p <port number>` | Update the port number of secondary service |
> | `IQService.exe -o <port number>` | Update the TLS port number of secondary service |
> | `IQService.exe -t` | Restart the secondary service. |
>
> For TLS, the secondary service uses all the configuration defined in primary service (except the TLS Port).
>
> The secondary service uses the log level defined in the primary service. The file name is the same as that of the primary service. The only change is the file is in the installation directory of the secondary service.
>
> > **Note**
> >
> > - It is recommended that you shouldn't stop the secondary service.
> > - If the logon user is changed for the primary service, then you need to update the logon user for the secondary service to the same new user.

> [!NOTE]
>
> **Secondary IQService Information**
>
> In SailPoint, the Test Connection call confirms that all the required components are up and running. With this new feature, the source sends secondary IQService port information to SailPoint. This information is stored in the source XML file, and it is utilized whenever there is a need to connect to a secondary IQService. There is no indication in the user interface that a secondary IQService exists.
>
> > **Note**
> >
> > - Secondary IQService details are not available on UI.
> > - Secondary IQService details are updated in source xml file only after first Test connection call.

## Upgrading IQService

To upgrade, you must uninstall the previous version and then install the new version.

SailPoint also recommends backing up the current installation before uninstalling to aid with troubleshooting the new version, should issues arise.

- To determine the existing (old) version, run the following command:

  ```text
  IQService.exe -v
  ```
- To uninstall the existing (old) version, run the following command:

  ```text
  IQService.exe -u
  ```
- Run the following command to install a new version:

  ```text
  IQService.exe -i
  ```

### Upgrading IQService to the Latest Version

1. Take the backup of the existing IQService installation.
2. Stop the service either from the Services Applet or from the command line by running the following command:

   ```text
   IQService.exe -k
   ```
3. Uninstall IQService using the `IQService -u` command.
4. Extract the latest IQService in the installation directory.
5. Install the new IQService using the `IQService -i` command.
6. Start the IQService.

> [!NOTE]
>
> If you have executed the **IQService Public Key Exchange** task for the existing IQService then SailPoint recommends that you follow the instructions mentioned to install and register a new IQService.

# Machine Account Attributes

Machine account attributes are used in provisioning configurations for machine accounts.

After you have [created the required machine account subtypes](<https://documentation.sailpoint.com/saas/help/machine/account_configuration.html#creating-machine-account-subtypes>), you can use the machine account attributes to provision machine accounts in your SailPoint tenant.

Refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>) for more information.

> [!NOTE]
>
> Attributes marked with an asterisk (\*) are mandatory.

## Machine Account Provisioning Attributes

Machine account creation uses the same source attributes as standard service principal provisioning. For the complete list of supported attributes and their descriptions, refer to [Account Profile for Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/azure_policies.html#account-profile-for-service-principal>).

| Create Machine Account Attribute | Description |
| --- | --- |
| spn\_appDisplayName\* | Display name for the Microsoft Entra ID application. Used to create the associated service principal (machine account). |
| spn\_appId | Existing application (client) ID to associate with service principal creation/update flows. |
| spn\_appTemplateId | Microsoft Entra ID application template ID used for template-based app creation. |
| spn\_appTemplateName | Human-readable name of the application template. |
| spn\_homepage | Homepage URL for the application object. |
| spn\_loginUrl | Login URL configured on the application/service principal. |
| spn\_logoutUrl | Logout URL configured on the application/service principal. |
| description | Description text for the application/service principal object. |
| spn\_tags | Tags to set on the service principal. Multi-valued attribute. |
| spn\_owners | Object IDs / references of owners assigned to the service principal/application. Multi-valued attribute. |
| spn\_app\_keyCredentials | Key credential definitions (certificate-based credentials) for the application object. Multi-valued attribute. |
| spn\_passwordCredentials | Password credential definitions (client secrets) for the service principal. Multi-valued attribute. |
| spn\_app\_passwordCredentials | Password credential definitions (client secrets) for the application object. Multi-valued attribute. |

# Prerequisites and Permissions

## Prerequisites

### Azure Management

> [!WARNING]
>
> To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

- Ensure that a client application has been registered on your Azure Management portal as a web application or web API, and you have access to the Client ID and Client Secret for this application.
- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Use certificate based authentication in Exchange Online as basic authentication is deprecated by Microsoft. For more information, refer to [Certificate Based Authentication](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html#exchange-online-management>) in Exchange Online Management.
- You must install IQService to use this feature. For more information, refer to [IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/index.html>).

  > **Important**
  >
  > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/iqservice/configuring_tls_and_client_authentication_for_iqservice.html#configuring-tls-and-client-authentication-for-iqservice>).
- For cloud management prerequisites and requirements, refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>).
- To use Graph API, a client application must be registered on the Azure management portal. This application is responsible for calling Web APIs on behalf of the connector. The application's client ID and client secret key are required while configuring the application.

  To register an application on Azure, perform the following:

  1. Use either of these Azure management portals to do the configuration: [https://portal.azure.com](<https://portal.azure.com>) Or [https://aad.portal.azure.com](<https://aad.portal.azure.com>)
  2. Select **Microsoft Entra ID** in the left pane.
  3. Select **App registrations**.
  4. Select **New registration**.
  5. On the **Register an application** page, in the **Name** field, enter the name of the application that you want to set up. For example, SailPointAzureADManagement.
  6. In the Supported account types, set up accounts based on users that are able to use that application or the API.
  7. (*Optional*) Set up the URL in Redirect URL, to have the successful response after authentication. You can use the following format: **http://*domainName*/GraphWebapp**

     > **Note**
     >
     > The Microsoft Entra ID connector does not use the URL mentioned above, the above example is just a placeholder and does not impact functionality.
  8. Select **Register**. An application is created. On the Application page the **Application (client) ID**, and other details are displayed. Note down this ID.
  9. On the left-hand panel, select **Certificates &amp; secrets**. On the Certificates &amp; secrets page, in the **Client secrets** section, select **New client secret**.
  10. On the **Add a client secret** page, enter the **Description** to generate a secret, choose the validity duration in the **Expires** list. Select **Add**. Note down the value of the secret that you have just created.

### Microsoft Entra

The required host values (`https://<host>/`) by the Microsoft Entra ID connector to interact with the managed system are as follows:

- [https://graph.microsoft.com](<https://graph.microsoft.com>)
- [https://management.azure.com](<https://management.azure.com>)
- [https://login.microsoftonline.com](<https://login.microsoftonline.com>)

  > **Note**
  >
  > If you are using this option, refer to the [Azure Government Endpoint Configuration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-government-endpoint-configuration>) topic for configuration details.

### Creating OAuth 2.0 JWT Certificate Credentials

> [!NOTE]
>
> SailPoint recommends JWT certificate credentials for OAuth 2.0 authentication.

Use the following steps to create JWT certificate credentials for OAuth 2.0 authentication. For more information, refer to [OAuth 2.0 Authentication](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/security.html#oauth-20-authentication>).

#### Registering an Application and Assigning API Permissions

1. Register an application in Azure portal. For more information, refer to [register an application](<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app>) in the Microsoft documentation.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.
2. After you register the app, copy the Application (client) ID, and then generate a client secret.
3. Assign API permissions to the application. For the permissions this connector requires, refer to [Required Permissions](<#required-permissions>). For more information about assigning permissions, refer to [API permissions](<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis>) in the Microsoft documentation.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.

If you have already registered the application and assigned API permissions, continue with [Creating and Using the Certificate](<#creating-oauth-20-jwt-certificate-credentials>).

#### Creating and Using the Certificate

1. Run PowerShell as an administrator on a Windows computer, and then generate a self-signed certificate with the following command:

   `New-SelfSignedCertificate -DnsName "EntraID" -CertStoreLocation "cert:\LocalMachine\My"`
2. Go to **certlm.msc \> Personal \> Certificates**, right-click the certificate, and select **Export**. Complete the Certificate Export Wizard and export the certificate in PFX format.
3. Select **Include all certificates in the certification path if possible** and Enable certificate privacy.
4. Enter a password to protect the private key, and use AES-256-SHA256 encryption. You need this password when you use the PFX file.
5. Save the PFX file to a directory of your choice. Download [OpenSSL](<https://sourceforge.net/projects/openssl/>), or use Git Bash.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.

   Copy the PFX file into the directory where the command prompt or terminal is open as an administrator. Run the following commands one at a time, and press Enter after each command. The file names are examples. You can use other file names if you use the same names in each command.

   1. `openssl pkcs12 -in test1.pfx -nocerts -out sp.key`
   2. `openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt`
   3. `openssl rsa -in sp.key -out rsasp.key -traditional`

      > **Note**
      >
      > The -traditional parameter is not always required. Whether you need it depends on the OpenSSL version.
6. Upload the `sp.crt` file to the Microsoft Entra app registration:

   1. Sign in to the Azure portal.
   2. In App registrations, select the client application.
   3. Select **Certificates &amp; secrets**.
   4. Select **Upload certificate**, select the certificate file, and then select **Add**.
7. On the Connection Settings page, enter the text of `rsasp.key` in Private Key and the text of `sp.crt` in Certificate. For more information, refer to [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#connection-settings>).

   Private Key Password is the passphrase you entered when you created `sp.key`.

## Required Permissions

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment or [Service Principal Accounts Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/workload_identities.html#service-principal-account-management>)), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.
>
> To display cloud resource data through SailPoint CIEM, you must also configure the SailPoint CIEM Azure source. For more information, refer to [Connecting Azure and CIEM](<https://documentation.sailpoint.com/saas/help/ciem/azure/connect_azure.html>).

> [!NOTE]
>
> This list of permissions includes the most commonly used features from the connector, however there may be custom permissions and roles required for certain specific features. Ensure to read the details for each feature in the [Supported Features](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/index.html#supported-features>) section.

If you don’t want to provide granular permissions on each API, provide the following permissions on the entire directory to the client application created in Azure, which will enable the connector to perform read and write operations on users and groups (excluding deleting users and groups) :

- Directory.Read.All (Read Directory Data)
- Directory.ReadWrite.All (Read and Write Directory Data)

> [!IMPORTANT]
>
> To grant read-only access, assign the built-in Reader role to the service principal or the application you created at the tenant root group level.

### Assigning the Built-in Reader Role to the Application

To grant the built-in reader role to the application, follow these steps in the Microsoft Entra ID portal:

1. Go to **Management groups**.
2. Select the **Tenant Root Group** and open its **Access control (IAM)** settings.
3. Select **Add**, then choose **Add role assignment** from the dropdown menu.
4. Select the **Reader**(built-in) role from the list.
5. Go to the **Members** tab and select **Select members**.
6. Search for the application you created earlier and select it.
7. Select the **Review and assign** to finalize the role assignment.

### Assigning Necessary Permissions to the Client Application

To grant the necessary permissions to the client application, follow these steps:

1. In the Microsoft Entra console, go to **API permissions** and select **Add a permission**.
2. On the **Request API permissions** page, select **Microsoft Graph API** from the list of APIs.
3. For the permission type, select **Application permissions**.
4. Under **Select permissions**, choose the permissions listed in the table below, and then select **Add permissions**.
5. Go to the **Grant consent** section and select **Grant admin consent** for your directory.
6. When the confirmation dialog appears, select **Yes**.

### Granular Level Application Permission

- To perform Set Password and Delete user operations, an application created on Azure must have the User Administrator role.
- To manage users with administrative roles or users who are members/owners of role-assignable groups, an application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role.
- Use the Azure portal to assign the previously mentioned administrative roles. For more information, refer to [Assign Microsoft Entra Roles to Users](<https://learn.microsoft.com/en-us/azure/active-directory/roles/manage-roles-portal>).

### Additional API Permissions for CIEM

The following API permissions are necessary for SailPoint CIEM to include potential Azure cloud resource access derived from eligible membership in PIM groups:

- PrivilegedAccess.Read.AzureADGroup
- PrivilegedAssignmentSchedule.Read.AzureADGroup
- PrivilegedEligibilitySchedule.Read.AzureADGroup

The following table lists the required permission types and their purposes:

<table class="span-table"> <tr> <td>Permission</td> <td>Type</td> <td>Purpose</td> </tr> <tr> <td>User.Invite.All</td> <td colspan="1" rowspan="12">Application</td> <td>Creating / Inviting B2B User</td> </tr> <tr> <td>User.Read.All</td> <td>Account Aggregation, Account Delta, Get Object, Roles and Groups Membership Aggregation</td> </tr> <tr> <td>User.ReadWrite.All</td> <td>Create User, Update User Properties (Non Entitlement), Add / Remove License Pack and Plan, Enable/ Disable User Account, Delete User</td> </tr> <tr> <td>Organization.Read.All</td> <td>Aggregate License Pack and Plan Details of tenant</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Add / Remove Directory Roles</td> </tr> <tr> <td>User.Read</td> <td>Pass-through Authentication</td> </tr> <tr> <td>Group.Read.All</td> <td>Group Aggregation</td> </tr> <tr> <td>Group.ReadWrite.All</td> <td>Create Group, Update Group, Delete Group</td> </tr> <tr> <td>Application.Read.All</td> <td>Service Principal Aggregation</td> </tr> <tr> <td>AppRoleAssignment.ReadWrite.All</td> <td>Add / Remove users from Service Principal</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Role provisioning (if defined as Entitlement object)</td> </tr> <tr> <td>RoleManagement.Read.Directory</td> <td>Role Aggregation (if defined as Entitlement object)</td> </tr> </table>

The following permission applies to SAML Bearer Assertion, Refresh Token / AuthCode, and JWT Certificate Credentials grant types:

| Permission | Type | Purpose |
| --- | --- | --- |
| Directory.AccessAsUser.All | Delegated | Change Password, Delete User |

The following permissions apply to Access Packages management:

| Permission | Type | Purpose |
| --- | --- | --- |
| EntitlementManagement.ReadWrite.All | Application | Add / Remove Access Packages |
| EntitlementManagement.Read.All | Application | Access Package Aggregation |

The following permissions apply to Multi-Factor Authentication management:

| Permission | Type | Purpose |
| --- | --- | --- |
| UserAuthenticationMethod.Read.All | Application | MFA Related User Information Aggregation |
| UserAuthenticationMethod.ReadWrite.All | Application | Add / Update / Remove MFA Related User Information |

The following permissions apply to User management:

| Permission | Type | Purpose |
| --- | --- | --- |
| User.EnableDisableAccount.All | Application | Delete User |
| User-PasswordProfile.ReadWrite.All | Application | Set Password |

# Provisioning

The Microsoft Entra ID connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft Entra ID directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

| Account Attribute | Generator | Description |
| --- | --- | --- |
| userPrincipalName\* | Create Unique Account ID | User principal name (UPN) of the user. This generator uses the value in the Pattern Used field to generate a unique user name for the new account.<br>For example, `jeff@contoso.onmicrosoft.com`<br>Note<br>You must edit your domain in the Pattern Used field to match your domain. |
| password\* | Create Password | Password for the new account. |
| displayName\* | Identity Attribute | Display name of the account. |
| mailNickname\* | Create Unique Account ID | Mail alias for the account. |
| accountEnabled | Static | Set it to false to create disabled account. Default: True |
| forceChangePasswordNextLogin | Static | If true, asks user to change password on next sign in. Default: True |
| department | Disable | Department in which the user works. |
| jobTitle | Disable | User's job title. |
| passwordPolicies | Disable | Specifies password policies for the user.<br>For example: DisablePasswordExpiration, DisableStrongPassword |
| otherMails | Disable | Additional email addresses for the user. |
| givenName | Identity Attribute | First name of the user. |
| surname | Identity Attribute | Surname of the user. |
| usageLocation | Static | A two letter country code (ISO standard 3166). Required for users that will be assigned licenses. |
| country | Disable | Country/region in which the user is located. For example, US or UK |
| state | Disable | State or province in the user's address. |
| city | Disable | City in which the user is located. |
| streetAddress | Disable | Street address of the user's place of business. |
| postalCode | Disable | Postal code for the user's postal address. |
| physicalDeliveryOfficeName | Disable | Office location in the user's place of business. |
| telephoneNumber | Disable | Primary telephone number of the user's place of business. |
| mobile | Disable | Primary cellular telephone number for the user. |
| facsimileTelephoneNumber | Disable | Telephone number of the user's business fax machine. |
| userType | Disable | A string value that can be used to classify user types in your directory. |
| isFederatedDomain | Static | Set it true to create federated domain user. If this is checked and **immutableId** is not set then random **immutableId** value will be used. |
| immutableId | Disable | This property is used to associate an on-premises Active Directory user account to their Microsoft Entra ID user account; Populate this attribute with objectGUID of account from on-premises Active Directory to create federated user synchronized with on-premises Active Directory user. |
| preferredLanguage | Disable | Preferred language for the user. Should follow ISO 639-1 Code.<br>For example, `en-US` |
| servicePrincipalRoleId |  | ServicePrincipal Role Id.<br>By default not present in the schema. It is required if you want to assign ServicePrincipal during account creation. |

### Guest User (B2B) Support

The Microsoft Entra ID connector supports creation of Guest User (B2B) by sending invitations. Creation of Guest User (B2B) varies from normal user creation in terms of attributes provided during creation.

#### Create Guest User (B2B) Account Policy

| Attribute Name | Description |
| --- | --- |
| accountType\* | Default is User<br>To create Guest User (B2B), set this value to Guest User B2B. |
| invitedUserEmailAddress\* | Email address of the user. |
| inviteRedirectUrl\* | The URL that the user will be redirected to after redemption. |
| sendInvitationMessage\* | Set it to False if invitation email need not to be sent to the user. Default is True |
| customizedMessageBody | Customized message text that can be added in the invitation email for the B2B Guest User. |
| invitedUserDisplayName | The display name of the user being invited. |
| invitedUserUsageLocation | A two letter country code indicating usage location (ISO standard 3166). |
| servicePrincipalRoleId | ServicePrincipal Role Id.<br>By default not present in the schema. It is required if you want to assign ServicePrincipal during account creation. |

### External Member (B2B) Support

The Microsoft Entra ID connector supports the creation of External Member (B2B) users by sending invitations. This process is similar to creating a Guest (B2B) user, but the `userType` is configured as Member instead of Guest.

#### Create External Member (B2B) Account Policy

| Attribute Name | Description |
| --- | --- |
| accountType\* | Default is User.<br>To create External Member (B2B), set this value to External Member B2B. |
| invitedUserEmailAddress\* | Email address of the user. |
| inviteRedirectUrl\* | The URL that the user will be redirected to after redemption. |
| sendInvitationMessage\* | Default is True.<br>Set it to False if the invitation email should not be sent to the user. |
| customizedMessageBody | Customized message text that can be added in the invitation email for the External Member user. |
| invitedUserDisplayName | The display name of the user being invited. |
| invitedUserUsageLocation | A two-letter country code indicating usage location (ISO standard 3166). |

### Local User (B2C) Support

The Microsoft Entra ID connector supports creation of Local Users. Creation of Local User account varies from normal user in terms of attributes provided during creation. Account creation also supports custom attribute.

#### Create Local User (B2C) Account Policy

| Attribute Name | Description |
| --- | --- |
| accountType\* | Default is User<br>To create Local User (B2C), set this value to Local User B2C. |
| signInNameType\* | Sign-in type for user in your Azure directory. |
| signInNameValue\* | Sign-in name for user. |
| localAccountDisplayName\* | Display name of account. |
| b2cPassword\* | Password for the new account. |
| enableLocalAccount | Set it to false to create disabled account. Default: True |
| b2cForceChangePasswordNextLogin | If true, asks user to change password on next login. Default: True |
| servicePrincipalRoleId | ServicePrincipal Role Id.<br>By default not present in the schema. It is required if you want to assign ServicePrincipal during account creation. |

> [!NOTE]
>
> Custom user attributes can be added in B2C create account policy by appending suffix "\_C" to the attribute.

## Multi-Factor Authentication (MFA) Provisioning Policy Attributes

To provision MFA attributes for users, add the same attributes in the provisioning policy that are present in the account schema (for more information, refer to [Multi-Factor Authentication (MFA) Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#multi-factor-authentication-mfa-attributes>)) with the Review Required flag checked.

> [!NOTE]
>
> When using the phone authentication method, the values for the following attributes are expected to be provided with the country code as a prefix: `mfa_phoneNumber_mobile`, `mfa_phoneNumber_alternateMobile`, and `mfa_phoneNumber_office`. If the country code is not provided provisioning operations will result in failure. The value for these attributes should follow this format (there must be a space between the country code and the phone number):`<country code> <phone number>`
>
> Examples:
>
> - `<AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>`
> - `<AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>`
> - `<AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>`

> [!NOTE]
>
> Once you enable MFA for any user there will be one default authentication method set. This is usually the first method configured, but you can modify it later from the Azure portal. If you are trying to remove values for an attribute that belongs to the default authentication method, the Azure APIs will throw an error as the APIs do not expect to remove values for attributes that belong to the default authentication method. For example, if email is the default authentication method configured for an Azure user, the connector will not be able to remove the value for the `mfa_emailAddress` attribute.

<table> <thead> <tr> <th>Authentication Method</th> <th>Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Phone</td> <td>mfa_phoneNumber_mobile</td> <td>String</td> <td>Mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_alternateMobile</td> <td>String</td> <td>Alternate mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_office</td> <td>String</td> <td>Office phone number assigned to the user.</td> </tr> <tr> <td>Email</td> <td>mfa_emailAddress</td> <td>String</td> <td>Email address assigned to the user.</td> </tr> <tr> <td>Microsoft Authentication</td> <td>mfa_microsoftAuthenticatorAuthenticationMethod</td> <td>String: Multivalued</td> <td>Microsoft Authentication method assigned to the user.</td> </tr> <tr> <td>Other</td> <td>mfa_methodName<br>Where methodName is the authentication method name.<br>For example:<br><ul><li>mfa_fido2AuthenticaitonMethod</li><li>mfa_temporaryAccessPassAuthenticationMethod</li><li>mfa_softwareOauthAuthenticationMethod</li><li>mfa_windowsHelloForBusinessAuthenticationMethod</li></ul></td> <td>String: Multivalued</td> <td>Other authentication method assigned to the user.</td> </tr> </tbody> </table>

For the `mfa_methodName` attribute, the connector only supports removing or clearing the MFA related information. For more information, refer to the second sample update request.

## Provisioning B2C userIdentities and signInNames

You can use the Update and Modify operations like Add, Set, and Remove of `userIdentities` and `signInNames` for a social and local user account in an Azure Active Directory B2C tenant.

If you want to leverage this functionality, add the following attributes in the provisioning policy with type as string and multi as true (with the value in JSON format):

- `userIdentities`
- `signInNames`

## Create/Modify/Delete Mail Contact Profile Attributes

The followings lists the create mail contact profile attributes:

> [!NOTE]
>
> Attributes marked with an asterisk (\*) are mandatory.

| Attribute Name | Description |
| --- | --- |
| mailContact\_displayName\* | Display name of the mail contact. |
| mailContact\_mail\* | External email address of the mail contact. |
| mailContact\_mailNickname | Mail nickname of the mail contact. |
| mailContact\_givenName | First name of the mail contact. |
| mailContact\_surname | Last name of the mail contact. |

### Sample Provisioning Request for Creating Mail Contact

```text
<ProvisioningPlan>
  <AccountRequest op="Create">
    <AttributeRequest name="accountType" op="Add" value="Mail Contact"/>
    <AttributeRequest name="displayName" op="Set" value="DummyContact"/>
    <AttributeRequest name="mailContact_mail" op="Set" value="DummyContact@gmail.com"/>
    <AttributeRequest name="mailContact_mailNickname" op="Set" value="DummyContact"/>
    <AttributeRequest name="mailContact_givenName" op="Set" value="DummyContact-FirstName"/>
    <AttributeRequest name="mailContact_surname" op="Set" value="DummyContact-LastName"/>
</ProvisioningPlan>
```

### Sample Provisioning Request for Modifying Mail Contact

```text
<ProvisioningPlan nativeIdentity="DummyContact">
  <AccountRequest nativeIdentity="microsoft.mailContact:615a0c76-b18f-476c-b448-83610a600973" op="Modify">
    <AttributeRequest  displayValue="DummyGroupName" name="groups" op="Add" value="0a9bd1d7-a993-49b8-ab01-0e4f709ef42b">
      <Attributes>
        <Map>
          <entry key="assignment" value="true"/>
        </Map>
      </Attributes>
    </AttributeRequest>
    <AttributeRequest name="mailContact_city" op="Add" value="Delhi" />
  </AccountRequest>
</ProvisioningPlan>
```

### Sample Provisioning Request for Deleting Mail Contact

```text
<ProvisioningPlan nativeIdentity="DummyContact">
  <AccountRequest nativeIdentity="microsoft.mailContact:615a0c76-b18f-476c-b448-83610a600973" op="Delete"></AccountRequest>
</ProvisioningPlan>
```

# Azure Attributes

The Microsoft Entra ID connector supports additional account and group schema attributes for Azure objects. Add the attributes for the features you manage to the corresponding account or group schema.

The Azure attributes are described on the following pages:

- [Azure PIM and Cloud Object Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/pim_cloud_objects.html>) - Azure PIM attributes and group attributes for Azure cloud objects such as management groups, subscriptions, and resource groups.
- [Workload Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html>) - Group attributes for service principals, account attributes for managing service principals as accounts, and account attributes for user-assigned and system-assigned managed identities.

# Azure PIM and Cloud Object Attributes

## Azure PIM Attributes

Add the following attributes to connector Account Schema:

<table class="span-table"> <tr> <td>Name</td> <td>Type</td> <td>Details</td> </tr> <tr> <td>azureEligibleRoles</td> <td colspan="1" rowspan="6">String : Multivalued : Entitlement</td> <td>List of Azure Roles for which user is eligible</td> </tr> <tr> <td>azureADEligibleRoles</td> <td>List of Microsoft Entra ID Roles for which user is eligible</td> </tr> <tr> <td>azureActiveRoles</td> <td>List of Azure Roles assigned to user</td> </tr> <tr> <td>azureADActiveRoles</td> <td>List of Microsoft Entra ID Roles assigned to user</td> </tr> <tr> <td>azureADEligibleGroups</td> <td>List of groups for which the account has PIM eligible membership.</td> </tr> <tr> <td>azureADActiveGroups</td> <td>List of groups for which the account has PIM active membership.</td> </tr> </table>

### Membership Aggregation

Membership Aggregation is part of account aggregation. PIM Membership aggregation will be added to existing membership aggregation flow and will be triggered only if flag is ON and required attributes are present in account schema Memberships will be aggregated if flag is true and account attributes are present in schema.

For example:

- If the enablePIM attribute is true and only Microsoft Entra ID Roles : Active is present in schema, only Microsoft Entra ID Roles membership for active assignments are aggregated.
- PIM Memberships are aggregated per page. For example, membership is fetched for users aggregated in a page.
- PIM Memberships for Azure resources are aggregated if Azure Management is enabled and respective attributes are present in the schema.

### Membership Aggregation of PIM Roles for Microsoft Entra ID Groups

Azure / Microsoft Entra ID PIM Role assignments / membership for Microsoft Entra ID groups will be visible as entitlement attributes after running group / entitlement aggregation ONLY when relevant role attributes (mentioned above as Azure PIM attributes) are added to group schema and PIM flag is true.

> [!NOTE]
>
> The PIM membership for such groups would show only the native identity of the assigned PIM roles.

### Group Schema Objects

The following new group schema objects are supported.

### Microsoft Entra ID Eligible Role

Object Type is azureADEligibleRole, Identity Attribute is id, and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Eligible role display name. |
| id | Microsoft Entra ID eligible role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Microsoft Entra ID Active Role

Object Type is azureADActiveRole, Identity Attribute is id, and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Active AD role display name. |
| id | Microsoft Entra ID active role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Azure Active Role

Object Type is azureActiveRole, Identity Attribute is id, and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Active role display name. |
| id | Azure active role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Azure Eligible Role

Object Type is azureEligibleRole, Identity Attribute is id , and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| displayName | Eligible role display name. |
| id | Azure eligible role ID. |
| isBuiltIn | Indicates whether role is custom or built-in. |
| roleName | Name of the role. |
| scope | Scope at which role can be assigned. |

### Azure AD Eligible Group

Represents a group for which a principal holds a time-bound eligible PIM membership (the principal must activate the membership before it becomes active).

Object Type is azureADEligibleGroup, Identity Attribute is id , and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| id | Native ID. The unique identifier (object ID) of the group. |
| displayName | Display name of the group. |
| description | Description of the group. |
| securityEnabled | Indicates whether the group is a security group. |
| groupTypes | Type of the group. Blank for Security groups; Unified for Microsoft 365 groups. |

### Azure AD Active Group

Represents a group for which a principal holds a time-bound active PIM membership.

Object Type is azureADActiveGroup, Identity Attribute is id , and the Display Attribute is displayName.

| Attribute Name | Description |
| --- | --- |
| id | Native ID. The unique identifier (object ID) of the group. |
| displayName | Display name of the group. |
| description | Description of the group. |
| securityEnabled | Indicates whether the group is a security group. |
| groupTypes | Type of the group. Blank for Security groups; Unified for Microsoft 365 groups. |

## Group Attributes for Azure Cloud Objects

> [!NOTE]
>
> The schema for the following mentioned Group objects is not available with the included Microsoft Entra ID connector. You must purchase a CIEM license in order to enable the Cloud Governance features of the connector.

To manage the following Azure Management Objects, ensure that the attributes present in the respective sections are present in the group schema:

- [Management Groups](<#management-groups>)
- [Subscriptions](<#subscriptions>)
- [Resource Group](<#resource-group>)
- [Azure Role Assignment](<#azure-role-assignment>)

### Management Groups

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| displayName | Name of the management group. |
| id | Fully qualified ID for the management group. |
| type | Objecttype. |
| name | Name of the management group. |

Example schema:

The following is the corresponding sample entry of this entitlement in the account schema (if needed):

### Subscriptions

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| displayName | Display name of the subscription. |
| id | Subscription identifier with scope. |
| authorizationSource | Authorization Source for the subscription. Default: RoleBased |
| managedByTenants | List of tenants managing subscription.<br>Type: String, Multi-Valued |
| subscriptionId | Unique identifier for the subscription. |
| tenantId | Tenant ID with which subscription has trust relationship. |
| state | State of subscription, that is, it is enabled or disabled. |

Example schema:

The following is the corresponding sample entry of this entitlement in the account schema (if needed):

### Resource Group

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| id | ID of the resource group. |
| name | Name of the resource group. |
| type | Type of the resource group. |
| location | Location of the resource group. |
| provisioningState | Provisioning state of the resource group. |

Example schema:

The following is the corresponding sample entry of this entitlement in the account schema (if needed):

### Azure Role Assignment

Add the following attributes to your schema using the [Create New Schema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Attribute Name | Description |
| --- | --- |
| displayName | Display name. |
| id | Azure Role Assignment ID. |
| resource | Display name of the resource on which role can be assigned. |
| roleName | Display name of the role which can be assigned on resource. |

Example schema:

The following is the corresponding sample entry of this entitlement in the account schema (if needed):

# Workload Identity Attributes

## Service Principal

> [!NOTE]
>
> - The Service Principal Group Object schema is not available out of the box for new connectors and should only be added if you intend to manage Service Principal as a Group Object.
> - The Microsoft Entra ID connector has the capability to manage Service Principals as Account, which is the recommended approach. For more information, refer to [Service Principal Account Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/workload_identities.html#service-principal-account-management>).

```text
{
    "nativeObjectType": "servicePrincipal",
    "identityAttribute": "objectId",
    "displayAttribute": "displayName",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "displayName",
            "type": "STRING",
            "schema": null,
            "description": "ServicePrincipal name",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "servicePrincipalType",
            "type": "STRING",
            "schema": null,
            "description": "ServicePrincipal type",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "objectId",
            "type": "STRING",
            "schema": null,
            "description": "ServicePrincipal ID",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "owners",
            "type": "STRING",
            "schema": null,
            "description": "ServicePrincipal Owners",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "appRoles",
            "type": "STRING",
            "schema": null,
            "description": "ServicePrincipal Roles",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        }
    ],
    "name": "servicePrincipal",
    "created": "2021-06-25T08:47:33.024Z",
    "modified": null
}​
```

## Service Principal As Accounts Attributes

You can automate the process of adding Service Principal account attributes to the account schema, with the toggle option for **Manage Azure Service Principal As Account** during Account Schema configuration. This reduces your efforts by automating the Service Principal account attributes addition process. It allows the segregation of various feature attributes within account schema for better retrieval.

> [!IMPORTANT]
>
> Ensure Manage Microsoft Entra Service Principals as Accounts during [Feature Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/feature_management.html#feature-management>) configuration is selected to aggregate Azure Service Principals along with users during the account aggregation process.

Select **Include Attributes in Schema** for managing azure Service Principal as account to automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration.

To manage Service Principals, following lists the attributes that are present in the account schema:

<table> <thead> <tr> <th>Schema Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>objectId</td> <td>String</td> <td>The ID of the user, service principal, or managed identity.<br>This is an Identity Attribute that must not be changed.<br><strong>Note</strong><br><code>objectId</code> is a concatenation of the Service Principal (SPN) Object ID and the corresponding Application Object ID.</td> </tr> <tr> <td>accountEnabled</td> <td>Boolean</td> <td>This is set to true if the user, service principal, or managed identity is enabled. Otherwise, this is set to false.</td> </tr> <tr> <td>spn_appDisplayName</td> <td>String</td> <td>The display name for the application.</td> </tr> <tr> <td>spn_app_Description</td> <td>String</td> <td>This is a free-text field for providing the description of the application object to end users. The maximum size is 1024 characters.</td> </tr> <tr> <td>spn_appId</td> <td>String</td> <td>This is the unique identifier for the application that is assigned to an application by Microsoft Entra.</td> </tr> <tr> <td>spn_applicationTemplateId</td> <td>String</td> <td>This is the unique identifier of the application template.</td> </tr> <tr> <td>spn_appOwnerOrganizationId</td> <td>String</td> <td>This contains the tenant ID where the application is registered.</td> </tr> <tr> <td>spn_createdDateTime</td> <td>String</td> <td>This is the date and time the application was registered.</td> </tr> <tr> <td>spn_homepage</td> <td>String</td> <td>This is the home page or landing page of the application.</td> </tr> <tr> <td>spn_loginUrl</td> <td>String</td> <td>Displays the URL where the service provider redirects the user to Microsoft Entra to authenticate.</td> </tr> <tr> <td>spn_logoutUrl</td> <td>String</td> <td>Displays the URL that will be used by Microsoft's authorization service to log out a user.</td> </tr> <tr> <td>description</td> <td>String</td> <td>The description that is displayed in the address book for the user or service principal.</td> </tr> <tr> <td>displayName</td> <td>String</td> <td>The name displayed in the address book for the user or service principal.</td> </tr> <tr> <td>spn_servicePrincipalType</td> <td>String</td> <td>Identifies whether the service principal represents an application, managed identity, or legacy application.</td> </tr> <tr> <td>spn_signInAudience</td> <td></td> <td>Displays the Microsoft accounts that are supported for the current application.</td> </tr> <tr> <td>spn_passwordCredentials</td> <td>String<br>Multi</td> <td>The collection of password credentials associated with the service principal.</td> </tr> <tr> <td>spn_keyCredentials</td> <td>String<br>Multi</td> <td>The collection of key credentials associated with the service principal.</td> </tr> <tr> <td>spn_tags</td> <td>String<br>Multi</td> <td>The custom strings that can be used to categorize and identify the service principal.</td> </tr> <tr> <td>spn_app_owners<br><strong>Note</strong><br>Both Users and Applications (corresponding SPN) can be owners.<br>For consistency, the following are shown:<br><ul><li>owner type :: displayName :: object Id<br>Where <code>owner type</code> will either be SPN or User</li></ul></td> <td>String<br>Mutli</td> <td>Directory objects that are owners of the application.</td> </tr> <tr> <td>spn_owner<br><strong>Note</strong><br>Only Users can be owners of SPN. Showing <code>displayName :: ObjectId</code></td> <td>String<br>Multi</td> <td>Directory objects that are owners of this servicePrincipal.</td> </tr> <tr> <td>spn_app_passwordCredentials</td> <td>Multi</td> <td>The collection of password credentials associated with the application.</td> </tr> <tr> <td>spn_app_keyCredentials</td> <td>Multi</td> <td>The collection of key credentials associated with the service principal.</td> </tr> <tr> <td>spn_appRoles</td> <td>String<br>Multi</td> <td>The roles exposed by the application that this service principal represents.</td> </tr> <tr> <td>appRoleAssignments</td> <td>applicationRole<br>Multi</td> <td>Lists the associated application roles for the Account. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>groups</td> <td>group<br>Multi</td> <td>Lists the associated groups for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>roles</td> <td>roles<br>Multi</td> <td>Lists the associated Microsoft Entra Roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>azureActiveRoles</td> <td>azureActiveRole<br>Multi</td> <td>Lists the associated Azure active roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>azureADActiveRoles</td> <td>azureADActiveRole<br>Multi</td> <td>Lists the associated Microsoft Entra ID roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>azureRoleAssignments</td> <td>azureRoleAssignment<br>Multi</td> <td>Lists the associated RBAC roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>spn_adminConsentedPermissions</td> <td>adminConsentedPermission<br>Multi<br>Entitlement</td> <td>Lists the associated Azure admin consented permissions for the service principal. This is a multi-valued, entitlement, and managed attribute.</td> </tr> <tr> <td>spn_userConsentedPermissions</td> <td>String<br>Multi<br>Entitlement</td> <td>Lists the associated Azure user consented permissions for the service principal. This is a multi-valued, entitlement, and managed attribute.</td> </tr> </tbody> </table>

> [!NOTE]
>
> The Service Principal object will also display Application object properties. Attributes with *app* in the name are Application object properties and all others are Service Principal object properties.
>
> For example,
>
> - spn\_app\_owners is for directory objects that are owners of the *application*.
> - spn\_owners is for directory objects that are owners of this *service principal*.

## User-Assigned Managed Identity Attributes

You can automate the process of adding user-assigned managed identities account attributes to the account schema, with the toggle option for **User Assigned Managed Identities** during Account Schema configuration. This reduces your efforts by automating the user-assigned managed identities account attributes addition process. It allows the segregation of various feature management attributes within account schema for better retreival.

> [!IMPORTANT]
>
> Ensure Include User-Assigned Managed Identities during [Cloud Resource Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/feature_management.html#cloud-resource-management>) configuration is selected to manage user-assigned identities.

Select **Include Attributes in Schema** for managing user-assigned managed identities to automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration.

To manage user-assigned managed identities, following lists the attributes that are present in the account schema:

| Attribute Name | Description |
| --- | --- |
| objectId | ID of the user or managed identity. |
| managedIdentity\_location | The geolocation where the managed identity lives. |
| displayName | The display name of the user or managed identity. |
| managedIdentity\_tags | Tags for the managed identity resource. |
| managedIdentity\_type | The type of managed identity resource. |
| managedIdentity\_principalId | The ID of the service principal object associated with the managed identity. |
| managedIdentity\_associatedResources | Lists the associated Azure resources for the managed identity. This is a multi-valued attribute. |
| azureRoleAssignements | Lists the associated RBAC roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| groups | Lists the associated groups for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureActiveRoles | Lists the associated Azure active roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |

## System-Assigned Managed Identity Attributes

You can automate the process of adding system-assigned managed identities account attributes to the account schema, with the toggle option for **System-Assigned Managed Identities** during Account Schema configuration. This simplifies your workflow by automating the system-assigned managed identities account attributes addition process. It enables organized segregation of system-assigned identity-related attributes within the account schema for more efficient retrieval.

> [!IMPORTANT]
>
> Ensure Include System-Assigned Managed Identities during [Cloud Resource Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/feature_management.html#cloud-resource-management>) configuration is selected to manage system-assigned identities.

Select **Include Attributes in Schema** for managing system-assigned managed identities to automate the process of adding system-assigned managed identities account attributes to the account schema during Account Schema configuration.

To manage system-assigned managed identities, following lists the attributes that are present in the account schema:

| Attribute Name | Description |
| --- | --- |
| objectId | ID of the user or managed identity. |
| managedIdentity\_location | The geolocation where the managed identity lives. |
| displayName | The display name of the user or managed identity. |
| managedIdentity\_tags | Tags for the managed identity resource. |
| managedIdentity\_type | The type of managed identity resource. |
| managedIdentity\_principalId | The ID of the service principal object associated with the managed identity. |
| managedIdentity\_associatedResources | Lists the associated Azure resources for the managed identity. This is a multi-valued attribute. |
| azureRoleAssignements | Lists the associated RBAC roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| groups | Lists the associated groups for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureActiveRoles | Lists the associated Azure active roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| managedIdentity\_tenantId | The Azure Active Directory (AAD) tenant ID associated with the managed identity. This uniquely identifies the directory where the resource resides. |
| managedIdentity\_resourceName | The name of the Azure resource (e.g., a Storage Account, App Service, etc.) to which the managed identity is attached. |
| managedIdentity\_resourceType | The resource type identifies the service provider and the specific type of the resource. |
| managedIdentitiy\_resourceKind | The kind of the Azure resource, providing additional classification or capabilities. |

# Directory Attributes

## Admin Consented Permission Attributes

To manage admin consented permissions, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The object type is `adminConsentedPermission`.

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for adminConsentedPermission.<br>This is the native identity attribute. This ID is a concatenation of `resourceId:value`<br>Where `resourceId` is the ID of SPN and `value` is the value for the adminConsentedPermssion within that SPN.<br>For example:<br>`2555d458-1b3c-4953-bcc4-a38409561c2f:AuditLog.Read.All` |
| displayName | String | This is the display name of the adminConstentedPermission.<br>Just like id, displayName is a concatenation of `value [on] resource-DisplayName`<br>For example:<br>If an SPN with a displayName of `Microsoft Graph` has a permission defined with the value as `AuditLog.Read.All`, then the displayName for adminConsentedPermission after concatenation would be `AuditLog.Read.All [on] Microsoft Graph` |
| spn\_description | String | This is the description for the SPN. |
| permission\_description | String | This is the description for the adminConsentedPermission. |
| type | String | The possible values are `User` and `Admin`. This denotes whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an admin consent should always be required. |
| isEnabled | boolean | Whether the adminConsentedPermission is enabled or disabled. |
| value | String | The value for the attribute. For example:<br>`AuditLog.Read.All` |

Use the following JSON request and REST API to add the `adminConsentedPermission` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
        "nativeObjectType": "adminConsentedPermission",
        "identityAttribute": "id",
        "displayAttribute": "displayName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "displayName",
                "type": "STRING",
                "schema": null,
                "description": "The display name for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "spn_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of service principal",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "permission_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "id",
                "type": "STRING",
                "schema": null,
                "description": "The unique identifier for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "type",
                "type": "STRING",
                "schema": null,
                "description": "Allowed types for admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "isEnabled",
                "type": "STRING",
                "schema": null,
                "description": "States whether the admin consented permission is enabled or not",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "value",
                "type": "STRING",
                "schema": null,
                "description": "Value of the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ]
}
```

## Administrative Units Attributes

To manage administrative units, ensure that the following attribute is present in the account schema:

| Name | Type | Details |
| --- | --- | --- |
| administrativeUnits | String<br>Multivalued<br>Entitlement | List of Administrative Units to which the user belongs to. |

### Object Type - administrativeUnit

To manage the Microsoft Entra ID administrative units objects, ensure that the following attributes are present in the entitlement schema:

<table class="span-table"> <tr> <td>Schema Attribute Name</td> <td>Type</td> <td>Description</td> </tr> <tr> <td>id</td> <td colspan="1" rowspan="8">String</td> <td>Fully qualified ID for the Administrative Unit.</td> </tr> <tr> <td>displayName</td> <td>Friendly name of the Administrative Unit.</td> </tr> <tr> <td>description</td> <td>This is the description of the Administrative Unit.</td> </tr> <tr> <td>isMemberManagementRestricted</td> <td>This is the description of Administrative Unit.</td> </tr> <tr> <td>membershipRule</td> <td>Membership Rule.</td> </tr> <tr> <td>membershipType</td> <td>MembershipType.</td> </tr> <tr> <td>membershipRuleProcessingState</td> <td>Membership Rule Processing State.</td> </tr> <tr> <td>visibility</td> <td>Visibility.</td> </tr> </table>

Use the following JSON request and the SailPoint REST API to add the `administrativeUnit` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
      "type": "administrativeUnit",
      "nativeObjectType": "administrativeUnit",
      "identityAttribute": "id",
      "displayAttribute": "displayName",
      "attributes": [
        {
          "name": "id",
          "type": "STRING",
          "schema": null,
          "description": "Fully qualified ID for the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "displayName",
          "type": "STRING",
          "schema": null,
          "description": "Friendly name of the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "description",
          "type": "STRING",
          "schema": null,
          "description": "Description of Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "isMemberManagementRestricted",
          "type": "BOOLEAN",
          "description": "Description of Administrative Unit"
        },
        {
          "name" : "membershipRule",
          "type" : "STRING",
          "description": "Membership Rule"
        },
        {
          "name" : "membershipType",
          "type" : "STRING",
          "description": "Membership Type"
        },
        {
          "name" : "membershipRuleProcessingState",
          "type" : "STRING",
          "description": "Membership Rule Processing State"
        },
        {
          "name" :"visibility",
          "type" : "STRING",
          "description" : "Visibility"
        }

]

}
```

## Application Role Attributes

### Object Type - applicationRole

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for Application Role.<br>This is the nativeIdentity attribute.<br>This id is a concatenation of:<br>`resourceId:appRoleId`<br>Where, `resourceId` is the ID of SPN, and `appRoleId` is the ID for the appRole within that SPN.<br>For example, `70b32868-8393-4c4e-99fc-916710f62412:6f445064-b311-4d3e-a869-e024e787d6a9` |
| displayName | String | This is the display name of the Application Role.<br>Just like id, displayName is a concatenation of:<br>`resource-DisplayName: appRole-DisplayName`<br>For example, if an SPN with displayName TestSPN, has an appRole defined with name Engineer, then the displayName for appRole after concatenation would be TestSPN:Engineer |
| spn\_description | String | This is the description for the SPN. |
| appRole\_description | String | This is the description for the appRole. |
| allowedMemberTypes | String<br>Multi | Displays the types of members that this role can be assigned to. For example, `Users,Groups,Applications` |
| isEnabled | boolean | Displays whether the appRoles is enabled or disabled. |
| value | String |  |

Use the following JSON request and the REST API to add the `ApplicationRole` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
    "nativeObjectType": "applicationRole",
    "name": "applicationRole",
    "identityAttribute": "id",
    "displayAttribute": "displayName",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "id",
            "type": "STRING",
            "schema": null,
            "description": "Unique Identifier for Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "displayName",
            "type": "STRING",
            "schema": null,
            "description": "Display Name of the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "spn_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Service Principal",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "appRole_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "allowedMemberTypes",
            "type": "STRING",
            "schema": null,
            "description": "Types of members that this role can be assigned to, for example: Users,Groups,Applications",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "isEnabled",
            "type": "BOOLEAN",
            "schema": null,
            "description": "Represents whether the Application Role is enabled or disabled.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "value",
            "type": "STRING",
            "schema": null,
            "description": "The value of the Application Role.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}
```

## Roles

To manage the Microsoft Entra role objects, ensure that the following attributes are present in the group schema.

| Attribute Name | Description |
| --- | --- |
| description | Specify the description of the Microsoft Entra role. |
| displayName | Specify the display name for the Microsoft Entra role. |
| id | Specify the unique identifier for the Microsoft Entra role. |
| isBuiltIn | Specify the flag indicating whether the role is part of the default set included in Microsoft Entra or a custom one. |
| isEnabled | Specify the flag indicating whether the role is enabled for assignment. If it is false, the role is not available for assignment. |
| rolePermissions | Specify the list of permissions included in the role. |

### Backward Compatibility Note

The Microsoft Entra ID connector used to support roles as entitlement attribute on accounts but there was no support to aggregate roles as new separate group / entitlement type.

With that configuration, the connector used to show ‘displayName’ of role as entitlement value on the accounts. In order to continue support displayName based role entitlements, connector supports displayName as native Identity attribute of the new role object.

There are certain limitations in using displayName as native identity attribute :

- Duplicate displayName is allowed for roles. If duplicate display names exists in your deployment, then avoid using displayName as native identifier.
- **displayName** is an editable field, so it should not be edited if used as native identifier.

## Mail Contacts As Accounts Attributes

To manage mail contacts as accounts, ensure the following attributes are present in your account schema:

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| objectId | String | ID is normal GUID. So to identity this object as `mailContacts` you should save this as `microsoft.mailContact:88914ce6-7962-4465-8cb3-371268c1e64a` |
| displayName | String | Display name of the mail contact. |
| groups | String<br>Multivalued<br>Entitlement<br>Managed | List of groups that the mail contact is a member of. |
| mailContact\_department | String | The name for the department in which the contact works. |
| mailContact\_companyName | String | The name of the company that this mail contact belongs to. |
| mailContact\_givenName | String | First name of the mail contact. |
| mailContact\_jobTitle | String | Job title of the mail contact. |
| mailContact\_mail | String | The SMTP address of the contact. For example, `jeff@contoso.onmicrosoft.com` |
| mailContact\_mailNickName | String | Email alias (portion of the email address prepending the @ symbol) of the mail contact. |
| mailContact\_surname | String | Last name of the mail contact. |
| mailContact\_address | String | Post address of the mail contact.<br>Note<br>The contact can only have one physical address. |
| mailContact\_phones | String | List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax. |

### Sample JSON Request for Managing Mail Contacts As Accounts

```text
{
  "nativeObjectType": "account",
  "identityAttribute": "objectId",
  "displayAttribute": "userPrincipalName",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [],
  "configuration": {},
  "attributes": [
    {
      "name": "objectId",
      "type": "STRING",
      "schema": null,
      "description": "The unique identifier for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "STRING",
      "schema": null,
      "description": "The name displayed in the address book for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "groups",
      "type": "STRING",
      "schema": {
        "type": "CONNECTOR_SCHEMA",
        "id": "2c918085843dc5ce01845bebf6e43a8a",
        "name": "group"
      },
      "description": "Groups assigned to a user",
      "isMulti": true,
      "isEntitlement": true,
      "isGroup": true
    },
    {
      "name": "mailContact_phones",
      "type": "STRING",
      "schema": null,
      "description": "List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax.",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_department",
      "type": "STRING",
      "schema": null,
      "description": "The name for the department in which the contact works.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_companyName",
      "type": "STRING",
      "schema": null,
      "description": "The name of the company that this mail contact belongs to.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_givenName",
      "type": "STRING",
      "schema": null,
      "description": "First name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_surname",
      "type": "STRING",
      "schema": null,
      "description": "Last name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_jobTitle",
      "type": "STRING",
      "schema": null,
      "description": "Job title of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mailNickName",
      "type": "STRING",
      "schema": null,
      "description": "Email alias (portion of the email address prepending the @ symbol) of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mail",
      "type": "STRING",
      "schema": null,
      "description": "The SMTP address of the contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```

## Channel Attributes

To manage the channel management objects, ensure that the following attributes are present in the group schema.

<table> <thead> <tr> <th>Attribute Name</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>description</td> <td>Optional textual description for the channel.</td> </tr> <tr> <td>displayName</td> <td>Channel name as it will appear to the user in Microsoft Teams.<br>Combination of team display name: channel display name.</td> </tr> <tr> <td>id</td> <td>The channel's unique identifier.<br>Combination of team id: channel id</td> </tr> <tr> <td>isFavoriteByDefault</td> <td>Indicates whether the channel must automatically be marked favorite for all members of the team. Default: false.</td> </tr> <tr> <td>email</td> <td>The email address for sending messages to the channel. Read-only.</td> </tr> <tr> <td>webUrl</td> <td>A hyperlink that will go to the channel in Microsoft Teams.</td> </tr> <tr> <td>membershipType</td> <td>The type of the channel. Possible values are:<br><ul><li>standard: Channel inherits the list of members of the parent team.</li><li>private: Channel can have members that are a subset of all the members on the parent team.</li></ul></td> </tr> <tr> <td>createdDateTime</td> <td>Read only. Timestamp at which the channel was created.</td> </tr> <tr> <td>teamEmail</td> <td>The email address of the parent team.</td> </tr> <tr> <td>owners</td> <td>The list of owners of the private channel.<br>Properties: Multi-Valued</td> </tr> </tbody> </table>

# Schema Reference

This section describes the different schema attributes. The Microsoft Entra ID connector currently supports the following types of objects:

- Account: Account objects are used when building identities Link objects.
- Group: The group schema is used when building Account-Group objects that are used to hold entitlements shared across identities.
- Service Principal: The Service Principal schema is used to represent Azure Service Principal which are identities created for use with applications, hosted services, and automated tools to access Azure resources.
- Service Plan: The Service Plan schema is used to represent Azure Service Plan (License Plans).
- Management Group: The Management group schema is used to represent Azure Management Groups which are created to allow Azure customers to organize their subscriptions and apply governance controls such as Role Based Access Control and Policies.
- Subscription: The Subscription schema is used to represent Azure Subscription objects which represent a signed agreement between a supplier and customer that the customer would receive and provide payment for regular products or services.
- Resource Group: The Resource group schema is used to represent Azure Resource Groups which are container objects that hold related resources for an Azure solution.
- Azure Role Assignment: The Azure Role Assignment schema is used to represent custom group objects that consist of the following elements:

  - Security Principal (user, groups, service principal, managed identity)
  - Role Definition
  - Access Scope

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Microsoft Entra ID connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| objectId | Account |
| objectId | Group |
| objectId | Service Principle |
| objectId | Service Plan |
| id | Channel |
| id | Azure Eligible Role |
| id | Azure Active Role |
| id | Microsoft Entra ID Active Role |
| id | Microsoft Entra ID Eligible Role |
| id | applicationRole |

### Default Account Attributes

The Microsoft Entra ID connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| accountEnabled | True if the user is enabled; otherwise, false. |
| assignedLicenses | List of the licenses that are assigned to the user. |
| assignedPlans | Plans that are assigned to the user (Entitlement). |
| city | City in which the user is located. |
| country | Country/region in which the user is located. |
| creationType | Indicates whether the user account is a local account for an Azure Active Directory B2C tenant. |
| department | Name for the department the user belongs to. |
| onPremisesSyncEnabled | Indicates whether a Microsoft Entra ID user is synchronized from an on-premises directory. |
| disabledPlans | Plans that are not assigned to the user. |
| displayName | Name displayed in the address book for the user. |
| employeeId | Numerically identifies an employee within an organization. |
| facsimileTelephoneNumber | Telephone number of the user's business fax machine. |
| givenName | First name of an user. |
| groups | Groups assigned to an user (Entitlement). |
| servicePrincipals | Enterprise Applications assigned to a user.<br>Note<br>The existing `servicePrincipals` attribute has been renamed to a new entitlement attribute named `appRoleAssignments` (along with an associated new entitlement schema. For more information, refer to [appRoleAssignments](<#default-account-attributes>). To continue to manage Service Principals as a group object, the schema from [Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal>) and the respective account attribute needs to be present in your configuration. |
| immutableId | Property used to associate an on-premises Active Directory user account to their Microsoft Entra ID user account. |
| jobTitle | User’s job title. |
| lastDirSyncTime | Indicates the last time at which the user was synchronized with the on-premises directory. |
| signInActivity.lastNonInteractiveSignInDateTime | Indicates the last time a user signed in to the directory with an non-interactive authentication method.<br>The timestamp represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2022 is `2022-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastNonInteractiveSignInRequestId | Indicates the request identifier of the last non-interactive sign-in performed by this user.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSignInDateTime | Indicates the last time a user signed in to the directory with an interactive authentication method.<br>The timestamp represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2022 is `2022-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSignInRequestId | Indicates the request identifier of the last interactive sign-in performed by this user.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSuccessfulSignInDateTime | Indicates the date and time of the user's most recent successful sign-in activity.<br>The timestamp type represents date and time information always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| signInActivity.lastSuccessfulSignInRequestId | Indicates the request identifier of the last successful sign-in activity.<br>Note<br>This attribute is not present by default and must be added explicitly to the account schema if required. |
| mail | The SMTP address for the user. For example, `john@contoso.onmicrosoft.com` |
| mailNickname | Mail alias for the user. |
| signInNames | Specifies the collection of sign-in names for a local account in an Azure Active Directory B2C tenant. |
| manager | Manager of the user. (Type: String).<br>The Microsoft Entra ID connector provides support for provisioning the `manager` attribute. For more information, refer to [Support for Provisioning Operations of 'manager' Attribute](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/configuring_for_integration.html#support-for-provisioning-operations-of-manager-attribute>). |
| mobile | Primary cellular telephone number for the user. |
| objectId | Unique identifier for the user. |
| onPremisesSecurityIdentifier | Contains the on-premises security identifier (SID) for the user that was synchronized from on-premises to the cloud. |
| otherMails | A list of additional email addresses for the user. |
| passwordPolicies | Specifies password policies for the user. |
| physicalDeliveryOfficeName | Office location in the user's place of business. |
| postalCode | ZIP OR postal code for the user's postal address. |
| preferredLanguage | Preferred written or spoken language for a person. |
| proxyAddresses | Proxy addresses.<br>For example, `["SMTP: bob@contoso.com", "smtp: bob@sales.contoso.com"]` |
| roles | Administrator Role assigned to user (Entitlement). |
| sipProxyAddress | Specifies the voice over IP (VOIP) session initiation protocol (SIP) address for the user. |
| state | State or province in the user's address. |
| sponsors | Sponsors of the user. The Microsoft Entra ID connector provides support aggregation and provisioning of sponsors attribute. For more information, refer to [Configuring Sponsors for Guest User ( B2B) and External Member (B2B)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/configuring_for_integration.html#sponsors-for-guest-user-b2b-and-external-member-b2b>). |
| userIdentities | Specifies the collection of userIdentities for a social user account in an Azure Active Directory B2C tenant. |
| streetAddress | Street address of the user's place of business. |
| surname | Last name of the user. |
| telephoneNumber | Primary telephone number of the user's place of business. |
| usageLocation | A two letter country code indicating usage location. |
| userPrincipalName | User principal name (UPN) of the user. |
| userType | Type of the user. |
| channels | List of channel membership of a user.<br>Type: Entitlement, Multi-Valued |
| azureRoleAssignments\* | Azure Role Assignments assigned to user (Only applicable for SailPoint CIEM). |
| appRoleAssignments | Lists the associated application roles for the Account. This is a multi-valued, entitlement, and managed attribute.<br>Type: applicationRole, Multi-Valued |

#### Risky User Alert Supported Attributes

| Attribute Name | Description |
| --- | --- |
| riskLevel | Level of the detected risky user. |
| riskState | State of the user's risk. |
| riskDetail | Details of the detected risk. |
| riskLastUpdatedDateTime | The date and time that the risky user was last updated. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Microsoft Entra ID connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| description | Description for the group. |
| dirSyncEnabled | Indicates whether this group was synced from the on-premises directory. |
| displayName | Display name for the group. |
| lastDirSyncTime | Indicates the last time at which the group was synced with the on-premises directory. |
| mail | SMTP address for the group. |
| mailEnabled | Specifies whether the group is mail-enabled |
| mailNickname | Mail alias for the group. |
| objectId | Group ID. |
| onPremisesSecurityIdentifier | Contains the on-premises security identifier (SID) for the group that was synchronized from on-premises to the cloud. |
| owners | Owner of the group. |
| proxyAddresses | Proxy addresses of the group. |
| securityEnabled | Specifies whether the group is a security group. |
| teamsEnabled | Specifies whether teams has been enabled for the group. |
| groupTypes | Type of the group. Blank for Security and /or Unified for Office 365 type of groups.<br>For example, Unified for Office 365 group. |

## Access Package Attributes

To manage access packages, ensure that the following attribute is present in the account schema:

| Attribute Name | Description |
| --- | --- |
| accessPackages | List of access packages assigned to the user.<br>Type: Entitlement, Multi-Valued |

To manage the Microsoft Entra access package objects, ensure that the following attributes are present in the group schema:

| Attribute Name | Description |
| --- | --- |
| id | Unique identifier of the Access Package. |
| displayName | Display name made by combining the Access Package name and Policy name. |
| description | Description of the Access Package. |
| policyDescription | Description of the Access Package's policy. |
| expiration | Expiration time for the Access Package's policy. |
| isHidden | Indicates whether the Access Package is hidden from end users on My Access portal. |
| catalog | Container where the Access Package resides. |

## Identity Profile Mapping

The Microsoft Entra ID connector supports the following attributes in Identity Profile Mapping by default:

| Identity Attribute | Schema Attribute |
| --- | --- |
| displayName | displayName |
| email | userPrincipalName |
| firstname | givenName |
| lastname | surname |
| phone | mobile |
| uid | userPrincipalName |
| workPhone | telephoneNumber |

## Multi-Factor Authentication (MFA) Attributes

To manage multi-factor authentication user information, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> When using the phone authentication method, the values for the following attributes are expected to be provided with the country code as a prefix: `mfa_phoneNumber_mobile`, `mfa_phoneNumber_alternateMobile`, and `mfa_phoneNumber_office`. If the country code is not provided provisioning operations will result in failure. The value for these attributes should follow this format (there must be a space between the country code and the phone number):`<country code> <phone number>`
>
> Examples:
>
> - `<AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>`
> - `<AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>`
> - `<AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>`

> [!NOTE]
>
> Once you enable MFA for any user there will be one default authentication method set. This is usually the first method configured, but you can modify it later from the Azure portal. If you are trying to remove values for an attribute that belongs to the default authentication method, the Azure APIs will throw an error as the APIs do not expect to remove values for attributes that belong to the default authentication method. For example, if email is the default authentication method configured for an Azure user, the connector will not be able to remove the value for the `mfa_emailAddress` attribute.

<table> <thead> <tr> <th>Authentication Method</th> <th>Attribute Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Phone</td> <td>mfa_phoneNumber_mobile</td> <td>String</td> <td>Mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_alternateMobile</td> <td>String</td> <td>Alternate mobile phone number assigned to the user.</td> </tr> <tr> <td>Phone</td> <td>mfa_phoneNumber_office</td> <td>String</td> <td>Office phone number assigned to the user.</td> </tr> <tr> <td>Email</td> <td>mfa_emailAddress</td> <td>String</td> <td>Email address assigned to the user.</td> </tr> <tr> <td>Microsoft Authentication</td> <td>mfa_microsoftAuthenticatorAuthenticationMethod</td> <td>String: Multivalued</td> <td>Microsoft Authentication method assigned to the user.</td> </tr> <tr> <td>Other</td> <td>mfa_methodName<br>Where methodName is the authentication method name.<br>For example:<br><ul><li>mfa_fido2AuthenticationMethod</li><li>mfa_temporaryAccessPassAuthenticationMethod</li><li>mfa_softwareOathAuthenticationMethod</li><li>mfa_windowsHelloForBusinessAuthenticationMethod</li></ul></td> <td>String: Multivalued</td> <td>Other authentication method assigned to the user.</td> </tr> </tbody> </table>

## Service Plan

```text
{
  "name": "servicePlan",
  "nativeObjectType": "servicePlan",
  "identityAttribute": "objectId",
  "displayAttribute": "displayName",
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "attributes": [
    {
      "name": "objectId",
      "type": "string",
      "isMultiValued": false,
      "description": "Unique identifier for the service plan which is a combination of skuId and servicePlanId separated by colon (:).",
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuId",
      "type": "string",
      "description": "Unique identifier (GUID) for the License Pack",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuPartNumber",
      "type": "string",
      "description": "The SKU part number of the License Pack. For example, AAD_PREMIUM",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "appliesTo",
      "type": "string",
      "description": "Object types to which the license pack can be assigned. For example: User, Company",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "string",
      "description": "Display name of service plan which is a combination of skuPartNumber and servicePlanName separated by colon (:).",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanId",
      "type": "string",
      "description": "Unique identifier of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanName",
      "type": "string",
      "description": "The name of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "provisioningStatus",
      "type": "string",
      "description": "The provisioning status of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ],
  "created": "2019-12-24T22:32:58.104Z",
  "modified": "2019-12-31T20:22:28.104Z"
}​
```

## Using Multiple Group Entitlements With Pre-Existing Connectors

For the pre-existing Microsoft Entra ID connectors, perform the following steps to start using Multiple Group Entitlements with your current connector.

1. Use the [createSchema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) API to create new group schema for your connector. Refer to the following respective sections for examples of API body content for adding to existing connector:

   - [servicePlan](<#service-plan>)
   - [Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal>)
2. Update Account Schema with the following steps:

   1. Get account schema using the [getSchema](<https://developer.sailpoint.com/docs/api/get-source-schema-v-1/>) API.
   2. Copy the schema to a file and search for attribute corresponding to the group schema that is added in the previous step.
   3. Add or update the following two properties for the attribute found in the previous step:

      ```text
      "isGroup": true,
      "schema": {"type": "CONNECTOR_SCHEMA","id": "<Schema_ID_From_Step1>","name": "<Name_Of_Schema_Created_In_Step1>"}
      ```
   4. Add the schema modified in the previous step to the payload to update account schema in the connector using the [replaceSchema](<https://developer.sailpoint.com/docs/api/put-source-schema-v-1/>) API.

# Privileged Access and Azure Cloud Governance

## Azure Cloud Object Management

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM. Contact your SailPoint Customer Success Manager to request access and for more information.
>
> To display cloud resource data through SailPoint CIEM, you must also configure the SailPoint CIEM Azure source. Refer to [Connecting Azure and SailPoint CIEM](<https://documentation.sailpoint.com/saas/help/ciem/azure/connect_azure.html>) to learn more.

The Microsoft Entra ID connector provides support for access management of the following Azure Management Objects:

- Management Groups
- Subscriptions
- Resource Groups
- Role Assignment (RBAC role assignments. This is a custom group object)

The newly supported group objects (Azure Management objects) and operations are:

| Operations | Group Objects |
| --- | --- |
| Aggregation | Management Groups, Subscriptions, and Resource Groups |
| Aggregation and Add / Remove Entitlement | Role Assignment (RBAC role assignments. This is a custom group object.) |

The following attributes can be configured in the source XML using the REST APIs in accordance with your requirements:

| Parameter | Description |
| --- | --- |
| managementGroup-api-version | API version to be used for management group API. Type: String<br>Default value: 2020-02-01 |
| subscription-api-version | API version to be used for subscription API. Type: String<br>Default value: 2020-01-01 |
| resourceGroup-api-version | API version to be used for resource group API. Type: String<br>Default value: 2020-06-01 |
| role-assignment-api-version | API version to be used for Role Assignments API. Type: String<br>Default value: 2018-07-01 |
| azure-management-resource-base | Azure management API resource base in case of Entra Gov or another private instance. Type: String<br>Default value: [https://management.azure.com](<https://management.azure.com>) |
| fetch-azure-roleassignment-getobject | Specify if role assignments need to be fetched during Get Account call. Type: boolean<br>Default value: False |

### Prerequisites

- The Microsoft Entra ID connector supports the following grant types for OAuth2 authentication:

  - Client Credentials
  - Auth Code / Refresh Token
  - Certificate Credentials

  Ensure that the appropriate permissions are granted as mentioned in the Administrator Permissions section below.
- Existing clients must be modified for supporting `management.azure.com` as the scope.

### Administrator Permissions

Based on the supported operations (Aggregation and Add/ Remove Entitlements), the following are the required permissions:

| Parameter | Description |
| --- | --- |
| Object Aggregation | Permission: Microsoft.Management/managementGroups/read<br>*Or*<br>Role: Reader<br>Scope: Management Group |
| Role Assignment Aggregation | Permission: Microsoft.Authorization/roleAssignments/read<br>*Or*<br>Role: Reader<br>Scope: Management Group / Subscription |
| Role Definition Aggregation | Permission: Microsoft.Authorization/roleDefinitions/read<br>*Or*<br>Role: Reader<br>Scope: Management Group / Subscription |
| Add Role Assignment | Permission: Microsoft.Authorization/roleAssignments/write<br>*Or*<br>Role: User Access Administrator<br>Scope: Management Group / Subscription |
| Remove Role Assignment | Permission: Microsoft.Authorization/roleAssignments/delete<br>Or<br>Role: User Access Administrator<br>Scope: Management Group / Subscription |

#### API Permissions

| OAuth2.0 Authentication | Type | API | Permission |
| --- | --- | --- | --- |
| Client Credentials | Delegated | Azure Service Management | user\_impersonation |
| Client Credentials | Application | Microsoft Graph | Directory.ReadWriteAll |
| Refresh Token / AuthCode | Delegated | Azure Service Management | user\_impersonation |
| JWT Certificate Credentials | Delegated | Azure Service Management | user\_impersonation |

Refer to the following table to learn more about object management when SailPoint CIEM license is enabled (Cloud Governance) and otherwise (Identity Governance).

<table class="span-table"> <tr> <td>Management Type</td> <td>Object</td> <td>Identity Governance</td> <td>Cloud Governance</td> </tr> <tr> <td>Account Management</td> <td>User</td> <td>Yes</td> <td colspan="1" rowspan="12">Yes</td> </tr> <tr> <td>Account Management</td> <td>B2B Guest User</td> <td>Yes</td> </tr> <tr> <td>Account Management</td> <td>B2C User</td> <td>Yes</td> </tr> <tr> <td>Account Management</td> <td>Federated User (Synchronized with On-Prem AD)</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Groups</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>License Plan (Service Plan)</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Administrator Roles</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Service Principal Names</td> <td>Yes</td> </tr> <tr> <td>Entitlement Management</td> <td>Management Groups</td> <td>No</td> </tr> <tr> <td>Entitlement Management</td> <td>Subscriptions</td> <td>No</td> </tr> <tr> <td>Entitlement Management</td> <td>Resource Groups</td> <td>No</td> </tr> <tr> <td>Entitlement Management</td> <td>Roles Assignment (RBAC)</td> <td>No</td> </tr> </table>

## Azure Government Endpoint Configuration

> [!IMPORTANT]
>
> When SailPoint CIEM is enabled for MS Entra source that uses GCC High, ensure `azure-management-resource-base` attribute is set to `https://management.usgovcloudapi.net` so that entitlement aggregation works correctly.

To meet security and compliance needs of federal agencies, state and local governments, Microsoft provides a separate instance of the Azure service. A few example of such instances are Azure Government, and Azure China. As these instances are separated from general Azure services, endpoint (host address) for such instances might also be different.

With endpoint configuration functionality, the Microsoft Entra connector can be configured to communicate with these instances.

The following attributes must be configured in the source XML using the REST APIs:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

| Parameter | Description |
| --- | --- |
| msGraphResourceBase | Base resource URL to be used for Microsoft Graph API rest calls.<br>The following example points base to default Microsoft Graph resource base:<br>key: `msGraphResourceBase`<br>value: `https://graph.microsoft.us` |
| msGraphTokenBase | Base token URL to be used to get access token for Microsoft Graph API rest calls<br>The following example points base to default Microsoft Graph token base:<br>key: `msGraphTokenBase`<br>value: `https://login.microsoftonline.us` |
| azure-management-resource-base | Base resource URL to be used for Microsoft Graph API rest calls when CIEM is enabled.<br>The following example points base to default Microsoft Graph resource base:<br>key: azure-management-resource-base<br>value: [https://management.azure.com](<https://management.azure.com>) |

> [!NOTE]
>
> The actual values of endpoints can be found in Microsoft documentation for specific instance. For connector operation, the values for the above attributes must be provided.

## Azure Privileged Identity Management (PIM)

The Microsoft Entra ID connector supports Privileged Identity Management (PIM) as a service in Microsoft Entra ID. PIM enables you to manage, control, and monitor access to important resources in your organization.

### Azure PIM for Roles

The Microsoft Entra ID connector supports Privileged Identity Management (PIM) as a service in Microsoft Entra ID. PIM enables you to manage, control, and monitor access to important resources in your organization.

These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources. It reduces the chance of a malicious actor getting access to the resource or an authorized user accidentally impacting a sensitive resource.

#### Supported Features

- Aggregation of PIM Role Assignment objects for Azure and Microsoft Entra ID during entitlement aggregation of type "Groups"
- Aggregation of PIM Role Assignment objects for Azure and Microsoft Entra ID during Account aggregation
- Aggregation of Azure and Microsoft Entra ID PIM roles during Entitlement Aggregation
- Provisioning of eligible role assignment on user for Azure or Microsoft Entra ID PIM role

| Operations | Group Objects |
| --- | --- |
| Entitlement Aggregation of type "Groups" | The following group objects are aggregated as entitlements: Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles. |
| Entitlement Aggregation | Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles (These are custom group objects) |
| Account Aggregation | The following group objects are aggregated as entitlements: Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles. |
| Add or Remove or Delete Entitlement | Azure Eligible Roles, Microsoft Entra ID Eligible Roles , Azure Active Roles, Microsoft Entra ID Active Roles |

#### Required Permissions

Microsoft Entra ID Roles (azureADActiveRoles and azureADEligibleRoles)

To communicate with the PIM Graph API for Microsoft Entra ID roles, you must have at least one of the following permissions:

- `RoleManagement.ReadWrite.Directory`
- `RoleManagement.Read.Directory`

To grant these permissions to the client application, refer to the steps in the [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>) topic.

Azure Resource Roles (azureActiveRoles and azureEligibleRoles

The PIM API for Azure resource roles is developed on top of the Azure Resource Manager framework. You will need to give consent to Azure Resource Management but won’t need any Graph API permission. You must ensure that the user or the service principal communicating with the API has at least the Owner or User Access Administrator role on the resource.

To assign the Owner or User Access Administrator role, complete the following:

1. Login to portal.azure.com and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. On the left-hand side of the screen, select **Access Control (IAM)**.
3. Select **Role Assignments** and then the +Add button to assign the Owner or User Access Administrator role on the resource.

#### PIM Aggregation

For sources with Privileged Identity Management (PIM) enabled, SailPoint recommends using full aggregation without partitioning.

| Aggregation Method | Reason |
| --- | --- |
| Without Partitioning | The connector uses a caching mechanism to fetch all PIM memberships, improving performance. |
| With Partitioning | The connector must make individual API calls for each user to fetch PIM memberships, which can slow down aggregation. |

##### PIM with Single Account Aggregation

If PIM is enabled, use full aggregation only.

Single Account Aggregation is not recommended, as processing the PIM membership cache for one user can be time-consuming and may lead to a timeout, especially with large amounts of PIM data.

### Azure PIM for Groups

The Microsoft Entra ID connector now supports Privileged Identity Management (PIM) for Groups. This includes time-bound eligible and active group memberships managed through Microsoft Entra PIM.

- Aggregation of PIM Group Assignment objects (`azureADEligibleGroup` and `azureADActiveGroup`) for Microsoft Entra ID during entitlement aggregation.
- Aggregation of PIM Group Assignment objects (`azureADEligibleGroups` and `azureADActiveGroups`) for Microsoft Entra ID during Account aggregation.
- Provisioning of Group Assignment on Users for Microsoft Entra ID PIM Group.

#### Prerequisites

- Azure AD Premium P2 license.
- Required to use Privileged Identity Management for Groups.
- Enable Privileged Identity Management

  The Enable Privileged Identity Management checkbox must be selected in the connector's Azure Privileged Identity Management Settings section. For more information, refer to [Manage Azure Privileged Identity Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/feature_management.html#manage-azure-privileged-identity-management>).
- Microsoft Graph API permissions

  The Enterprise Application used for the integration must have the permissions granted (Application type).

##### Microsoft Graph API Permissions

| Permission | Purpose |
| --- | --- |
| PrivilegedEligibilitySchedule.Read.AzureADGroup | Read PIM eligible group schedule instances |
| PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup | Assign/revoke eligible group memberships |
| PrivilegedAssignmentSchedule.Read.AzureADGroup | Read PIM active group schedule instances |
| PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup | Assign/revoke active group memberships |

> [!IMPORTANT]
>
> - Microsoft Graph returns a `Request_UnsupportedQuery error (filter height 4, max 3)` when you combine the PIM groups filter field value with the connector's internal group type filter. The internal filter always takes precedence. The user-defined filter applies independently.
> - The Graph API for eligibility and assignment schedule instances accepts `principalId` as a filter. The system fetches membership per account, not in bulk.

## Azure PIM Configuration

| Attribute | Details |
| --- | --- |
| enablePIM | Select the **Enable Privileged Identity Management** checkbox to define the scope of the Microsoft Entra ID PIM roles (Microsoft Entra ID as well as Azure). |
| eligibleRoleExpiresAfter | Specifies the default duration for which Azure and Microsoft Entra ID eligible roles must be assigned to user. The values must be in the ISO\_8601 duration format.<br>For example, if eligible role needs to be assigned for 180 Days, use \<entry key="eligibleRoleExpiresAfter" value="P180D" /\> |
| activeRoleExpiresAfter | Specifies the default duration for which Azure and Microsoft Entra ID Active roles must be assigned to user. The values must be in the ISO\_8601 format.<br>For example, if eligible role must be assigned for 10 Hours, use \<entry key="activeRoleExpiresAfter" value="PT10H" /\> |

# Account, Group, and Role Management

## Account Management for User, User in Federated Domain, Guest User (B2B), and External Member (B2B)

This section describes the supported features for user, user in federated domain, guest user (B2B), and external member (B2B).

The following table lists various operations supported by connector for different Users:

<table> <thead> <tr> <th>Operations</th> <th>User</th> <th>User in Federated Domain</th> <th>Guest User (B2B)</th> <th>External Member (B2B)</th> </tr> </thead> <tbody> <tr> <td>Aggregation</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Delta Aggregation</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Get Account</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Pass-Through Authentication</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Create</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Update</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Delete</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Enable/Disable Users</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Set Password</td> <td>Yes</td> <td>No</td> <td>No</td> <td>No</td> </tr> <tr> <td>Add/Remove Entitlements<br><ul><li>Add/Remove Shared Mailbox</li><li>Add/Remove individual license plans</li><li>Add/Remove license packs</li><li>Add/Remove Roles</li><li>Add/Remove user's group membership</li><li>Add/Remove ServicePrincipal Names</li><li>Add/Remove Channels</li></ul></td> <td>Yes</td> <td>Yes</td> <td>Yes<br>Note <br><em>Not applicable for Add or Remove Shared Mailbox from users</em></td> <td>Yes<br>Note <br><em>Not applicable to Add/ Remove Shared Mailbox from users</em></td> </tr> <tr> <td>Aggregate Exchange Mailbox Attribute</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Update Exchange Mailbox Attribute</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Aggregate Shared Mailbox as an Entitlement</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Aggregate and Provision Sponsors</td> <td>No</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> </tbody> </table>

## Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Account Management for Local User (B2C)

Azure Active Directory B2C is primarily for businesses and developers that create customer-facing applications. With Azure Active Directory B2C, users can use Microsoft Entra as the full-featured identity system for their application, while letting customers sign in with an identity they already have established (like Facebook or Gmail).

B2C is intended for inviting customers of your mobile and web applications, whether individuals, institutional or organizational customers into your Microsoft Entra.

Supported identities are Consumer users with local application accounts (any email address or user name) or any supported social identity with direct federation. A new/separate Microsoft Entra application must be created to manage B2C tenants.

If Manage B2C Tenant is selected, entitlements are not fetched by default. To fetch entitlements set `fetchB2CMembership` attribute to true as mentioned in the [Additional Configuration Parameters](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>) section.

<table class="span-table"> <tr> <td>Operations</td> <td>Manage B2C Tenant - Local User</td> <td>Manage B2C Tenant - Social User</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="6">Yes</td> <td>Yes</td> </tr> <tr> <td>Create</td> <td>No</td> </tr> <tr> <td>Update</td> <td>Yes</td> </tr> <tr> <td>Delete</td> <td>Yes</td> </tr> <tr> <td>Enable or Disable Users</td> <td>Yes</td> </tr> <tr> <td>Add/Remove Entitlements<br>Add/Remove Roles<br>Add/Remove User's Group Membership<br>Add/Remove ServicePrincipal Names</td> <td>Yes</td> </tr> </table>

> [!NOTE]
>
> Delta Aggregation is not applicable if Manage B2C Tenant is selected on the [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#connection-settings>) page.

## Revoke Session After Disabling User Account

Disabling a user account prevents future authentication attempts, but existing active sessions can remain valid until token expiration. With this feature enabled, the Microsoft Entra ID connector automatically revokes active sign-in sessions during the disable account workflow, cutting off access immediately.

### Supported Operations

- Revoke active user sign-in sessions when their account is disabled.

> [!NOTE]
>
> This feature applies to user accounts only. Service principals do not have sign-in sessions.

### Administrator Permissions

To revoke sign-in sessions, assign the following Microsoft Graph API application permissions to your Entra ID app registration:

| Type | Permission | Purpose |
| --- | --- | --- |
| Application | `User.RevokeSessions.All` | Revoke a user's sign-in sessions |
| Application | `User.ReadWrite.All` | Revoke a user's sign-in sessions |

> [!NOTE]
>
> If your application registration already contains the required permissions to perform the standard account disable operation `(User.ReadWrite.All)`, no additional permissions are required.

### Configuring Account Disable Settings

> [!NOTE]
>
> - For existing sources, this is disabled by default. When required, ensure to select this option.

To configure Account Disable Settings:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/revoke_sessions.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/revoke_sessions.png>)

1. Go to **Feature Management**.
2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled.
3. Select **Save**.

## Last Login for Accounts

The Microsoft Entra ID connector can retrieve the last login date and time for individual users. This information can enable governance workflows to certify access and remove long-standing access if it's no longer needed.

The connector uses the MS Graph API to retrieve the last login account data.

### Prerequisites

You must have an Microsoft Entra P1/P2 license to use this feature.

### Administrator Permissions

To retrieve the last login account data, the MS Graphs API requires you to assign it the `AuditLog.Read.All` API permission.

### Supported Operations

The connector retrieves last login information during the following operations:

- Account aggregation
- Get account

### Required Attributes

This feature requires the following login information:

> [!IMPORTANT]
>
> Important These attributes are not present by default and you must add them explicitly to the account schema, if required. To add these attributes to the account schema, use `signInActivity.<attribute_name>` format. For example, to use `lastSuccessfulSignInDateTime` from the managed system, add `signInActivity.lastSuccessfulSignInDateTime` to the account schema. For more information, refer to [Account Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#default-account-attributes>).

#### Attributes Related to Interactive Authentication Method

> [!NOTE]
>
> If you have an existing connector with attributes in your account schema named `lastSignInDateTime` and `lastNonInteractiveSignInDateTime`, the connector will still aggregate the values assigned to those attributes.

- `signInActivity.lastSignInDateTime`: To retrieve the last time a user logged into the directory with an interactive authentication method.
- `signInActivity.lastSignInRequestId`: To retrieve the request identifier of the last interactive sign-in performed by this user.

#### Attributes Related to Non-Interactive Authentication Method

- `signInActivity.lastNonInteractiveSignInDateTime`: To retrieve the last time a client signed in to the directory on behalf of a user.
- `signInActivity.lastNonInteractiveSignInRequestId`: To retrieve the request identifier of the last non-interactive sign-in performed by this user.

#### Other Supported Attributes

The following attributes are also supported along with the above listed attributes:

- `signInActivity.lastSuccessfulSignInDateTime`:To retrieve the date and time of the user’s most recent successful sign-in activity.
- `signInActivity.lastSuccessfulSignInRequestId`: To retrieve the request ID of the last successful sign-in.

## Azure Mail Contact Management

Mail contacts (also known as organizational contacts) are managed by an organization's administrators. Additionally, mail contacts are either synchronized from on-premises directories or from Exchange Online. With this feature, the connector supports managing Mail Contacts as Accounts.

### Supported Operations

The following operations are supported for Azure Mail Contact:

<table class="span-table"> <tr> <td>Operations</td> <td>Mail Contact</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="8">Yes</td> </tr> <tr> <td>Partitioned Aggregation</td> </tr> <tr> <td>Delta Aggregation</td> </tr> <tr> <td>Get Account</td> </tr> <tr> <td>Create</td> </tr> <tr> <td>Modify</td> </tr> <tr> <td>Delete</td> </tr> <tr> <td>Add/Remove Entitlements<br><ul><li>Add/Remove Mail Contacts from Distribution Groups/Lists</li></ul></td> </tr> </table>

### Administrator Permissions

> [!NOTE]
>
> If the `Directory.Read.All` or `Directory.ReadWrite.All` permission is already assigned to the application then the `OrgContact.Read.All` permission is not required.

| Purpose | Permission |
| --- | --- |
| Aggregate Mail Contacts | `OrgContact.Read.All` |
| Fetch Group Membership | `GroupMember.Read.All` |
| Create, Update, Delete, and Add/Remove Entitlements | The user account communicating via IQService must have the Exchange Administrator Role and the prerequisites mentioned in the [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html#exchange-online-management>) topic. |

### Supported Schema Attributes

To aggregate mail contacts as accounts, ensure that the mail contact attributes are present in the account schema. For more information, refer to [Mail Contacts as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#mail-contacts-as-accounts-attributes>).

### Supported Provisioning Attributes

To provision mail contacts related information, refer to [Create/Modify/Delete Mail Contact Profile Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/provisioning.html#createmodifydelete-mail-contact-profile-attributes>).

### Configure Mail Contacts As Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/mail_contacts_as_accounts_2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/mail_contacts_as_accounts_2.png>)

1. Go to **Feature Management**.
2. If it is not already selected, select **Manage Exchange Online** to view the rest of the fields. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.
3. Select **Mail Contact Governance** to manage mail contacts as accounts. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.
4. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')`

## Custom (extension) Attributes

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the extended attributes that are registered on the client application on Azure. Creation of Local User (B2C) also supports custom attributes.

> [!NOTE]
>
> - Custom user attributes can be added in B2C create account policy by appending suffix "\_C" to the attribute. For example, `OrganizationName_C`
> - To update the custom attribute, the provisioning policy must be updated with the custom attribute name.

To aggregate custom attributes, you must update the schema for account or entitlement with the custom attribute names. The custom attribute name must match the custom attribute name on the managed Microsoft Entra ID system.

Use the following format for single-valued and multivalued string type custom attributes:

`extension_<clientID>_<CustomAttributeName>`

### Managing Complex Extension Attributes

To manage complex extension attributes, as shown below:

```text
"onPremisesExtensionAttributes": {
             "extensionAttribute1": "Value1",
             "extensionAttribute2": "Value2",
            "extensionAttribute3": "Value3",
            "extensionAttribute4": "Value4",
            "extensionAttribute5": "Value5",
            "extensionAttribute6": "Value6",
            "extensionAttribute7": "Value7",
            "extensionAttribute8": "Value8",
            "extensionAttribute9": "Value9",
            "extensionAttribute10": "Value10",
            "extensionAttribute11": "Value11",
            "extensionAttribute12": "Value12",
            "extensionAttribute13": "Value13",
            "extensionAttribute14": "Value14",
            "extensionAttribute15": "Value15"
```

Add these attributes in the **Account Schema** and **Create Account** sections in the SailPoint user interface. To add, use the following format:

> [!NOTE]
>
> Attributes are case sensitive.

`onPremisesExtensionAttributes_extensionAttribute1`

`onPremisesExtensionAttributes_extensionAttribute2`

`onPremisesExtensionAttributes_extensionAttribute3`

`onPremisesExtensionAttributes_extensionAttribute4`

`onPremisesExtensionAttributes_extensionAttribute5`

`onPremisesExtensionAttributes_extensionAttribute6`

`onPremisesExtensionAttributes_extensionAttribute7`

`onPremisesExtensionAttributes_extensionAttribute8`

`onPremisesExtensionAttributes_extensionAttribute9`

`onPremisesExtensionAttributes_extensionAttribute10`

`onPremisesExtensionAttributes_extensionAttribute11`

`onPremisesExtensionAttributes_extensionAttribute12`

`onPremisesExtensionAttributes_extensionAttribute13`

`onPremisesExtensionAttributes_extensionAttribute14`

`onPremisesExtensionAttributes_extensionAttribute15`

## Account - Group Management

The Microsoft Entra ID connector supports managing following group types as an entitlement and as separate group objects. These different types of groups are created for different purpose which are described as follows:

- Microsoft 365 groups (formerly Office 365 groups) are used for collaboration between internal and external users of the company.
- Distribution Lists (Distribution groups) are used for sending notifications to a group of people.
- Security groups are used for granting access to resources such as SharePoint sites.
- Mail-enabled security groups are used for granting access to resources such as SharePoint, and emailing notifications to those users.

The following table describes different conditions or configurations depending on which connector will aggregate different types of groups:

<table class="span-table"> <tr> <td>Group Types</td> <td>Default Aggregation</td> <td>Manage Office 365 checkbox selected in Feature Management</td> <td>Aggregate All Groups checkbox selected in Aggregation Settings</td> </tr> <tr> <td>Security</td> <td>Yes</td> <td>Yes</td> <td colspan="1" rowspan="4">Yes</td> </tr> <tr> <td>Mail-Enabled Security</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Office 365</td> <td>No</td> <td>Yes</td> </tr> <tr> <td>Distribution List</td> <td>No</td> <td>No</td> </tr> </table>

For more information on enabling Aggregate All Groups, refer to [Aggregation Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#aggregation-filter-and-partitioning-settings>).

For more information on enabling provisioning for Distribution Lists and Mail-Enabled Security Groups, refer to [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html#exchange-online-management>).

For more information on enabling Office 365 Groups, refer to [Feature Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/feature_management.html#feature-management>).

## Group Hierarchy Information

This feature shows read-only group hierarchy information. By default, this feature is enabled for new connectors.

> [!NOTE]
>
> The group hierarchy calculation requires additional MS Graph API calls, so you may see an increase in aggregation time depending on the number of groups and the associated number of parent-child relations between them.

For existing connectors, modify the group schema as follows:

1. Use the following SailPoint REST API to add the attribute definition for the hierarchy attribute ( `memberOf`) along with the `hierarchyAttribute` property on the group schema.

   `PATCH https://{orgName}.api.identitynow.com/v3/sources/{source ID}/schemas/{group schema ID}`

   In the body of the PATCH, use the form-data as follows:

   ```text
   [
     {
       "op": "add",
       "path": "/hierarchyAttribute",
       "value": "memberOf"
     },
     {
       "op": "add",
       "path": "/attributes/-",
       "value": {
         "name": "memberOf",
         "type": "STRING",
         "schema": null,
         "description": "Group Membership",
         "isMulti": true,
         "isEntitlement": false,
         "isGroup": false
       }
     }
   ]
   ```

## Microsoft Entra Role Management

Microsoft Entra ID roles allow you to grant granular permissions to your admins, abiding by the principle of least privilege. Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, and applications.

Microsoft Entra supports two types of roles definitions:

- **Built-in roles** - Built-in roles are out of box roles that have a fixed set of permissions. These role definitions cannot be modified.
- **Custom roles** - To round off the edges and meet your sophisticated requirements, Microsoft Entra also supports custom roles.

Microsoft Entra roles object type supports the following operations:

- Aggregation of built-in and custom roles as separate group object
- Aggregation of user membership to roles during account aggregation
- Add / Remove built-in and custom roles to Microsoft Entra users

### Administrator Permissions

<table class="span-table"> <tr> <td>Permission</td> <td>Permission Type</td> <td>Purpose</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td colspan="1" rowspan="4">Application</td> <td>Add/Remove Roles for Accounts</td> </tr> <tr> <td>RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All</td> <td>Aggregate Roles</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Provisioning</td> </tr> <tr> <td>RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All</td> <td>Read Roles entitlement for Accounts</td> </tr> </table>

### Supported Schema Attributes

To manage the Microsoft Entra role objects, ensure that the attributes present in [Roles Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#roles>) are present in the group schema.

## Administrative Units

An administrative unit is a Microsoft Entra resource that serves as a container for other Microsoft Entra resources. It can contain only users, groups, or devices. A user can be a member of multiple administrative units.

### Supported Operations

This feature supports the following operations:

- Manage administrative units as entitlements.
- Create a user with a single or multiple administrative units.
- Add/Remove administrative units from users.
- Delete administrative units from users.

### Administrator Permissions

To fetch administrative units details, the following API permissions must be assigned:

| Type | Permission | Purpose |
| --- | --- | --- |
| Application | AdministrativeUnit.Read.All | Aggregate Administrative Units |
| Application | AdministrativeUnit.ReadWrite.All | Add Users to Administrative Units |
| Application | AdministrativeUnit.ReadWrite.All | Delete Users from Administrative Units |

### Supported Schema Attributes

To manage the administrative units, ensure administrative units attributes are present in the group schema. For more information, refer to [Administrative Units Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#administrative-units-attributes>).

### Configure Administrative Unit

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/admin_units.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/admin_units.png>)

1. Go to **Feature Management**.
2. Select **Manage Administrative Units** to manage administrative units.

## Access Package Management

An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization.

Microsoft Entra ID access package management can help you manage access to Groups &amp; Teams, Applications, and SharePoint Online sites as a bundle.

> [!IMPORTANT]
>
> To use entitlement management and assign users to access packages, you must have one of the following licenses:
>
> - Microsoft Entra ID P2 or Microsoft Entra ID Governance
> - Enterprise Mobility + Security (EMS) E5 license
>
> For more information, refer to [Access Package in Entitlement Management](<https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-reprocess-access-package-assignments>).

The following operations are supported for the Microsoft Entra ID access packages object type:

- Aggregation of custom access package objects (a combination of access package and policy) as a separate group type.
- Aggregation of user membership to access packages during account aggregation.
- Add and Remove access packages entitlements to users.

### Administrator Permissions

| Purpose | Permission Type | Permissions |
| --- | --- | --- |
| Aggregate Access Packages | Application | EntitlementManagement.Read.All |
| Read Access Packages entitlements for Accounts | Application |  |
| Add and Remove Access Packages for Accounts | Application | EntitlementManagement.ReadWrite.All |

For more information on the required permissions, refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>).

### Supported Schema Attributes

To manage the Microsoft Entra ID access package objects, ensure that the attributes in [Access Package Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#access-package-attributes>) are present in the group schema.

To aggregate access packages assigned to the user during account aggregation, ensure the `accessPackages` attribute is present in account schema. This attribute lists the access packages assigned to the user.

> [!NOTE]
>
> The Microsoft Entra ID connector provisions `accessPackage` entitlements only through admin context. Therefore, the approval settings configured in the assignment policy does not get triggered.

### Configure Access Packages in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/access_package_management.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/access_package_management.png>)

1. Go to Feature Management.
2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off.
3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal.
4. Select **Save**.

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

# Supported Features

The Microsoft Entra ID connector supports the following features:

Refer to the following pages for details on each feature:

- [Account, Group, and Role Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/identity_management.html>)
- [Security, Authentication, and Compliance](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/security.html>)
- [Privileged Access and Azure Cloud Governance](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html>)
- [Microsoft 365 and Collaboration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html>)
- [Service Principals and Managed Identities](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/workload_identities.html>)

> [!IMPORTANT]
>
> The Microsoft Azure API dropped support for managing mail-enabled security groups and distribution groups. Distribution List groups and O365 mail-enabled security groups can be added/removed as entitlements during provisioning operations using Exchange Online cmdlets via IQService.

# Microsoft 365 and Collaboration

## Exchange Online Management

Microsoft Entra can be used to manage Exchange online mailboxes, distribution lists, and mail-enabled security groups. The Microsoft Entra ID connector uses Exchange Online PowerShell Module through IQService to support this feature.

Exchange Online Management supports the following operations:

- Aggregation of Exchange Online Mailbox attributes for users
- Aggregation of Shared Mailbox as an entitlement for users
- Aggregation of Exchange Online attributes for groups
- Modification of Exchange Online Mailbox attributes
- Adding and Removing Shared Mailboxes from users
- Adding and Removing Exchange Distribution Lists and Mail-Enabled Security groups from users

> [!NOTE]
>
> Delta Aggregation does not capture changes in Exchange Online Attributes and Shared Mailbox assignments.

<table class="span-table"> <tr> <td>Objects/Attributes</td> <td>Aggregation</td> <td>Modification</td> <td>Add/Remove User</td> </tr> <tr> <td>Exchange Online Mailbox attributes for users</td> <td colspan="1" rowspan="5">Yes</td> <td>Yes</td> <td>N/A</td> </tr> <tr> <td>Shared Mailbox as an entitlement for users</td> <td>N/A</td> <td>Yes</td> </tr> <tr> <td>Exchange Online attributes for groups</td> <td>N/A</td> <td>N/A</td> </tr> <tr> <td>Distribution List</td> <td>N/A</td> <td>Yes</td> </tr> <tr> <td>Mail-Enabled Security Group</td> <td>N/A</td> <td>Yes</td> </tr> </table>

### Prerequisites

The following are required host values by the IQService to interact with the managed service, whitelist/allow the URLs from the IQService machine:

- [https://graph.microsoft.com](<https://graph.microsoft.com>)
- [https://login.microsoftonline.com](<https://login.microsoftonline.com>)

### Basic Authentication

> [!IMPORTANT]
>
> - Basic authentication in Exchange Online is deprecated by Microsoft. For more information, refer to [deprecation of basic authentication in Exchange Online](<https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online>) in Microsoft documentation.
> - It is recommended to utilize [Certificate Based Authentication](<#exchange-online-management>) for Exchange Online management.

1. Configure IQService
2. Install Exchange Online PowerShell Module: EXO V3 (version 3.0.0 or later) on the same IQService machine.
3. Create a user in Microsoft Entra ID with the Exchange Administrator role.
4. Select **Manage Exchange Online** on Application Configuration page.
5. Provide the username and password of the user you created.

> [!NOTE]
>
> The configured IQService user in the source XML must match the logged-on user for that IQService on the Windows server where the IQService is installed. If the IQService user is not configured, use IQServices as the local user context.(Path: Services\> IQService-Instance \>Log On As)

> [!NOTE]
>
> Due to a limitation on PowerShell sessions, SailPoint recommends using separate IQService instances and a separate exchange admin user for different Microsoft Entra ID applications, which are defined to manage exchange online.

> [!NOTE]
>
> The connector uses PowerShell sessions to manage Exchange Online Mailboxes. Due to restrictions on the number of concurrent PowerShell sessions allowed by Microsoft, there may be a delay or occasional failures when the connector processes Exchange Online requests.

### Certificate Based Authentication

- The following additional API permission needs to be added to the already registered Microsoft Entra ID Enterprise Application. Refer to the [Prerequisites](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#prerequisites>) section regarding application registration and [API permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>), if necessary.

  - Permission `Exchange.ManageAsApp`, for Office 365 Exchange Online
  - The steps to assign API permissions to an application are listed here: [Assign API permissions to the application.](<https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-2-assign-api-permissions-to-the-application>)
- Assign the following roles to the application:

  - Exchange Administrator
  - The steps to assign roles to an application are listed here: [Assign Microsoft Entra roles to the application.](<https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-5-assign-azure-ad-roles-to-the-application>)
- To ensure modern authentication:

  - A certificate key-pair needs to be generated for the IQService machine. This will be used by the Exchange PowerShell module to connect to the Exchange Online.
  - The certificate must be uploaded to the registered Microsoft Entra ID Enterprise Application under Certificates and Secrets.
- The steps to generate a self-signed certificate and attach it to the Microsoft Entra ID application are listed here:

  - [Generate a self-signed certificate](<https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-3-generate-a-self-signed-certificate>)
  - [Attach the certificate to the Microsoft Entra ID application](<https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-4-attach-the-certificate-to-the-azure-ad-application>)
- Use Exchange Online PowerShell Module: EXO V3 (version 3.0.0 or later).

### Schema Configurations

You must add Exchange attributes that you want to aggregate to the account or group scheme with the prefix **EXO\_**.

For example, to aggregate `EmailAddresses` attribute, add it to the schema as follows:

- Name: EXO\_EmailAddresses
- Type: String
- Property: Multivalued
- To aggregate shared mailbox attributes as an Entitlement, add `sharedMailbox` as an account attribute.
- Example Name: `sharedMailbox`
- Type: String
- Property: Multivalued, Entitlement, Managed

### Aggregate Exchange Online Groups

By default, the Microsoft Entra ID connector aggregates Mail-Enabled Security groups. To aggregate Distribution List groups, on the **Aggregation Settings** page, enable the `Aggregate All Groups` configuration parameter.

> [!NOTE]
>
> Aggregation of Distribution List group with basic group details does not need Exchange Online IQService configuration.

### Add/Remove Exchange Distribution Groups from Users

When adding a user to, or removing a user from, a Mail-Enabled Security group, the user configured in the Manage Exchange Online configuration must be the owner of the group. The Distribution does not have the same restriction, but SailPoint recommends that the user in the Manage Exchange Online configuration is the owner of the group.

> [!NOTE]
>
> When the Exchange Online Authentication Type is set to certificate-based authentication, `BypassSecurityGroupManagerCheck` entry gets added by default. If you don't want to use `BypassSecurityGroupManagerCheck`, add `enableByPassSecurityManagerCheck` entry to the source XML with its value set to false.

### Provisioning Policy Changes

To update the Exchange Mailbox attribute value, the attribute must be added to provisioning policy with the prefix **EXO\_**.

For example, to update the `Alias` attribute, it must be added in provisioning policy as follows:

- Name: EXO\_EmailAddresses
- Type: String
- Type Setting: Multivalued: true, Review Required: true

> [!NOTE]
>
> - It is important to add with proper attribute type and property, which meets exchange attribute definition for successful update operation.
> - Attributes to be added in provisioning policy must be present in account schema.

### Shared Mailbox As Entitlement

> [!NOTE]
>
> `sharedMailbox` is fetched only during account aggregation when the promote managed attribute is true by default in SailPoint. All `sharedMailbox` that are assigned to users are aggregated during account aggregation as entitlements. Unassigned `sharedMailbox` on the Microsoft side are not aggregated. There is no support of entitlement aggregation for sharedMailbox.

An Exchange user can be a member of a Shared Mailbox. Along with membership, the user obtains permission on the mailbox. This permission has to be selected while adding the user to the shared mailbox. The following permissions are categorized as Recipient and Mailbox:

- Recipient: SendAs
- Mailbox: ChangeOwner, ChangePermission, DeleteItem, ExternalAccount, FullAccess, ReadPermission

In order to provide flexibility to select the permission to be assigned, mailbox entitlements are created one per permission per mailbox as shown in the following example:

`User Mark Taylor has SendAs, FullAccess and ReadPermission permissions on shared mailbox called O365Support. After account aggregation following entitlements would be created:`

`O365Support: SendAs`

`O365Support: FullAccess`

`O365Support: ReadPermission`

## Microsoft Teams

Microsoft Teams, also referred to simply as Teams, is a unified communication and collaboration platform that combines persistent workplace chat, video meetings, file storage (including collaboration on files), and application integration.

Teams are built on the top Microsoft 365 groups. The Microsoft 365 group forms the directory object representing Teams. All identity and access controls for Teams are performed on the Microsoft 365 group. Because the Microsoft Entra ID connector deals with directory objects, Microsoft Teams are represented as part of Microsoft 365 Groups.

As Microsoft Entra ID connector deals with directory objects, Microsoft Teams are represented as Microsoft 365 Groups.

The Manage Office 365 Groups checkbox must be selected as it is aggregated as Microsoft 365 Group.

The following operations are supported:

- Add or Remove Owners and Members

| Attribute Name | Action | Group Schema | Create Group Policy |
| --- | --- | --- | --- |
| teamsEnabled | Distinguish Teams group | Type: Boolean | NA |
| teamsEnabled | Enabling Teams creation | NA | Type: Boolean<br>Review Required: True |
| teamsEnabled | Enabling Teams creation for existing Microsoft Office 365 Groups | NA | Type: Boolean<br>Review Required: True |
| Owners | NA | Property: Multi-Valued<br>Data Type: string<br>Description: Owners of the group | Read-Only: False |

## Channel Management

Microsoft Teams, also referred to as Teams, is a unified communication and collaboration platform that combines persistent workplace chat, video meetings, file storage (including collaboration on files), and application integration.

Channels are dedicated sections within a team to keep conversations organized as per organization requirements.

Basic criteria for any user to be able to be part of the channel is to be part of the team. If the user is not part of the team, then they cannot be added to the channel. Access to the channel varies based on the type of channel:

- **Standard Channel**: By default, any user who is member of the Team gets membership to the standard channel.
- **Private Channel**: Owner/ Admin of the channel needs to add the team member to the channel. By default, the channel is not accessible to anyone other than the owner/ admin.

Addition of a user to the team gives access to the standard channel, and removal of a user from the team leads to automatic removal from all channels including private channels to which user has access to.

This feature provides support for the following operations:

- Aggregation of channels as separate group object.
- Aggregation of user membership to channels.
- Add or remove users from private channels.

> [!NOTE]
>
> - Before enabling Teams Governance, ensure that Manage Microsoft 365 Groups is enabled.
> - Enabling the Teams Governance feature can have impact on aggregation performance due to API limitations to fetch channel memberships.

### Administrator Permissions

| Permission | Permission Type | Purpose |
| --- | --- | --- |
| Channel.Create | Application | Create Channel |
| Channel.Delete.All | Application | Delete Channel |
| Channel.ReadBasic.All | Application | Aggregate Channels |
| ChannelMember.ReadWrite.All | Application | Add or Remove Channel Members |
| ChannelMember.ReadWrite.All | Delegated | Add or Remove Channel Members |

### Supported Schema Attributes

To manage the channel management objects, ensure that the attributes present in [Channel Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#channel-attributes>) are present in the group schema.

# Security, Authentication, and Compliance

## Multi-Factor Authentication (MFA) Management

Microsoft Entra Multi-Factor Authentication (MFA) adds additional security over only using a password when a user signs in. The user can be prompted for additional forms of authentication, such as to respond to a push notification, enter a code from a software or hardware token, or respond to an SMS or phone call.

The Microsoft Entra ID connector supports the MFA Attribute Management, which can help you manage MFA related information required for authentication, such as mobile numbers, alternate mobile numbers, office phone numbers, email addresses, and the Microsoft authenticator app.

The following operations are supported for Multi-Factor Authentication Management:

- Aggregate MFA related information for the user (applicable for all authentication methods).
- For the Phone and Email authentication methods you can add, update, and remove MFA related information.
- For other authentication methods (for example, Microsoft Authenticator or Fido2) you can remove MFA related information.

### Administrator Permissions

| Purpose | Permission Type | Permissions |
| --- | --- | --- |
| Aggregate MFA Related Information for the User | Application | UserAuthenticationMethod.Read.All |
| Add, Update, and Remove MFA Related Information for the User | Application | UserAuthenticationMethod.ReadWrite.All |

### Supported Schema Attributes

To aggregate MFA related information for the user during account aggregation, ensure that the MFA attributes are present in the account schema. For more information, refer to [Multi-Factor Authentication (MFA) Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#multi-factor-authentication-mfa-attributes>).

> [!NOTE]
>
> When retrieving MFA information, the API is called concurrently per user, which may trigger "429 Too Many Requests" errors. To prevent this, add the following entry to your source XML to restrict multi-threading:
>
> `<entry key="max-thread-mfa-attributes" value="1"/>`

## OAuth 2.0 Authentication

The Microsoft Entra ID connector supports OAuth2.0 authentication with the following grant types:

- Client Credentials
- SAML Bearer Assertion
- Refresh Token/Auth Code
- JWT Certificate Credentials

### Client Credentials

The default grant type is client credentials-based authentication. This grant type requires the following:

- Obtain your Client ID and Client Secret from Microsoft Entra ID by registering the application.
- Assign the required Microsoft Graph API permission to the application. For more information, refer to [Microsoft Graph API](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/configuring_for_integration.html#microsoft-graph-api>).
- The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.
- Assign the required permissions to the application:

  | Permission | Type | Purpose |
  | --- | --- | --- |
  | Directory.ReadWrite.All | Application | Read, Update, Delete Group, and Add Membership<br>Read, Update, Change Password, and Delete User |
  | User.Invite.All | Application | Invite B2B Users |

### SAML Bearer Assertion

The SAML Bearer Assertion grant type authentication involves password-based user authentication with ADFS environment. SAML assertion issued by ADFS after authentication is used to obtain the access token from Microsoft Entra ID.

The SAML Bearer Assertion authentication requires the following additional configurations to be performed:

- Microsoft Entra Connect configured with Microsoft Entra ID along with ADFS.
- Obtain your Client ID and Client Secret from Microsoft Entra ID by registering the application.
- Assign required permissions to the application: PermissionTypePurposeDirectory.ReadWrite.AllDelegatedRead, Update, Delete Group, and Add MembershipRead User and Update UserUser.Invite.AllDelegatedInvite B2B UsersDirectory.AccessAsUser.AllDelegatedChange Password and Delete User

  > **Note**
  >
  > Assign granular level application permission for each operation if you do not want to assign full directory level permission. For more information, refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>).
- The authentication user must be synchronized in Microsoft Entra ID.
- To manage users with administrative roles, an application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.

  > **Note**
  >
  > To manage users with administrative roles, assign user with Global Administrator role.
- The ADFS endpoint required to authenticate user must be enabled.
- The ADFS service communication certificate must be installed on the SailPoint machine.
- The ADFS machine time zone must be in sync with Azure time zone, that is, UTC.

### Refresh Token/Auth Code or JWT Certificate Credentials

- **Refresh Token/Auth Code**: Refresh Token/Auth Code grant type is a client credentials-based authentication protocol. In addition to client credentials, it uses a Refresh Token to perform authentication.
- **JWT Certificate Credentials**: JWT Certificate Credentials supports Authentication based on JWT assertion prepared from Certificate and private key.

For the Refresh Token/Auth Code or JWT Certificate Credentials grant type client credentials-based authentication, the following are the required configurations:

- Obtain your Client ID and Client Secret from Microsoft Entra by registering the application.
- Assign the required Microsoft Graph API permission to application. For more information, refer to Microsoft Graph API.
- The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.

  | Permission | Type | Purpose |
  | --- | --- | --- |
  | Directory.ReadWrite.All | Delegated | Read, Update, Delete Group, and Add Membership<br>Read User and Update User |
  | User.Invite.All | Delegated | Invite B2B Users |
  | Directory.AccessAsUser.All | Delegated | Change Password, and Delete User |

  > **Note**
  >
  > Assign granular level application permission for each operation if you do not want to assign full directory level permission.
- (*For Refresh Token/Auth Code only*) Generate a Refresh Token. For more information, refer to Generating Refresh Token.
- (*For JWT Certificate Credentials only*) The Certificate (self-signed or CA signed) must be uploaded. It must be of type X.509 Certificate and the Private Key must be encrypted with RSA and registered at the Microsoft Entra portal. Perform the following steps to register the certificate with the Microsoft identity platform:

  For the full procedure, including the OpenSSL commands, refer to [Creating OAuth 2.0 JWT Certificate Credentials](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#creating-oauth-20-jwt-certificate-credentials>).

  1. Log in to Microsoft Entra Portal.
  2. In the Entra app registrations for client application, select the client application.
  3. Select **Certificates &amp; secrets**.
  4. Select the **Upload certificate** and select the certificate file that is to be uploaded.
  5. Select **Add**.
  6. Obtain values for the following configurations:

     - **Private Key**: Obtain the private key text file.
     - **Private Key Password**
     - **Certificate**: Obtain the text file of the same certificate which was uploaded on the Microsoft Entra portal.

## Continuous Access Evaluation

Continuous access evaluation enables the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

When this feature is enabled on this connector, any long running operations, such as account aggregation, fail if a Continuous Access Evaluation (CAE) event (for example, a service principal disable or delete event) is triggered for the configured service principal during that operation.

To configure this feature:

1. Go to **Connection Settings**.
2. Select the **Use Continuous Access Evaluation** checkbox.
3. Select **Save**.

## Risky User Alert Feature

With the security reports in Microsoft Entra, you can gauge the probability of compromised user accounts in your environment. A user flagged for risk is an indicator for a user account that might have been compromised. The risky user represents the probability that a given identity or account is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources.

This feature supports the following operations:

- Account Aggregation
- Get Object

> [!NOTE]
>
> By default, this feature is enabled for new connectors. If your Microsoft Entra ID instance doesn't require or support the Risky User Alert feature, you must disable the feature by removing attributes from the schema.

### Prerequisite

The tenant must have a Microsoft Entra P2 license.

### Administrator Permissions

To fetch risky user details using MS Graph APIs, the following API permissions must be assigned:

| OAuth2.0 Authentication | Type | Permission | Purpose |
| --- | --- | --- | --- |
| Client Credentials | Application | IdentityRiskEvent.Read.All<br>IdentityRiskyUser.Read.All | Aggregate or Get Risky user related information |
| SAML Bearer Assertion<br>Refresh Token / AuthCode<br>JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All<br>IdentityRiskyUser.Read.All | Aggregate or Get Risky user related information |

> [!NOTE]
>
> For SAML Bearer Assertion the authenticated user must have the Security Operator role.

### Supported Schema Attributes

To manage the risky user alert feature, ensure that the [Risky User Alert Supported Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#default-account-attributes>) are present in the account schema.

> [!NOTE]
>
> Only the default schema attributes are supported. The Account schema cannot be extended for other risk related attributes.

## Custom Security Attributes

Custom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources.

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the custom security attributes that are defined in Azure. Creation of local user (B2C) also supports custom attributes.

### Supported Operations

- Aggregation of assigned custom security attributes for MS Entra ID users.
- Assign, update, delete, and remove custom security attributes for MS Entra ID users.

### Required Permissions

Assign below permissions to the Microsoft Entra ID source to manage custom security attributes:

| Purpose | Permissions |
| --- | --- |
| To aggregate assigned custom security attributes | Attribute Assignment Reader |
| To assign, update, delete, and remove custom security attributes | Attribute Assignment Administrator |

> [!NOTE]
>
> - To aggregate custom security attributes, you must update the Account Schema with the custom attribute names.
> - The custom security attribute name must match the Attribute set and Attribute name defined on the Microsoft Entra ID system.

Use the following format for single-valued and multivalued type string custom attributes:

`customSecurityAttributes_<Attribute set name>_<Attribute name>`

For instance, if you have multiple attribute sets with attributes defined as follows:

**Attribute 1:**

Attribute set = Engineering

Attribute = Project

Attribute data type = Collection of Strings

Attribute value = \["Baker","Cascade"\]

**Attribute 2:**

Attribute set = Engineering

Attribute = ProjectDate

Attribute data type = String

Attribute value = "2022-10-01"

**Attribute 3:**

Attribute set = Marketing

Attribute = EmployeeId

Attribute data type = String

Attribute value = "QN26904"

Then, the Account Schema for the above attributes should define them in the following way:

**For Attribute 1**:

`customSecurityAttributes_Engineering_Project (DataType – String, isMulti - True)`

**For Attribute 2**:

`customSecurityAttributes_Engineering_ProjectDate (Data Type – String)`

**For Attribute 3**:

`customSecurityAttributes_Marketing_EmployeeId (Data Type – String)`

To manage the assignments (such as assigning, updating, and removing custom security attributes for MS Entra ID Users) in addition to adding attributes in Account Schema, you need to also add the attributes in a similar format to Create Account within the SailPoint user interface.

# Service Principals and Managed Identities

## Service Principal Management As an Entitlement

Entra Service Principals are a security identity used by user-created applications, services, and automation tools to access specific Entra resources. A Service Principal is a user identity (login and password or certificate) with a specific role, and controlled permissions to access your resources.

To improve security, only grant the minimum permission level to perform management tasks.

> [!NOTE]
>
> The Microsoft Entra ID connector has the capability to manage Service Principals as Account, which is the recommended approach. For more information, refer to [Service Principal Account Management](<#service-principal-account-management>). When creating new instances of the Microsoft Entra ID connector, the configuration will not have the group schema for the Service Principal object (i.e., the `servicePrincipal` object type schema). The associated entitlement attribute entry from the account schema has also been removed (i.e., the `servicePrincipals` account schema attribute). Backward compatibility is maintained with this feature. If you want to utilize the feature with new connectors, make the schema changes in accordance with the information in the [Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal>) topic.

The following operations are supported for the ServicePrincipal object type:

- Aggregation
- View details of ServicePrincipal (like object properties, members and so on)
- Provision and Revoke access request for ServicePrincipal

> [!NOTE]
>
> Aggregating Service Principal entitlements negatively impacts account aggregation performance.

### Enabling Feature on Existing Connectors

1. Modify the existing account schema and add the Service Principal related attributes as mention in the [Service Principal Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>) topic.
2. Remove the existing group schema for the "Service Principal" object.
3. Add a new group schema "Application Role" object as mentioned in the [Application Role Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#application-role-attributes>) topic.
4. After making the schema changes, perform account and group aggregation.
5. Modify the existing Create Account Policy to include the Service Principal attributes as mentioned in the [Account ProfileCreate Policy for Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/azure_policies.html#account-profile-for-service-principal>) topic.

## Service Principal Account Management

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.

To access resources that are secured by an Microsoft Entra ID tenant, the entity that requires access must be represented by a security principal. This requirement is true for both users (user principal) and applications (service principal). The security principal defines the access policy and permissions for the user/application in the Microsoft Entra ID tenant.

With this feature, the connector supports managing such Service Principals for enterprise applications as Accounts.

> [!NOTE]
>
> To gauge the probability of compromised service principals (workload identities) accounts in your environment, refer to [Risky Service Principal Alert Feature](<#risky-service-principal-alert-feature>) for more information.

> [!CAUTION]
>
> Switching from Service Principal Group Management to Service Principal Account Management may invalidate previously created Service Principal Managed Attribute objects. Ensure a thorough review of configurations before making this change to avoid potential data issues in your environment.

### Supported Operations

The following operations are supported for the azure service principal:

<table class="span-table"> <tr> <td>Operations</td> <td>Service Principal</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="6">Yes</td> </tr> <tr> <td>Get Account</td> </tr> <tr> <td>Create</td> </tr> <tr> <td>Update</td> </tr> <tr> <td>Enable and Disable Users</td> </tr> <tr> <td>Add and Remove Entitlements<br><ul><li>Add and Remove Roles</li><li>Add and Remove User's Group Membership</li><li>Add and Remove Application Role Memberships (<code>appRoleAssignments</code>)</li><li>Add and Remove PIM Role Memberships (<code>azureActiveRoles</code> and <code>AzureADActiveRoles</code>)</li><li>Add and Remove RBAC Role Memberships (<code>azureRoleAssignments</code>)<br>Note <br>For more details and the required prerequisites, refer to <a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management">Group Management for Azure Cloud Objects</a>.</li><li>Add and Remove Admin Consented Delegated Permissions (<code>spn_adminConsentedPermissions</code>)</li><li>Remove User Consented Delegated Permissions (<code>spn_userConsentedPermissions</code>)</li></ul></td> </tr> </table>

### Administrator Permissions

| Purpose | Type | Permissions |
| --- | --- | --- |
| Aggregation of Service Principals | Application | Application.Read.All |
| Create and Update Service Principals | Application | Application.ReadWrite.All |
| Add and Remove Owners | Application | Application.ReadWrite.OwnedBy |
| Add and Remove Application Roles for Service Principals | Application | AppRoleAssignment.ReadWrite.All |
| Aggregation of Application Roles | Application | Application.Read.All |
| Aggregation and Add/Remove Microsoft Entra ID Group and Roles for Service Principals |  | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Service Principals |  | Refer to [Group Attributes for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/pim_cloud_objects.html#group-attributes-for-azure-cloud-objects>). |
| Aggregation and Add/Remove PIM Azure Active and Microsoft Entra ID Roles for Service Principals |  | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-pim-for-roles>). |
| Aggregation of Admin/User Consented Permissions for Service Principals | Application | DelegatedPermissionGrant.Read.All |
| Add/Remove Admin Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All |
| Remove User Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All |

### Supported Schema Attributes

To aggregate service principal related information for the user during account aggregation, ensure that the service principal attributes are present in the account schema. For more information, refer to [Service Principal as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>).

### Supported Provisioning Attributes

To provision service principal related information, ensure that the attributes in [Service Principal Profile Provisioning Policy Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/azure_policies.html#account-profile-for-service-principal>) are present in your provisioning policy.

### Configuring Microsoft Entra Service Principals As Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/manage_service_principals1.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/manage_service_principals1.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.

   > **Note**
   >
   > To automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing azure Service Principal as account . For more information, refer to [Service Principal as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>).
3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'`

   > **Note**
   >
   > Advanced queries are not supported.

   Example filters:

   - For a filter to match the Enterprise Application default view on the Azure portal use the following:

     `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')`
4. Select the **Manage Azure PIM Role Memberships** checkbox to manage Azure PIM Active Role memberships for Service Principal.
5. Select the **Manage Microsoft Entra PIM Role Memberships** checkbox to manage Microsoft Entra ID PIM Active Role memberships for Service Principal.
6. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal.
7. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal.
8. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra ID Group memberships for Service Principal.
9. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals.
10. Select **the Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals.

    > **Note**
    >
    > This is for delegated permissions.
11. Select **Save**.

### Risky Service Principal Alert Feature

With the security reports in Microsoft Entra, you can gauge the probability of compromised service principals (workload identities) accounts in your environment. A service principal flagged for risk is an indicator of a service principal account that might have been compromised. The risky service principal represents the probability that a given service principal (workload identity) is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources.

> [!NOTE]
>
> - Before utilizing Risky Service Principal Alert feature, ensure that Service Principals are configured as accounts in the source. For more information, refer to [Service Principal Account Management](<#service-principal-account-management>).
> - By default, this feature is not enabled for new connectors. If your Microsoft Entra instance requires support of the Risky Service Principal Alert feature, you must enable the feature by adding attributes to the Account Schema in the SailPoint user interface.

#### Supported Operations

This feature supports the following operations:

- Account Aggregation (Service Principal Aggregation)
- Get Object (Get Service Principal)

#### Prerequisites

The tenant must have a Microsoft Entra P2 license.

#### Administrator Permissions

To fetch risky service principal details using MS Graph APIs, the following API permissions must be assigned:

| OAuth2.0 Authentication | Type | Permission | Purpose |
| --- | --- | --- | --- |
| Client Credentials | Application | IdentityRiskEvent.Read.All<br>IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information |
| Refresh Token / AuthCode<br>JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All<br>IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information |

#### Supported Schema Attributes

To manage the risky service principal alert feature, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The account schema cannot be extended for other risk related attributes.

| Attribute Name | Description |
| --- | --- |
| spn\_riskLevel | Level of the detected risky service principal. |
| spn\_riskState | State of the service principal's risk. |
| spn\_riskDetail | Details of the detected risk. |
| spn\_riskLastUpdatedDateTime | The date and time when the risky service principal was last updated. |

## Managed Identities

Managed identities for Azure resources offer a secure and convenient way for Azure services to authenticate to other Azure services that support Microsoft Entra ID authentication, without the need to manage or store credentials in the code.

### User-Assigned Managed Identities

SailPoint supports managing user-assigned managed identities as they have an independent lifecycle.

The following operations are supported for user-assigned managed identity objects:

- Aggregation of user-assigned managed identities in account aggregation.
- Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities.
- Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities.
- Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license).

#### Prerequisites

If you want to configure your source to aggregate managed identities, you need to modify the account schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as `Account Name`.

#### Correlation for Managed Identities

The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](<https://community.sailpoint.com/knowledge/Service-Accounts-Best-Practices>).

#### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator<br>OR<br>Role: Reader<br>Scope: Tenant Root Group (to fetch from all subscriptions) |
| Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>). |
| Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-pim-for-roles>). |

**To assign the Reader role at Tenant Root Group:**

1. Sign in to [https://portal.azure.com](<https://portal.azure.com>) and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. Select the **Tenant Root Group**.
3. On the left-hand side of the screen, select **Access Control (IAM)**.
4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource.

#### Supported Schema Attributes

To aggregate user-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [User-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#user-assigned-managed-identity-attributes>).

#### Configure User-Assigned Managed Identities in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat2_2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/az_ad_feat2_2.png>)

1. Go to **Feature Management**.
2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for user-assigned managed identities.
3. Select the **Include User-Assigned Managed Identities** checkbox to manage user-assigned identities.
4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for user-assigned managed identities.
5. Select **Save**.

### System-Assigned Managed Identities

SailPoint supports managing system-assigned managed identities, but with limited capabilities due to the tight coupling between the identity and the Azure resource lifecycle.

The following operations are supported for system-assigned managed identity objects:

- Aggregation of system-assigned managed identities in account aggregation.
- Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities.
- Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities.
- Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities. (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license).

#### Prerequisites

If you want to configure your source to aggregate managed identities, ensure to modify the Account Schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as Account Name.

#### Correlation for Managed Identities

The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](<https://community.sailpoint.com/knowledge/Service-Accounts-Best-Practices>).

#### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator<br>OR<br>Role: Reader<br>Scope: Tenant Root Group (to fetch from all subscriptions) |
| Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>). |
| Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-pim-for-roles>). |

**To assign the Reader role at Tenant Root Group:**

1. Sign in to [https://portal.azure.com](<https://portal.azure.com>) and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. Select the **Tenant Root Group**.
3. On the left-hand side of the screen, select **Access Control (IAM)**.
4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource.

#### Supported Schema Attributes

To aggregate system-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [System-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/azure/workload_identity_attributes.html#system-assigned-managed-identity-attributes>).

#### Configure System-Assigned Managed Identities in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/system_assigned_identities_2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/system_assigned_identities_2.png>)

1. Go to **Feature Management**.
2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for system-assigned managed identities.
3. Select the **Include System-Assigned Managed Identities** checkbox to manage system-assigned identities.
4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for system-assigned managed identities.
5. Select **Save**.

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Group Fetch Requests Fail Immediately After Creation

Group fetch requests may fail immediately after creation because cloud synchronization delays prevent the newly created group from being reflected.

**Resolution**: Add the `createGroupTimelag` attribute via the SailPoint REST API to specify a delay (in seconds) between creating and fetching the group. The default delay is 5 seconds and can be modified as needed. For more information, refer to [createAccountTimelag](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>).

## Exception Occurred in Iterate Objects - populateRiskyUsersDetails

This error occurs when the Risky User feature is disabled in Microsoft Entra ID.

**Resolution**: Choose one of the following solutions to complete account aggregation:

Option 1: Delete these four attributes from the connector's Account Schema:

- riskLevel
- riskState
- riskDetail
- riskLastUpdatedDateTime

Option 2: Grant the necessary permission to read Risky User Alerts in Entra ID.

## Account Creation Is Slow During Single Account Aggregation

This performance issue occurs because the connector makes numerous API calls to the Microsoft Graph API to retrieve Privileged Identity Management (PIM) membership data associated with the account.

**Resolution**: To improve performance, you can configure the connector to skip the retrieval of PIM membership data during the initial account creation. Set `skipPIMMembershipOnCreateAccount` parameter value to `true`. For more information, refer to [skipPIMMembershipOnCreateAccount](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>).

## Provisioning Fails With a 409 Conflict Error for License Assignment Requests

When a provisioning plan includes requests to add multiple assignedLicence values for a single user, the operation fails returning an API error code of 409. This occurs because the Microsoft cannot process simultaneous license assignment requests for the same user, treating it as a concurrency conflict.

**Resolution:** To resolve this issue, you can configure the connector to automatically retry the failed license assignment request. This allows a brief delay for the Microsoft tenant to process the initial request before the connector attempts the operation again. For more information, refer to [Configuring Errors and Retries](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html?h=retry+error#errors-and-retries>).

## Authentication Fails With "AADSTS70011 Invalid Scope" During Provisioning

When attempting to provision Exchange Online, the operation fails with an error message:

```text
AADSTS70011 Invalid scope. The scope has to be of the form "[https://resourceUrl/.default]""Mitigation: change the scope to be as expectedA configuration issue is preventing authentication - check the error message from the server for details.
```

**Resolution**: To resolve this authentication failure, you must verify that the application registration and permissions are correctly configured in both the source and Azure AD.

Follow these steps:

1. Verify App ID and Certificate Alignment

   - Confirm that the certificate used for authentication is uploaded to the correct Azure AD Application Registration Portal.
   - Ensure the Client ID configured in the source matches the Application (client) ID of the Azure AD application where the certificate is uploaded. A mismatch is a common cause of this failure.
2. Confirm Permissions

   1. In Azure AD, go to the App Registration Portal used for Exchange Online.
   2. Verify that the application has been granted the Exchange Administrator role and `Exchange.ManageAsApp` permission.

## Entitlement Aggregation Fails With a sailpoint.object.ManagedAttribute Insert Error

Entitlements having emojis in its name cause the issue during its insertion/processing in the database.

**Resolution**: Remove the emojis in the entitlements name on the managed system.

## Unable to Aggregate Azure PIM Role Membership

**Resolution**: To successfully aggregate Azure PIM role memberships, ensure that the Owner or User Access Administrator role is assigned to the Tenant Root Group/Subscription level within the Azure AD portal.

## Exchange Online Provisioning Fails With "Invalid Provider Type Specified"

When the Manage Exchange Online checkbox is selected, provisioning fails with the following error:

`Exception during Connect-ExchangeOnline: System.Management.Automation.RemoteException: Invalid provider type specified.`

This error indicates that the IQService, operating under a specific service account, lacks the necessary permissions to access the private key of the certificate used for connecting to Exchange Online.

**Resolution**:

To resolve this, grant the IQService's service account full control over the certificate's private key.

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/invalid_provider.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/invalid_provider.png>)

1. Open the Certificate Manager:

   - Press Win + R to open the Run dialog.
   - Type`certmgr.msc` and press **Enter**.
2. Go to **Personal \> Certificates**.
3. Select and right-click the certificate.
4. Go to **All Tasks**, and then select **Manage Private Keys**.
5. In the Permissions dialog box, click **Add**.
6. Enter the name of the service account under which IQService is running.
7. For the added service account, ensure Full control and Read permissions are granted.
8. Click **Apply**, then **OK** to save the changes.
9. Restart IQService for the new permissions to take effect.

## Test Connection Fails When the Manage Exchange Online Checkbox Is Selected

The test connection fails and displays the following error:

`Error returned from IQService. One or more errors occurred`

**Resolution**: Complete the following: Verify that all of the prerequisites for the Microsoft Exchange Online Mailbox attributes are in place. For more information, refer to [Prerequisites](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#prerequisites>). Once you have verified the prerequisites have been met, run the following PowerShell command on the IQService machine to verify connectivity:

```powershell
Connect-ExchangeOnline -UserPrincipalName <userPrincipalName>
```

## Test Connection Fails

Test Connection fails with the following error message when Microsoft Entra ID application is checked for **SAML Bearer Assertion** Grant Type:

```text
OAuth2Exception [toString()=connector.common.oauth2.OAuth2Exception: Unable to generate access token. Response returned:
{"error":"invalid_grant","error_description":"AADSTS50008: The SAML token is invalid.\r\nTrace ID: a74df376-3ede-4c17-ba34-b352079e3300\r\nCorrelation ID: f8c370ec-4ef6-48a4-a393-0297a5ce3b20\r\nTimestamp: 2020-05-04 05:58:16Z","error_codes":[50008],"timestamp":"2020-05-04 05:58:16Z","trace_id":"a74df376-3ede-4c17-ba34-b352079e3300","correlation_id":"f8c370ec-4ef6-48a4-a393-0297a5ce3b20","error_uri":"https://login.microsoftonline.com/error?code=50008"}
]
```

**Resolution**: Verify if the time zone of ADFS machine is in synchronize with Azure time zone, that is, UTC. If not, change the ADFS machine time and re-start the ADFS services.

## Test Connection / Account Aggregation Fails

Test Connection/ Account Aggregation fails with the following error message when Microsoft Entra ID application is checked for **SAML Bearer Assertion** Grant Type:

`Error - invalid_grant: AADSTS5000811: Unable to verify token signature. The signing key identifier does not match any valid registered keys.`

**Resolution**: Microsoft recommends to execute the following command from PowerShell running on ADFS server to manually renew token signing certificates:

```powershell
Update-MSOLFederatedDomain -DomainName <domain>
```

## Provisioning of Exchange Attribute Fails

Provisioning of Exchange attribute fails if account aggregation is in progress. Exchange online module supports maximum three sessions per user hence limiting the parallel operations in execution.

**Resolution**: Connector uses all the three sessions while performing aggregation. Hence to improve the aggregation performance no other operation must be performed using the configured user.

## Account Aggregation Fails

When new attributes are added in account schema, Get Object / Account Aggregation fails with the following error message:

`Error - 501 This operation target is not yet supported`

**Resolution**: Microsoft Graph API supports some of the following attributes only for retrieving single user:

- `aboutMe`
- `birthday`
- `hireDate`
- `interests`
- `mySite`
- `pastProjects`
- `preferredName`
- `responsibilities`
- `schools`
- `skills`
- `mailboxSettings`

The addition of these attributes while retrieving collection of users leads to aggregation failure. Verify if the newly added attributes are in the list of these attributes and remove them from the schema.

## Unexpected Errors Occur During Provisioning

`An unexpected 'PrimitiveValue' node was found when reading from the JSON reader. A 'StartArray' node was expected.`

Or

`Invalid value for the Property`

**Resolution**: Ensure that the data type of the attribute is added correctly to the provisioning policy. For more information, refer to the [Microsoft Documentation](<https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties>).

> [!NOTE]
>
> For update account operation, the businessPhones attribute accepts only single value with the data type as String collection.

## Delta Aggregation With the userFilters Scope Fails With an Aggregation Timeout

**Resolution**: Many users could be out of the defined userFilter scope. Add the returnNullROAfter attribute using SailPoint API. Value is number of the out of scope users, the default value is 50.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Account Fetch After Create Request May Fail Due to Cloud Delay

**Resolution**: Add the createAccountTimelag attribute, using the SailPoint REST API, to create a delay (in seconds) that will occur after the create request and before the connector fetches the account. The time can be modified as needed. The value could be number of the seconds, the default value is 20 seconds.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Full Account Aggregation Takes a Long Time to Complete

In cases where the entitlement attributes (like groups, roles, and servicePrincipals) are present in the account schema, add the following entry in the source XML using the SailPoint REST APIs `max-thread-account-membership` with a value of 6, 8, or 10 in accordance with your requirements. The default value is 4.

> [!NOTE]
>
> This entry is not valid/used during delta aggregation.

For example:

key: `max-thread-account-membership`

value: `8`

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Full Account Aggregation Is Slow and Pulls in Unwanted Schema Attributes

**Resolution**: Remove the unwanted attributes from schema using the SailPoint REST APIs.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

1. Use the following API to get the account schema:

   `curl --location 'https://<tenanturl>.api.cloud.sailpoint.com/v3/sources/<sourceID>/schemas/<schemaID>' \ --header 'Authorization: Bearer eyJhbGc'`

   For example, `curl --location'https://tenanturl.api.cloud.sailpoint.com/v3/sources/2fb65f6328cf/schemas/f2bdf68e851' \ --header 'Authorization: Bearer eyJhbGc'`
2. Get the response from the above API and remove the unwanted attributes and set the body in the following PUT API:

   > **PUT API Reference**
   >
   > ```text
   > curl --location --request PUT 'https://tenanturl.api.cloud.sailpoint.com/v3/sources/2fb65f6328cf43a2a95b49cdeb0778dd/schemas/f2bdf68fec764156b58ba41520cbe851' \
   > --header 'Content-Type: application/json' \
   > --header 'Authorization: Bearer acbdEFG123' \
   > --data-raw '{
   >     "id": "f2bdf68fec",
   >     "nativeObjectType": "User",
   >     "identityAttribute": "distinguishedName",
   >     "displayAttribute": "sAMAccountName",
   >     "hierarchyAttribute": null,
   >     "includePermissions": false,
   >     "features": [],
   >     "configuration": {},
   >     "attributes": [
   >         {
   >             "name": "businessCategory",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "business category",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "carLicense",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "vehicle license or registration plate",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "cn",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "common name(s) for which the entity is known by",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "departmentNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "identifies a department within an organization",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "destinationIndicator",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "destination indicator",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "displayName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "preferred name to be used when displaying entries",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "distinguishedName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "distinguished name for which the entity is known by",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "employeeNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "numerically identifies an employee within an organization",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "employeeType",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "type of employment for a person",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "facsimileTelephoneNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Facsimile (Fax) Telephone Number",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "givenName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "first name(s) for which the entity is known by",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "homePhone",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "home telephone number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "homePostalAddress",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "home postal address",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "initials",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "initials of some or all of names, but not the surname(s).",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "internationaliSDNNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "international ISDN number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "l",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "city",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "mail",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "RFC822 Mailbox",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "manager",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "DN of manager",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "mobile",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "mobile telephone number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "o",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "organization this object belongs to",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "ou",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "organizational unit this object belongs to",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "pager",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "pager telephone number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "physicalDeliveryOfficeName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Physical Delivery Office Name",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "postOfficeBox",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Post Office Box",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "postalAddress",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "postal address",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "postalCode",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "postal code",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "preferredDeliveryMethod",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "preferred delivery method",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "preferredLanguage",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "preferred written or spoken language for a person",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "registeredAddress",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "registered postal address",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "roomNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "room number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "secretary",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "DN of secretary",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "seeAlso",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "DN of related object",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "sn",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "last (family) name(s) for which the entity is known by",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "st",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "state or province which this object resides in",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "street",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "street address of this object",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "telephoneNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Telephone Number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "teletexTerminalIdentifier",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Teletex Terminal Identifier",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "telexNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Telex Number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "title",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "title associated with the entity",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "uid",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "user identifier",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "objectClass",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "object classes of the entity",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "memberOf",
   >             "type": "STRING",
   >             "schema": {
   >                 "type": "CONNECTOR_SCHEMA",
   >                 "id": "361378963168",
   >                 "name": "group"
   >             },
   >             "description": "Group Membership",
   >             "isMulti": true,
   >             "isEntitlement": true,
   >             "isGroup": true
   >         },
   >         {
   >             "name": "objectSid",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Windows Security Identifier",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "objectguid",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Object globally unique identifier ",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "sAMAccountName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "sAMAccountName",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "primaryGroupID",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "RID of users primary group",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "primaryGroupDN",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "DN of users primary group",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "accountFlags",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "List of the flags enabled on an account",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "department",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "User'\''s department",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msNPCallingStationID",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "CallingStationID",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msRADIUSFramedRoute",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Static Routes for Dial-In connection",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msNPAllowDialin",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Is dial-in allowed",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msRADIUSCallbackNumber",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Callback Number",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msRADIUSFramedIPAddress",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Define Static IP Address",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "mailNickname",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Exchange Alias",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "homeMDB",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Exchange Database",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msExchHideFromAddressLists",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Hide from Exchange address lists",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msRTCSIP-UserEnabled",
   >             "type": "BOOLEAN",
   >             "schema": null,
   >             "description": "User enabled for Lync Server",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "SipAddress",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Lync sipAddress",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "RegistrarPool",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Lync Registrar pool",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "LyncPinSet",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Lync user pin set status",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "LyncPinLockedOut",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Lync user pin lock status",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "pwdLastSet",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Time of last password reset",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msDS-PrincipalName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Name of the entity in the format \"NetBIOS domain name\\sAMAccountName\"",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "userPrincipalName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "The unique name of the entity within the domain, in the format \"name@domain\"",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "externalEmailAddress",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "External email address of Mail User",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "dNSHostName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Fully Qualified Domain Name for the Service Account",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msDS-ManagedPasswordInterval",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Password change interval in days for the Managed Service Account",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msDS-SupportedEncryptionTypes",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Supported Encryption Types for the Managed Service Account",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msDS-GroupMSAMembership",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Principals allowed to use Group Managed Service Account",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msDS-AllowedToActOnBehalfOfOtherIdentity",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Principals that can act on the behalf of Group Managed Service Account",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "servicePrincipalName",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Service principal names for the Service Account",
   >             "isMulti": true,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "objectType",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Type of Active Directory object",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "shadowAccountDN",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "DistinguishedName of the Linked Mailbox shadow account",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "shadowAccountGuid",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "ObjectGuid of the Linked Mailbox shadow account",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "msExchRecipientTypeDetails",
   >             "type": "STRING",
   >             "schema": null,
   >             "description": "Type of the Microsoft Exchange recipient object",
   >             "isMulti": false,
   >             "isEntitlement": false,
   >             "isGroup": false
   >         },
   >         {
   >             "name": "memberOfSharedMailbox",
   >             "type": "STRING",
   >             "schema": {
   >                 "type": "CONNECTOR_SCHEMA",
   >                 "id": "dd43485",
   >                 "name": "sharedMailbox"
   >             },
   >             "description": "List of Shared Mailboxes to which user has permissions",
   >             "isMulti": true,
   >             "isEntitlement": true,
   >             "isGroup": true
   >         }
   >     ],
   >     "id": "f2bdf68f",
   >     "name": "account",
   >     "created": "2023-10-09T17:22:35.174Z",
   >     "modified": "2023-10-09T17:22:35.174Z"
   > }'
   > ```

## Account Aggregation Fails With Duplicate 'ImmutableId' and 'immutableId' Keys

This error occurs when there is a duplication of attribute `immutableID` in the ResourceObject(RO).

**Resolution**: Add the entry `skipProcessLegacyIdentifiers` in the source XML using SailPoint REST API and set the value as `true`. By default this value is false.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Account Aggregation Gets Stuck for Days When Manage Exchange Online Is Enabled

Since there is no timeout limit set for the IQService's response, the current setting defaults to 0. This means it will wait indefinitely if IQService doesn't respond.

**Resolution**: Add the following entry to the source XML using PATCH:

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/IQServiceResponseTimeout",
        "value": "7200"
    }
]
```

The value is in seconds and depends on how long IQService takes to fetch the `sharedMailbox AND/OR EXO` attributes.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## SharedMailbox Displays Alphanumeric Values Instead of a User-Friendly Display Name

**Resolution**: If SharedMailbox displays Globally Unique Identifier (GUID) value instead of a readable `DisplayName`, add the `useDisplayNameForSharedMailbox` entry to the source XML using PATCH and set the value to `true`. For example,

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/useDisplayNameForSharedMailbox",
        "value": true
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Numeric Value Displayed for SPN Account Names

When managing users and Service Principal Names (SPNs) as accounts under a single source, if the `displayName` attribute of the Account Schema is set to `UserPrincipalName`, you may encounter numeric values for SPN accounts instead of readable names. **Resolution**: To display the correct SPN displayName, ensure that the `mapSPNDisplayNameToUPN` is added to the source XML using PATCH and set the value to `true`. For example,

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/mapSPNDisplayNameToUPN",
        "value": true
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Property usageLocation Is Invalid

The connector may return a 400 error or a message stating "Property usageLocation is invalid" when attempting to remove the `usageLocation` attribute.

**Resolution**:

To resolve this, configure the connector to wait after license operations are performed, ensuring they are fully processed before the connector attempts to modify the `usageLocation`. To do so, add the `waitAfterLicenseOperations` attribute to the source configuration using the following REST API PATCH call :

Endpoint: `PATCH /v3/sources/:id`

Body:

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/waitAfterLicenseOperations",
        "value": "15"
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

where, value equals to 15 represents the wait time in seconds.

## DeltaLink Older Than 30 Days Is Not Supported

**Resolution**: This error occurs because delta token has expired. Run a full aggregation to reset it to the latest delta token.

## 400 Bad Request on Microsoft Graph API Filter

**Resolution**: Replace `dirSyncEnabled` with `onPremisesSyncEnabled` to check if a user is synced from on-premises directory.

For example, `onPremisesSyncEnabled eq true`

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

> [!IMPORTANT]
>
> Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

### timeoutInSeconds

**Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests.

For example:

If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeoutInSeconds",
        "value": "15"
    }
]
```