# Account, Group, and Role Management

## Account Management for User, User in Federated Domain, Guest User (B2B), and External Member (B2B)

This section describes the supported features for user, user in federated domain, guest user (B2B), and external member (B2B).

The following table lists various operations supported by connector for different Users:

<table> <thead> <tr> <th>Operations</th> <th>User</th> <th>User in Federated Domain</th> <th>Guest User (B2B)</th> <th>External Member (B2B)</th> </tr> </thead> <tbody> <tr> <td>Aggregation</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Delta Aggregation</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Get Account</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Pass-Through Authentication</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Create</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Update</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Delete</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Enable/Disable Users</td> <td>Yes</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Set Password</td> <td>Yes</td> <td>No</td> <td>No</td> <td>No</td> </tr> <tr> <td>Add/Remove Entitlements<br><ul><li>Add/Remove Shared Mailbox</li><li>Add/Remove individual license plans</li><li>Add/Remove license packs</li><li>Add/Remove Roles</li><li>Add/Remove user's group membership</li><li>Add/Remove ServicePrincipal Names</li><li>Add/Remove Channels</li></ul></td> <td>Yes</td> <td>Yes</td> <td>Yes<br>Note <br><em>Not applicable for Add or Remove Shared Mailbox from users</em></td> <td>Yes<br>Note <br><em>Not applicable to Add/ Remove Shared Mailbox from users</em></td> </tr> <tr> <td>Aggregate Exchange Mailbox Attribute</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Update Exchange Mailbox Attribute</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Aggregate Shared Mailbox as an Entitlement</td> <td>Yes</td> <td>Yes</td> <td>No</td> <td>No</td> </tr> <tr> <td>Aggregate and Provision Sponsors</td> <td>No</td> <td>No</td> <td>Yes</td> <td>Yes</td> </tr> </tbody> </table>

## Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Account Management for Local User (B2C)

Azure Active Directory B2C is primarily for businesses and developers that create customer-facing applications. With Azure Active Directory B2C, users can use Microsoft Entra as the full-featured identity system for their application, while letting customers sign in with an identity they already have established (like Facebook or Gmail).

B2C is intended for inviting customers of your mobile and web applications, whether individuals, institutional or organizational customers into your Microsoft Entra.

Supported identities are Consumer users with local application accounts (any email address or user name) or any supported social identity with direct federation. A new/separate Microsoft Entra application must be created to manage B2C tenants.

If Manage B2C Tenant is selected, entitlements are not fetched by default. To fetch entitlements set `fetchB2CMembership` attribute to true as mentioned in the [Additional Configuration Parameters](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#additional-configuration-parameters>) section.

<table class="span-table"> <tr> <td>Operations</td> <td>Manage B2C Tenant - Local User</td> <td>Manage B2C Tenant - Social User</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="6">Yes</td> <td>Yes</td> </tr> <tr> <td>Create</td> <td>No</td> </tr> <tr> <td>Update</td> <td>Yes</td> </tr> <tr> <td>Delete</td> <td>Yes</td> </tr> <tr> <td>Enable or Disable Users</td> <td>Yes</td> </tr> <tr> <td>Add/Remove Entitlements<br>Add/Remove Roles<br>Add/Remove User's Group Membership<br>Add/Remove ServicePrincipal Names</td> <td>Yes</td> </tr> </table>

> [!NOTE]
>
> Delta Aggregation is not applicable if Manage B2C Tenant is selected on the [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#connection-settings>) page.

## Revoke Session After Disabling User Account

Disabling a user account prevents future authentication attempts, but existing active sessions can remain valid until token expiration. With this feature enabled, the Microsoft Entra ID connector automatically revokes active sign-in sessions during the disable account workflow, cutting off access immediately.

### Supported Operations

- Revoke active user sign-in sessions when their account is disabled.

> [!NOTE]
>
> This feature applies to user accounts only. Service principals do not have sign-in sessions.

### Administrator Permissions

To revoke sign-in sessions, assign the following Microsoft Graph API application permissions to your Entra ID app registration:

| Type | Permission | Purpose |
| --- | --- | --- |
| Application | `User.RevokeSessions.All` | Revoke a user's sign-in sessions |
| Application | `User.ReadWrite.All` | Revoke a user's sign-in sessions |

> [!NOTE]
>
> If your application registration already contains the required permissions to perform the standard account disable operation `(User.ReadWrite.All)`, no additional permissions are required.

### Configuring Account Disable Settings

> [!NOTE]
>
> - For existing sources, this is disabled by default. When required, ensure to select this option.

To configure Account Disable Settings:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/revoke_sessions.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/revoke_sessions.png>)

1. Go to **Feature Management**.
2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled.
3. Select **Save**.

## Last Login for Accounts

The Microsoft Entra ID connector can retrieve the last login date and time for individual users. This information can enable governance workflows to certify access and remove long-standing access if it's no longer needed.

The connector uses the MS Graph API to retrieve the last login account data.

### Prerequisites

You must have an Microsoft Entra P1/P2 license to use this feature.

### Administrator Permissions

To retrieve the last login account data, the MS Graphs API requires you to assign it the `AuditLog.Read.All` API permission.

### Supported Operations

The connector retrieves last login information during the following operations:

- Account aggregation
- Get account

### Required Attributes

This feature requires the following login information:

> [!IMPORTANT]
>
> Important These attributes are not present by default and you must add them explicitly to the account schema, if required. To add these attributes to the account schema, use `signInActivity.<attribute_name>` format. For example, to use `lastSuccessfulSignInDateTime` from the managed system, add `signInActivity.lastSuccessfulSignInDateTime` to the account schema. For more information, refer to [Account Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#default-account-attributes>).

#### Attributes Related to Interactive Authentication Method

> [!NOTE]
>
> If you have an existing connector with attributes in your account schema named `lastSignInDateTime` and `lastNonInteractiveSignInDateTime`, the connector will still aggregate the values assigned to those attributes.

- `signInActivity.lastSignInDateTime`: To retrieve the last time a user logged into the directory with an interactive authentication method.
- `signInActivity.lastSignInRequestId`: To retrieve the request identifier of the last interactive sign-in performed by this user.

#### Attributes Related to Non-Interactive Authentication Method

- `signInActivity.lastNonInteractiveSignInDateTime`: To retrieve the last time a client signed in to the directory on behalf of a user.
- `signInActivity.lastNonInteractiveSignInRequestId`: To retrieve the request identifier of the last non-interactive sign-in performed by this user.

#### Other Supported Attributes

The following attributes are also supported along with the above listed attributes:

- `signInActivity.lastSuccessfulSignInDateTime`:To retrieve the date and time of the user’s most recent successful sign-in activity.
- `signInActivity.lastSuccessfulSignInRequestId`: To retrieve the request ID of the last successful sign-in.

## Azure Mail Contact Management

Mail contacts (also known as organizational contacts) are managed by an organization's administrators. Additionally, mail contacts are either synchronized from on-premises directories or from Exchange Online. With this feature, the connector supports managing Mail Contacts as Accounts.

### Supported Operations

The following operations are supported for Azure Mail Contact:

<table class="span-table"> <tr> <td>Operations</td> <td>Mail Contact</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="8">Yes</td> </tr> <tr> <td>Partitioned Aggregation</td> </tr> <tr> <td>Delta Aggregation</td> </tr> <tr> <td>Get Account</td> </tr> <tr> <td>Create</td> </tr> <tr> <td>Modify</td> </tr> <tr> <td>Delete</td> </tr> <tr> <td>Add/Remove Entitlements<br><ul><li>Add/Remove Mail Contacts from Distribution Groups/Lists</li></ul></td> </tr> </table>

### Administrator Permissions

> [!NOTE]
>
> If the `Directory.Read.All` or `Directory.ReadWrite.All` permission is already assigned to the application then the `OrgContact.Read.All` permission is not required.

| Purpose | Permission |
| --- | --- |
| Aggregate Mail Contacts | `OrgContact.Read.All` |
| Fetch Group Membership | `GroupMember.Read.All` |
| Create, Update, Delete, and Add/Remove Entitlements | The user account communicating via IQService must have the Exchange Administrator Role and the prerequisites mentioned in the [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html#exchange-online-management>) topic. |

### Supported Schema Attributes

To aggregate mail contacts as accounts, ensure that the mail contact attributes are present in the account schema. For more information, refer to [Mail Contacts as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#mail-contacts-as-accounts-attributes>).

### Supported Provisioning Attributes

To provision mail contacts related information, refer to [Create/Modify/Delete Mail Contact Profile Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/provisioning.html#createmodifydelete-mail-contact-profile-attributes>).

### Configure Mail Contacts As Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/mail_contacts_as_accounts_2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/mail_contacts_as_accounts_2.png>)

1. Go to **Feature Management**.
2. If it is not already selected, select **Manage Exchange Online** to view the rest of the fields. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.
3. Select **Mail Contact Governance** to manage mail contacts as accounts. When this is turned off, you see a black X. If it is turned on, you see a blue ✔.
4. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')`

## Custom (extension) Attributes

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the extended attributes that are registered on the client application on Azure. Creation of Local User (B2C) also supports custom attributes.

> [!NOTE]
>
> - Custom user attributes can be added in B2C create account policy by appending suffix "\_C" to the attribute. For example, `OrganizationName_C`
> - To update the custom attribute, the provisioning policy must be updated with the custom attribute name.

To aggregate custom attributes, you must update the schema for account or entitlement with the custom attribute names. The custom attribute name must match the custom attribute name on the managed Microsoft Entra ID system.

Use the following format for single-valued and multivalued string type custom attributes:

`extension_<clientID>_<CustomAttributeName>`

### Managing Complex Extension Attributes

To manage complex extension attributes, as shown below:

```text
"onPremisesExtensionAttributes": {
             "extensionAttribute1": "Value1",
             "extensionAttribute2": "Value2",
            "extensionAttribute3": "Value3",
            "extensionAttribute4": "Value4",
            "extensionAttribute5": "Value5",
            "extensionAttribute6": "Value6",
            "extensionAttribute7": "Value7",
            "extensionAttribute8": "Value8",
            "extensionAttribute9": "Value9",
            "extensionAttribute10": "Value10",
            "extensionAttribute11": "Value11",
            "extensionAttribute12": "Value12",
            "extensionAttribute13": "Value13",
            "extensionAttribute14": "Value14",
            "extensionAttribute15": "Value15"
```

Add these attributes in the **Account Schema** and **Create Account** sections in the SailPoint user interface. To add, use the following format:

> [!NOTE]
>
> Attributes are case sensitive.

`onPremisesExtensionAttributes_extensionAttribute1`

`onPremisesExtensionAttributes_extensionAttribute2`

`onPremisesExtensionAttributes_extensionAttribute3`

`onPremisesExtensionAttributes_extensionAttribute4`

`onPremisesExtensionAttributes_extensionAttribute5`

`onPremisesExtensionAttributes_extensionAttribute6`

`onPremisesExtensionAttributes_extensionAttribute7`

`onPremisesExtensionAttributes_extensionAttribute8`

`onPremisesExtensionAttributes_extensionAttribute9`

`onPremisesExtensionAttributes_extensionAttribute10`

`onPremisesExtensionAttributes_extensionAttribute11`

`onPremisesExtensionAttributes_extensionAttribute12`

`onPremisesExtensionAttributes_extensionAttribute13`

`onPremisesExtensionAttributes_extensionAttribute14`

`onPremisesExtensionAttributes_extensionAttribute15`

## Account - Group Management

The Microsoft Entra ID connector supports managing following group types as an entitlement and as separate group objects. These different types of groups are created for different purpose which are described as follows:

- Microsoft 365 groups (formerly Office 365 groups) are used for collaboration between internal and external users of the company.
- Distribution Lists (Distribution groups) are used for sending notifications to a group of people.
- Security groups are used for granting access to resources such as SharePoint sites.
- Mail-enabled security groups are used for granting access to resources such as SharePoint, and emailing notifications to those users.

The following table describes different conditions or configurations depending on which connector will aggregate different types of groups:

<table class="span-table"> <tr> <td>Group Types</td> <td>Default Aggregation</td> <td>Manage Office 365 checkbox selected in Feature Management</td> <td>Aggregate All Groups checkbox selected in Aggregation Settings</td> </tr> <tr> <td>Security</td> <td>Yes</td> <td>Yes</td> <td colspan="1" rowspan="4">Yes</td> </tr> <tr> <td>Mail-Enabled Security</td> <td>Yes</td> <td>Yes</td> </tr> <tr> <td>Office 365</td> <td>No</td> <td>Yes</td> </tr> <tr> <td>Distribution List</td> <td>No</td> <td>No</td> </tr> </table>

For more information on enabling Aggregate All Groups, refer to [Aggregation Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#aggregation-filter-and-partitioning-settings>).

For more information on enabling provisioning for Distribution Lists and Mail-Enabled Security Groups, refer to [Exchange Online Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html#exchange-online-management>).

For more information on enabling Office 365 Groups, refer to [Feature Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/feature_management.html#feature-management>).

## Group Hierarchy Information

This feature shows read-only group hierarchy information. By default, this feature is enabled for new connectors.

> [!NOTE]
>
> The group hierarchy calculation requires additional MS Graph API calls, so you may see an increase in aggregation time depending on the number of groups and the associated number of parent-child relations between them.

For existing connectors, modify the group schema as follows:

1. Use the following SailPoint REST API to add the attribute definition for the hierarchy attribute ( `memberOf`) along with the `hierarchyAttribute` property on the group schema.

   `PATCH https://{orgName}.api.identitynow.com/v3/sources/{source ID}/schemas/{group schema ID}`

   In the body of the PATCH, use the form-data as follows:

   ```text
   [
     {
       "op": "add",
       "path": "/hierarchyAttribute",
       "value": "memberOf"
     },
     {
       "op": "add",
       "path": "/attributes/-",
       "value": {
         "name": "memberOf",
         "type": "STRING",
         "schema": null,
         "description": "Group Membership",
         "isMulti": true,
         "isEntitlement": false,
         "isGroup": false
       }
     }
   ]
   ```

## Microsoft Entra Role Management

Microsoft Entra ID roles allow you to grant granular permissions to your admins, abiding by the principle of least privilege. Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, and applications.

Microsoft Entra supports two types of roles definitions:

- **Built-in roles** - Built-in roles are out of box roles that have a fixed set of permissions. These role definitions cannot be modified.
- **Custom roles** - To round off the edges and meet your sophisticated requirements, Microsoft Entra also supports custom roles.

Microsoft Entra roles object type supports the following operations:

- Aggregation of built-in and custom roles as separate group object
- Aggregation of user membership to roles during account aggregation
- Add / Remove built-in and custom roles to Microsoft Entra users

### Administrator Permissions

<table class="span-table"> <tr> <td>Permission</td> <td>Permission Type</td> <td>Purpose</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td colspan="1" rowspan="4">Application</td> <td>Add/Remove Roles for Accounts</td> </tr> <tr> <td>RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All</td> <td>Aggregate Roles</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Provisioning</td> </tr> <tr> <td>RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All</td> <td>Read Roles entitlement for Accounts</td> </tr> </table>

### Supported Schema Attributes

To manage the Microsoft Entra role objects, ensure that the attributes present in [Roles Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#roles>) are present in the group schema.

## Administrative Units

An administrative unit is a Microsoft Entra resource that serves as a container for other Microsoft Entra resources. It can contain only users, groups, or devices. A user can be a member of multiple administrative units.

### Supported Operations

This feature supports the following operations:

- Manage administrative units as entitlements.
- Create a user with a single or multiple administrative units.
- Add/Remove administrative units from users.
- Delete administrative units from users.

### Administrator Permissions

To fetch administrative units details, the following API permissions must be assigned:

| Type | Permission | Purpose |
| --- | --- | --- |
| Application | AdministrativeUnit.Read.All | Aggregate Administrative Units |
| Application | AdministrativeUnit.ReadWrite.All | Add Users to Administrative Units |
| Application | AdministrativeUnit.ReadWrite.All | Delete Users from Administrative Units |

### Supported Schema Attributes

To manage the administrative units, ensure administrative units attributes are present in the group schema. For more information, refer to [Administrative Units Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/directory_attributes.html#administrative-units-attributes>).

### Configure Administrative Unit

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/admin_units.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/admin_units.png>)

1. Go to **Feature Management**.
2. Select **Manage Administrative Units** to manage administrative units.

## Access Package Management

An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization.

Microsoft Entra ID access package management can help you manage access to Groups &amp; Teams, Applications, and SharePoint Online sites as a bundle.

> [!IMPORTANT]
>
> To use entitlement management and assign users to access packages, you must have one of the following licenses:
>
> - Microsoft Entra ID P2 or Microsoft Entra ID Governance
> - Enterprise Mobility + Security (EMS) E5 license
>
> For more information, refer to [Access Package in Entitlement Management](<https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-reprocess-access-package-assignments>).

The following operations are supported for the Microsoft Entra ID access packages object type:

- Aggregation of custom access package objects (a combination of access package and policy) as a separate group type.
- Aggregation of user membership to access packages during account aggregation.
- Add and Remove access packages entitlements to users.

### Administrator Permissions

| Purpose | Permission Type | Permissions |
| --- | --- | --- |
| Aggregate Access Packages | Application | EntitlementManagement.Read.All |
| Read Access Packages entitlements for Accounts | Application |  |
| Add and Remove Access Packages for Accounts | Application | EntitlementManagement.ReadWrite.All |

For more information on the required permissions, refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/prerequisites.html#required-permissions>).

### Supported Schema Attributes

To manage the Microsoft Entra ID access package objects, ensure that the attributes in [Access Package Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/schema/index.html#access-package-attributes>) are present in the group schema.

To aggregate access packages assigned to the user during account aggregation, ensure the `accessPackages` attribute is present in account schema. This attribute lists the access packages assigned to the user.

> [!NOTE]
>
> The Microsoft Entra ID connector provisions `accessPackage` entitlements only through admin context. Therefore, the approval settings configured in the assignment policy does not get triggered.

### Configure Access Packages in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/access_package_management.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/img/access_package_management.png>)

1. Go to Feature Management.
2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off.
3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal.
4. Select **Save**.

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).