# Directory Attributes

## Admin Consented Permission Attributes

To manage admin consented permissions, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The object type is `adminConsentedPermission`.

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for adminConsentedPermission.<br>This is the native identity attribute. This ID is a concatenation of `resourceId:value`<br>Where `resourceId` is the ID of SPN and `value` is the value for the adminConsentedPermssion within that SPN.<br>For example:<br>`2555d458-1b3c-4953-bcc4-a38409561c2f:AuditLog.Read.All` |
| displayName | String | This is the display name of the adminConstentedPermission.<br>Just like id, displayName is a concatenation of `value [on] resource-DisplayName`<br>For example:<br>If an SPN with a displayName of `Microsoft Graph` has a permission defined with the value as `AuditLog.Read.All`, then the displayName for adminConsentedPermission after concatenation would be `AuditLog.Read.All [on] Microsoft Graph` |
| spn\_description | String | This is the description for the SPN. |
| permission\_description | String | This is the description for the adminConsentedPermission. |
| type | String | The possible values are `User` and `Admin`. This denotes whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an admin consent should always be required. |
| isEnabled | boolean | Whether the adminConsentedPermission is enabled or disabled. |
| value | String | The value for the attribute. For example:<br>`AuditLog.Read.All` |

Use the following JSON request and REST API to add the `adminConsentedPermission` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
        "nativeObjectType": "adminConsentedPermission",
        "identityAttribute": "id",
        "displayAttribute": "displayName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "displayName",
                "type": "STRING",
                "schema": null,
                "description": "The display name for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "spn_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of service principal",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "permission_description",
                "type": "STRING",
                "schema": null,
                "description": "Description of admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "id",
                "type": "STRING",
                "schema": null,
                "description": "The unique identifier for the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "type",
                "type": "STRING",
                "schema": null,
                "description": "Allowed types for admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "isEnabled",
                "type": "STRING",
                "schema": null,
                "description": "States whether the admin consented permission is enabled or not",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "value",
                "type": "STRING",
                "schema": null,
                "description": "Value of the admin consented permission",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ]
}
```

## Administrative Units Attributes

To manage administrative units, ensure that the following attribute is present in the account schema:

| Name | Type | Details |
| --- | --- | --- |
| administrativeUnits | String<br>Multivalued<br>Entitlement | List of Administrative Units to which the user belongs to. |

### Object Type - administrativeUnit

To manage the Microsoft Entra ID administrative units objects, ensure that the following attributes are present in the entitlement schema:

<table class="span-table"> <tr> <td>Schema Attribute Name</td> <td>Type</td> <td>Description</td> </tr> <tr> <td>id</td> <td colspan="1" rowspan="8">String</td> <td>Fully qualified ID for the Administrative Unit.</td> </tr> <tr> <td>displayName</td> <td>Friendly name of the Administrative Unit.</td> </tr> <tr> <td>description</td> <td>This is the description of the Administrative Unit.</td> </tr> <tr> <td>isMemberManagementRestricted</td> <td>This is the description of Administrative Unit.</td> </tr> <tr> <td>membershipRule</td> <td>Membership Rule.</td> </tr> <tr> <td>membershipType</td> <td>MembershipType.</td> </tr> <tr> <td>membershipRuleProcessingState</td> <td>Membership Rule Processing State.</td> </tr> <tr> <td>visibility</td> <td>Visibility.</td> </tr> </table>

Use the following JSON request and the SailPoint REST API to add the `administrativeUnit` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
      "type": "administrativeUnit",
      "nativeObjectType": "administrativeUnit",
      "identityAttribute": "id",
      "displayAttribute": "displayName",
      "attributes": [
        {
          "name": "id",
          "type": "STRING",
          "schema": null,
          "description": "Fully qualified ID for the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "displayName",
          "type": "STRING",
          "schema": null,
          "description": "Friendly name of the Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "description",
          "type": "STRING",
          "schema": null,
          "description": "Description of Administrative Unit",
          "isMulti": false,
          "isEntitlement": false,
          "isGroup": false
        },
        {
          "name": "isMemberManagementRestricted",
          "type": "BOOLEAN",
          "description": "Description of Administrative Unit"
        },
        {
          "name" : "membershipRule",
          "type" : "STRING",
          "description": "Membership Rule"
        },
        {
          "name" : "membershipType",
          "type" : "STRING",
          "description": "Membership Type"
        },
        {
          "name" : "membershipRuleProcessingState",
          "type" : "STRING",
          "description": "Membership Rule Processing State"
        },
        {
          "name" :"visibility",
          "type" : "STRING",
          "description" : "Visibility"
        }

]

}
```

## Application Role Attributes

### Object Type - applicationRole

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| id | String | This is the unique identifier for Application Role.<br>This is the nativeIdentity attribute.<br>This id is a concatenation of:<br>`resourceId:appRoleId`<br>Where, `resourceId` is the ID of SPN, and `appRoleId` is the ID for the appRole within that SPN.<br>For example, `70b32868-8393-4c4e-99fc-916710f62412:6f445064-b311-4d3e-a869-e024e787d6a9` |
| displayName | String | This is the display name of the Application Role.<br>Just like id, displayName is a concatenation of:<br>`resource-DisplayName: appRole-DisplayName`<br>For example, if an SPN with displayName TestSPN, has an appRole defined with name Engineer, then the displayName for appRole after concatenation would be TestSPN:Engineer |
| spn\_description | String | This is the description for the SPN. |
| appRole\_description | String | This is the description for the appRole. |
| allowedMemberTypes | String<br>Multi | Displays the types of members that this role can be assigned to. For example, `Users,Groups,Applications` |
| isEnabled | boolean | Displays whether the appRoles is enabled or disabled. |
| value | String |  |

Use the following JSON request and the REST API to add the `ApplicationRole` schema to an existing connector:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```text
{
    "nativeObjectType": "applicationRole",
    "name": "applicationRole",
    "identityAttribute": "id",
    "displayAttribute": "displayName",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "id",
            "type": "STRING",
            "schema": null,
            "description": "Unique Identifier for Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "displayName",
            "type": "STRING",
            "schema": null,
            "description": "Display Name of the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "spn_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Service Principal",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "appRole_description",
            "type": "STRING",
            "schema": null,
            "description": "This is the description for the Application Role",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "allowedMemberTypes",
            "type": "STRING",
            "schema": null,
            "description": "Types of members that this role can be assigned to, for example: Users,Groups,Applications",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "isEnabled",
            "type": "BOOLEAN",
            "schema": null,
            "description": "Represents whether the Application Role is enabled or disabled.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "value",
            "type": "STRING",
            "schema": null,
            "description": "The value of the Application Role.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}
```

## Roles

To manage the Microsoft Entra role objects, ensure that the following attributes are present in the group schema.

| Attribute Name | Description |
| --- | --- |
| description | Specify the description of the Microsoft Entra role. |
| displayName | Specify the display name for the Microsoft Entra role. |
| id | Specify the unique identifier for the Microsoft Entra role. |
| isBuiltIn | Specify the flag indicating whether the role is part of the default set included in Microsoft Entra or a custom one. |
| isEnabled | Specify the flag indicating whether the role is enabled for assignment. If it is false, the role is not available for assignment. |
| rolePermissions | Specify the list of permissions included in the role. |

### Backward Compatibility Note

The Microsoft Entra ID connector used to support roles as entitlement attribute on accounts but there was no support to aggregate roles as new separate group / entitlement type.

With that configuration, the connector used to show ‘displayName’ of role as entitlement value on the accounts. In order to continue support displayName based role entitlements, connector supports displayName as native Identity attribute of the new role object.

There are certain limitations in using displayName as native identity attribute :

- Duplicate displayName is allowed for roles. If duplicate display names exists in your deployment, then avoid using displayName as native identifier.
- **displayName** is an editable field, so it should not be edited if used as native identifier.

## Mail Contacts As Accounts Attributes

To manage mail contacts as accounts, ensure the following attributes are present in your account schema:

| Schema Attribute Name | Type | Description |
| --- | --- | --- |
| objectId | String | ID is normal GUID. So to identity this object as `mailContacts` you should save this as `microsoft.mailContact:88914ce6-7962-4465-8cb3-371268c1e64a` |
| displayName | String | Display name of the mail contact. |
| groups | String<br>Multivalued<br>Entitlement<br>Managed | List of groups that the mail contact is a member of. |
| mailContact\_department | String | The name for the department in which the contact works. |
| mailContact\_companyName | String | The name of the company that this mail contact belongs to. |
| mailContact\_givenName | String | First name of the mail contact. |
| mailContact\_jobTitle | String | Job title of the mail contact. |
| mailContact\_mail | String | The SMTP address of the contact. For example, `jeff@contoso.onmicrosoft.com` |
| mailContact\_mailNickName | String | Email alias (portion of the email address prepending the @ symbol) of the mail contact. |
| mailContact\_surname | String | Last name of the mail contact. |
| mailContact\_address | String | Post address of the mail contact.<br>Note<br>The contact can only have one physical address. |
| mailContact\_phones | String | List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax. |

### Sample JSON Request for Managing Mail Contacts As Accounts

```text
{
  "nativeObjectType": "account",
  "identityAttribute": "objectId",
  "displayAttribute": "userPrincipalName",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [],
  "configuration": {},
  "attributes": [
    {
      "name": "objectId",
      "type": "STRING",
      "schema": null,
      "description": "The unique identifier for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "STRING",
      "schema": null,
      "description": "The name displayed in the address book for the user",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "groups",
      "type": "STRING",
      "schema": {
        "type": "CONNECTOR_SCHEMA",
        "id": "2c918085843dc5ce01845bebf6e43a8a",
        "name": "group"
      },
      "description": "Groups assigned to a user",
      "isMulti": true,
      "isEntitlement": true,
      "isGroup": true
    },
    {
      "name": "mailContact_phones",
      "type": "STRING",
      "schema": null,
      "description": "List of phones associated with the mail contact. Phone types can be mobile, business, and businessFax.",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_department",
      "type": "STRING",
      "schema": null,
      "description": "The name for the department in which the contact works.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_companyName",
      "type": "STRING",
      "schema": null,
      "description": "The name of the company that this mail contact belongs to.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_givenName",
      "type": "STRING",
      "schema": null,
      "description": "First name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_surname",
      "type": "STRING",
      "schema": null,
      "description": "Last name of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_jobTitle",
      "type": "STRING",
      "schema": null,
      "description": "Job title of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mailNickName",
      "type": "STRING",
      "schema": null,
      "description": "Email alias (portion of the email address prepending the @ symbol) of the mail contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "mailContact_mail",
      "type": "STRING",
      "schema": null,
      "description": "The SMTP address of the contact.",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```

## Channel Attributes

To manage the channel management objects, ensure that the following attributes are present in the group schema.

<table> <thead> <tr> <th>Attribute Name</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>description</td> <td>Optional textual description for the channel.</td> </tr> <tr> <td>displayName</td> <td>Channel name as it will appear to the user in Microsoft Teams.<br>Combination of team display name: channel display name.</td> </tr> <tr> <td>id</td> <td>The channel's unique identifier.<br>Combination of team id: channel id</td> </tr> <tr> <td>isFavoriteByDefault</td> <td>Indicates whether the channel must automatically be marked favorite for all members of the team. Default: false.</td> </tr> <tr> <td>email</td> <td>The email address for sending messages to the channel. Read-only.</td> </tr> <tr> <td>webUrl</td> <td>A hyperlink that will go to the channel in Microsoft Teams.</td> </tr> <tr> <td>membershipType</td> <td>The type of the channel. Possible values are:<br><ul><li>standard: Channel inherits the list of members of the parent team.</li><li>private: Channel can have members that are a subset of all the members on the parent team.</li></ul></td> </tr> <tr> <td>createdDateTime</td> <td>Read only. Timestamp at which the channel was created.</td> </tr> <tr> <td>teamEmail</td> <td>The email address of the parent team.</td> </tr> <tr> <td>owners</td> <td>The list of owners of the private channel.<br>Properties: Multi-Valued</td> </tr> </tbody> </table>