accountPropertyFilter in transform for Azure group

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I am looking to create a transform, when the user is a member of the Azure AD group. I used the accountPropertyFilter option in the account attribute transform, and it seems not to be working.

What should be accountPropertyFilter to be used to get user’s group in Azure AD.

{
    "name": "Member of specified AD Group",
    "type": "static",
    "attributes": {
        "groupMember": {
            "attributes": {
                "ignoreErrors": "true",
                "values": [
                    {
                        "attributes": {
                            "sourceName": "Azure Active Directory",
                            "attributeName": "sAMAccountName",
                            "accountPropertyFilter": "(groups.containsAll({\"Test-Group\"}))"
                        },
                        "type": "accountAttribute"
                    },
                    "NONE"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($groupMember == \"NONE\")NOT IN GROUP#{else}IN GROUP#end"
    },
    "internal": false
}
2

Hi @Manju22,

Try changing the attributeName as userPrincipalName instead of sAMAccountName

Also, try giving the AD group value instead of the displayname.

The transform would look like this

{
    "name": "Member of specified AD Group",
    "type": "static",
    "attributes": {
        "groupMember": {
            "attributes": {
                "ignoreErrors": "true",
                "values": [
                    {
                        "attributes": {
                            "sourceName": "Azure_Source",
                            "attributeName": "userPrincipalName",
                            "accountPropertyFilter": "(groups.containsAll({\"8a999e02-5861-4bce-b1a4-bda480e95765\"}))"
                        },
                        "type": "accountAttribute"
                    },
                    "NONE"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($groupMember == \"NONE\")NOT IN GROUP#{else}IN GROUP#end"
    },
    "internal": false
}
1 Like
3

Thanks you @jesvin90 . It works :slight_smile:

1 Like