Skip to content

Provisioning

The Microsoft Entra ID connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft Entra ID directly from SailPoint.

Prerequisite: Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

Important

This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

Default Create Account Attributes

Account Attribute Generator Description
userPrincipalName* Create Unique Account ID User principal name (UPN) of the user. This generator uses the value in the Pattern Used field to generate a unique user name for the new account.
For example, jeff@contoso.onmicrosoft.com
Note
You must edit your domain in the Pattern Used field to match your domain.
password* Create Password Password for the new account.
displayName* Identity Attribute Display name of the account.
mailNickname* Create Unique Account ID Mail alias for the account.
accountEnabled Static Set it to false to create disabled account. Default: True
forceChangePasswordNextLogin Static If true, asks user to change password on next sign in. Default: True
department Disable Department in which the user works.
jobTitle Disable User's job title.
passwordPolicies Disable Specifies password policies for the user.
For example: DisablePasswordExpiration, DisableStrongPassword
otherMails Disable Additional email addresses for the user.
givenName Identity Attribute First name of the user.
surname Identity Attribute Surname of the user.
usageLocation Static A two letter country code (ISO standard 3166). Required for users that will be assigned licenses.
country Disable Country/region in which the user is located. For example, US or UK
state Disable State or province in the user's address.
city Disable City in which the user is located.
streetAddress Disable Street address of the user's place of business.
postalCode Disable Postal code for the user's postal address.
physicalDeliveryOfficeName Disable Office location in the user's place of business.
telephoneNumber Disable Primary telephone number of the user's place of business.
mobile Disable Primary cellular telephone number for the user.
facsimileTelephoneNumber Disable Telephone number of the user's business fax machine.
userType Disable A string value that can be used to classify user types in your directory.
isFederatedDomain Static Set it true to create federated domain user. If this is checked and immutableId is not set then random immutableId value will be used.
immutableId Disable This property is used to associate an on-premises Active Directory user account to their Microsoft Entra ID user account; Populate this attribute with objectGUID of account from on-premises Active Directory to create federated user synchronized with on-premises Active Directory user.
preferredLanguage Disable Preferred language for the user. Should follow ISO 639-1 Code.
For example, en-US
servicePrincipalRoleId ServicePrincipal Role Id.
By default not present in the schema. It is required if you want to assign ServicePrincipal during account creation.

Guest User (B2B) Support

The Microsoft Entra ID connector supports creation of Guest User (B2B) by sending invitations. Creation of Guest User (B2B) varies from normal user creation in terms of attributes provided during creation.

Create Guest User (B2B) Account Policy

Attribute Name Description
accountType* Default is User
To create Guest User (B2B), set this value to Guest User B2B.
invitedUserEmailAddress* Email address of the user.
inviteRedirectUrl* The URL that the user will be redirected to after redemption.
sendInvitationMessage* Set it to False if invitation email need not to be sent to the user. Default is True
customizedMessageBody Customized message text that can be added in the invitation email for the B2B Guest User.
invitedUserDisplayName The display name of the user being invited.
invitedUserUsageLocation A two letter country code indicating usage location (ISO standard 3166).
servicePrincipalRoleId ServicePrincipal Role Id.
By default not present in the schema. It is required if you want to assign ServicePrincipal during account creation.

External Member (B2B) Support

The Microsoft Entra ID connector supports the creation of External Member (B2B) users by sending invitations. This process is similar to creating a Guest (B2B) user, but the userType is configured as Member instead of Guest.

Create External Member (B2B) Account Policy

Attribute Name Description
accountType* Default is User.
To create External Member (B2B), set this value to External Member B2B.
invitedUserEmailAddress* Email address of the user.
inviteRedirectUrl* The URL that the user will be redirected to after redemption.
sendInvitationMessage* Default is True.
Set it to False if the invitation email should not be sent to the user.
customizedMessageBody Customized message text that can be added in the invitation email for the External Member user.
invitedUserDisplayName The display name of the user being invited.
invitedUserUsageLocation A two-letter country code indicating usage location (ISO standard 3166).

Local User (B2C) Support

The Microsoft Entra ID connector supports creation of Local Users. Creation of Local User account varies from normal user in terms of attributes provided during creation. Account creation also supports custom attribute.

Create Local User (B2C) Account Policy

Attribute Name Description
accountType* Default is User
To create Local User (B2C), set this value to Local User B2C.
signInNameType* Sign-in type for user in your Azure directory.
signInNameValue* Sign-in name for user.
localAccountDisplayName* Display name of account.
b2cPassword* Password for the new account.
enableLocalAccount Set it to false to create disabled account. Default: True
b2cForceChangePasswordNextLogin If true, asks user to change password on next login. Default: True
servicePrincipalRoleId ServicePrincipal Role Id.
By default not present in the schema. It is required if you want to assign ServicePrincipal during account creation.

Note

Custom user attributes can be added in B2C create account policy by appending suffix "_C" to the attribute.

Multi-Factor Authentication (MFA) Provisioning Policy Attributes

To provision MFA attributes for users, add the same attributes in the provisioning policy that are present in the account schema (for more information, refer to Multi-Factor Authentication (MFA) Attributes) with the Review Required flag checked.

Note

When using the phone authentication method, the values for the following attributes are expected to be provided with the country code as a prefix: mfa_phoneNumber_mobile, mfa_phoneNumber_alternateMobile, and mfa_phoneNumber_office. If the country code is not provided provisioning operations will result in failure. The value for these attributes should follow this format (there must be a space between the country code and the phone number):<country code> <phone number>

Examples:

  • <AttributeRequest name="mfa_phoneNumber_mobile" op="Add" value="+1 2065555555"/>
  • <AttributeRequest name="mfa_phoneNumber_alternateMobile" op="Add" value="+1 2065555556"/>
  • <AttributeRequest name="mfa_phoneNumber_office" op="Add" value="+1 2065555557"/>

Note

Once you enable MFA for any user there will be one default authentication method set. This is usually the first method configured, but you can modify it later from the Azure portal. If you are trying to remove values for an attribute that belongs to the default authentication method, the Azure APIs will throw an error as the APIs do not expect to remove values for attributes that belong to the default authentication method. For example, if email is the default authentication method configured for an Azure user, the connector will not be able to remove the value for the mfa_emailAddress attribute.

Authentication Method Attribute Name Type Description
Phone mfa_phoneNumber_mobile String Mobile phone number assigned to the user.
Phone mfa_phoneNumber_alternateMobile String Alternate mobile phone number assigned to the user.
Phone mfa_phoneNumber_office String Office phone number assigned to the user.
Email mfa_emailAddress String Email address assigned to the user.
Microsoft Authentication mfa_microsoftAuthenticatorAuthenticationMethod String: Multivalued Microsoft Authentication method assigned to the user.
Other mfa_methodName
Where methodName is the authentication method name.
For example:
  • mfa_fido2AuthenticaitonMethod
  • mfa_temporaryAccessPassAuthenticationMethod
  • mfa_softwareOauthAuthenticationMethod
  • mfa_windowsHelloForBusinessAuthenticationMethod
 String: Multivalued Other authentication method assigned to the user.

For the mfa_methodName attribute, the connector only supports removing or clearing the MFA related information. For more information, refer to the second sample update request.

Provisioning B2C userIdentities and signInNames

You can use the Update and Modify operations like Add, Set, and Remove of userIdentities and signInNames for a social and local user account in an Azure Active Directory B2C tenant.

If you want to leverage this functionality, add the following attributes in the provisioning policy with type as string and multi as true (with the value in JSON format):

  • userIdentities
  • signInNames

Create/Modify/Delete Mail Contact Profile Attributes

The followings lists the create mail contact profile attributes:

Note

Attributes marked with an asterisk (*) are mandatory.

Attribute Name Description
mailContact_displayName* Display name of the mail contact.
mailContact_mail* External email address of the mail contact.
mailContact_mailNickname Mail nickname of the mail contact.
mailContact_givenName First name of the mail contact.
mailContact_surname Last name of the mail contact.

Sample Provisioning Request for Creating Mail Contact

<ProvisioningPlan>
  <AccountRequest op="Create">
    <AttributeRequest name="accountType" op="Add" value="Mail Contact"/>
    <AttributeRequest name="displayName" op="Set" value="DummyContact"/>
    <AttributeRequest name="mailContact_mail" op="Set" value="DummyContact@gmail.com"/>
    <AttributeRequest name="mailContact_mailNickname" op="Set" value="DummyContact"/>
    <AttributeRequest name="mailContact_givenName" op="Set" value="DummyContact-FirstName"/>
    <AttributeRequest name="mailContact_surname" op="Set" value="DummyContact-LastName"/>
</ProvisioningPlan>

Sample Provisioning Request for Modifying Mail Contact

<ProvisioningPlan nativeIdentity="DummyContact">
  <AccountRequest nativeIdentity="microsoft.mailContact:615a0c76-b18f-476c-b448-83610a600973" op="Modify">
    <AttributeRequest  displayValue="DummyGroupName" name="groups" op="Add" value="0a9bd1d7-a993-49b8-ab01-0e4f709ef42b">
      <Attributes>
        <Map>
          <entry key="assignment" value="true"/>
        </Map>
      </Attributes>
    </AttributeRequest>
    <AttributeRequest name="mailContact_city" op="Add" value="Delhi" />
  </AccountRequest>
</ProvisioningPlan>

Sample Provisioning Request for Deleting Mail Contact

<ProvisioningPlan nativeIdentity="DummyContact">
  <AccountRequest nativeIdentity="microsoft.mailContact:615a0c76-b18f-476c-b448-83610a600973" op="Delete"></AccountRequest>
</ProvisioningPlan>

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.