Hello Team,
In entra account created Azure team confirms, All attributes are populating. But Sailpoint not showing up in the source accounts. I checked provisioning plan its creating the accounts adding all mandatory attributes but while running the aggregation account not showed up in Sailpoint. Any thoughts please suggest.
Your filter isn’t syntactically correct, you need to bracket the NOT clauses.
Try
(startsWith(userPrincipalName,‘ADM’) AND NOT(startsWith(userPrincipalName,‘ADM.’)) …etc.
Also alway good to check filter syntax using a Graph API explorer.
To create a privileged account,. Please contact your Entra team and ask them to create the appropriate privileged group.
Also, I noticed that the account in the target system does not have the entitlement that was assigned through SailPoint. Once the Entra team creates the privileged group, you can use that entitlement during the account creation process.
Hello,
Please check this extension this will help the debug:
Hello Ravi,
The part I would check here is the third filter clause: NOT startsWith(userPrincipalName,'admin')
The UPN for this account is: ADMIndrajithSaseendran1@ChubbGlobal.onmicrosoft.com
The first five characters are ADMIn, which effectively forms admin when compared without case sensitivity. So if the Entra/Graph filter evaluation treats startsWith(userPrincipalName,'admin') as case-insensitive for this property, then this account would match the exclusion condition, and the NOT would prevent it from being aggregated into ISC.
Something like ADMRavikumar or ADMJohnSmith doesn’t match admin regardless of the case, but ADMIndrajith does. And if all other ADM accounts are getting created and aggregated without any issue, and only this one is being skipped, that pattern lines up with this being the cause.
To confirm, I would suggest testing the filter directly in Graph Explorer:
GET https://graph.microsoft.com/v1.0/users?$filter=startswith(userPrincipalName,'admin')&$select=userPrincipalName
If ADMIndrajithSaseendran1@ChubbGlobal.onmicrosoft.com shows up in those results, which confirms startsWith is treating the comparison as case-insensitive. Then the aggregation filter is the root cause.
Hi @punna0001 Thank you for your response, Can you please suggest the correct filter.
Hi Harish, I removed NOT startsWith(userPrincipalName,‘admin’) this condition in the filter, I am able to aggregate that filter. However few more accounts also aggregated that starts with admin123, admin_tets also. How to exclude that UPN starts with admin accounts.
Hi @ravikumar7284 ,
The filter in aggregation, how it will work is, whatever accounts satisfying this criteria they will be filtered out, that means they will not come to Sailpoint, so according to your filter, basically you are filtering out users whose userprincipalname starts with ADM, I suspect that filter is the reason you are not able to aggregate that account to SailPoint.
Hey Ravi, glad we were able to narrow down the root cause here. It’s the case-insensitive behavior of startsWith in the Microsoft Graph API.
At 5 characters, ADMIn and admin are identical to the API, so it might not be possible to write a single startsWith clause that blocks one and allows the other. That is why your NOT startsWith(userPrincipalName,'admin') clause was unintentionally excluding Indrajith’s account.
That said, maybe someone else in the community has dealt with a similar situation and can suggest a cleaner approach. I will keep looking into this as well and will update here if I find anything better.
Hi Harish, Thank you for your time, Please let me know if you find any solution for this.
Hi @ravikumar7284 If I read your requirement correctly, the first thing to say, is that your Entra admins are using a sub-optimal naming convention for UPN and that should be changed.
However, looking at your data, perhaps the Display Name offers what you are after?
ie
startswith(displayName,'ADM ')
Hi Jerry,
I tried the following filter:
(startsWith(displayName,‘ADM’)
AND NOT startsWith(displayName,‘ADM.’)
AND NOT startsWith(displayName,‘admin’))
ADMIndrajith was successfully aggregated into ISC. Accounts such as admin123 and admin_test were excluded from aggregation.
Thank you for your help.
Hi @ravikumar7284 If you include the space after ADM in the filter, as above, then you wont require the subsequent NOT clauses
Hi Jeremy,
Yes that’'s correct. Thank you for your time.
Hi @ravikumar7284 If my post provided the solution, can you please mark it as such?
Hi Jeremy, Yes your post solved my issue, I marked as solution. Thanks