Schema Reference

This section describes the different schema attributes. The Microsoft Entra ID connector currently supports the following types of objects:

• Account: Account objects are used when building identities Link objects.
• Group: The group schema is used when building Account-Group objects that are used to hold entitlements shared across identities.
• Service Principal: The Service Principal schema is used to represent Azure Service Principal which are identities created for use with applications, hosted services, and automated tools to access Azure resources.
• Service Plan: The Service Plan schema is used to represent Azure Service Plan (License Plans).
• Management Group: The Management group schema is used to represent Azure Management Groups which are created to allow Azure customers to organize their subscriptions and apply governance controls such as Role Based Access Control and Policies.
• Subscription: The Subscription schema is used to represent Azure Subscription objects which represent a signed agreement between a supplier and customer that the customer would receive and provide payment for regular products or services.
• Resource Group: The Resource group schema is used to represent Azure Resource Groups which are container objects that hold related resources for an Azure solution.
• Azure Role Assignment: The Azure Role Assignment schema is used to represent custom group objects that consist of the following elements:
  • Security Principal (user, groups, service principal, managed identity)
  • Role Definition
  • Access Scope

The application schema is used to configure the objects returned from a connector.

The Microsoft Entra ID connector uses the following default correlation and object configurations.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

The following table lists the default account IDs for this connector:

Default Account Attributes

The Microsoft Entra ID connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Risky User Alert Supported Attributes

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Default Group Attributes

The Microsoft Entra ID connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Access Package Attributes

To manage access packages, ensure that the following attribute is present in the account schema:

To manage the Microsoft Entra access package objects, ensure that the following attributes are present in the group schema:

Identity Profile Mapping

The Microsoft Entra ID connector supports the following attributes in Identity Profile Mapping by default:

Multi-Factor Authentication (MFA) Attributes

To manage multi-factor authentication user information, ensure that the following attributes are present in the account schema:

Service Plan

{
  "name": "servicePlan",
  "nativeObjectType": "servicePlan",
  "identityAttribute": "objectId",
  "displayAttribute": "displayName",
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "attributes": [
    {
      "name": "objectId",
      "type": "string",
      "isMultiValued": false,
      "description": "Unique identifier for the service plan which is a combination of skuId and servicePlanId separated by colon (:).",
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuId",
      "type": "string",
      "description": "Unique identifier (GUID) for the License Pack",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "skuPartNumber",
      "type": "string",
      "description": "The SKU part number of the License Pack. For example, AAD_PREMIUM",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "appliesTo",
      "type": "string",
      "description": "Object types to which the license pack can be assigned. For example: User, Company",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "displayName",
      "type": "string",
      "description": "Display name of service plan which is a combination of skuPartNumber and servicePlanName separated by colon (:).",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanId",
      "type": "string",
      "description": "Unique identifier of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "servicePlanName",
      "type": "string",
      "description": "The name of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "provisioningStatus",
      "type": "string",
      "description": "The provisioning status of the service plan",
      "isMultiValued": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ],
  "created": "2019-12-24T22:32:58.104Z",
  "modified": "2019-12-31T20:22:28.104Z"
}​

Using Multiple Group Entitlements With Pre-Existing Connectors

For the pre-existing Microsoft Entra ID connectors, perform the following steps to start using Multiple Group Entitlements with your current connector.

1. Use the createSchema API to create new group schema for your connector. Refer to the following respective sections for examples of API body content for adding to existing connector:

   • servicePlan
   • Service Principal

2. Update Account Schema with the following steps:

   1. Get account schema using the getSchema API.
   2. Copy the schema to a file and search for attribute corresponding to the group schema that is added in the previous step.

   3. Add or update the following two properties for the attribute found in the previous step:

      "isGroup": true,
      "schema": {"type": "CONNECTOR_SCHEMA","id": "<Schema_ID_From_Step1>","name": "<Name_Of_Schema_Created_In_Step1>"}
      

   4. Add the schema modified in the previous step to the payload to update account schema in the connector using the replaceSchema API.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.