Azure Active Directory source - Advanced user filter

[jrossicare (Jason Ross)]

Hi

Has anyone used the Advanced User Filter for Azure Active Directory source?

Trying it with endsWith(userPrincipalName,'mydomain.com') but getting the error

Exception occurred in Iterate Objects. Error message - sailpoint.connector.ConnectorException: Exception occurred in processReadRequest. Error - Response Code - 400 Error - 400 Operator 'endsWith' is not supported because the 'ConsistencyLevel:eventual' header is missing. Refer to https://aka.ms/graph-docs/advanced-queries for more information 

I have followed the documentation, and everything seems OK.
I assume that missing header is something that ISC supplies automatically, so not sure why ISC is not setting it.

Thanks in advance

[Arun-Kumar]

Hi @jrossicare,

Did you set supportsAdvancedAccountFilter to true in the source?

Regards,
Arun

[jrossicare (Jason Ross)]

Hi Arun,
Yes, I verified that was set to true.

[varshini303 (VARSHINI SANKAR)]

Hi @jrossicare,

I believe that you have removed the manager attribute from account schema and owners attribute from group schema. Did you replicate this issue in Postman by adding the necessary header and param to see if you get the same error? If you don’t get any issue there, need to check why SailPoint is not automatically adding the ConsistencyLevel header. Also, try adding useMSGraphAPI: true in the source.

Azure Active Directory Connector, User filter

Hi @mrioux - Microsoft recommends the use of Microsoft Graph API instead of the Azure Active Directory Graph API. Microsoft has stopped addition of new feature in the Azure Active Directory API. The Azure Active Directory connector has been enhanced to use the Microsoft Graph API completely. So the action item for you would be check if you have enabled the use of Microsoft Graph API for all connector operations. For example, entry key="useMSGraphAPI" value="true"

[MeKhalbi (Mehdi Khalbi)]

I am using an advanced filter (NOT) and I selected the advanced filter button on the source config and added the input " supportsAdvancedAccountFilter" to the connectorAttributes as well as removing the “manager” attribute from the account schema as mentioned above. The source aggregation worked properly for me then.

[jrossicare (Jason Ross)]

Hi,

Thank you so much for the reply. Once I removed manager from the account schema, the aggregation was successful.

I will make a recommendation to update the documentation, to clearly state this.

Thanks again