Azure AD connector Accounts Aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Experts,

We are trying to aggregate extensionAttribute14 from Azure AD by setting up the employee number into it.
We have added extensionAttribute14 in Account schema of AAD connector. Also ensured in AAD portal account’s extensionAttribute14 value is set to employee number.
Ran the aggregation in IDN portal, but unable to see extensionAttribute14 value.

Any suggestions here, does AAD connector supports aggregation of extensionAttribute14?

We are successfully able to aggregate extensionAttribute14 value for AD accounts but not happening with AAD accounts.

Any help or suggestions are much appreciated.

Cheers,
SKH

2

Its likely the name is different than you expect. (The extension attributes get prefixed with more stuff when pushed into AAD).

There are a few ways to see this.

  • Try making a dynamic group using that attribute. I believe the true name of the attribute is seen in the dynamic group rules editor.

  • Try using graph explorer (Graph Explorer | Try Microsoft Graph APIs - Microsoft Graph) against the beta endpoint after being signed in with an account from your tenant (you may need to also consent). The graph explorer is a good tool to easily look at graph calls. (which is how this connector is communicating with Azure)

3

@ccarlton Thanks for your response.

As per your suggestion we have validated extensionAttribute14 format in AAD by using graph API explorer. Yes, the format was different than what I was referring to (extensionAttribute14).

It looks like below.

ExtensionAttribute14

extensionAttribute
extensionAttribute1793×184 114 KB

I have added this ExtensionAttribute14 into AAD Account Schema and ran the aggregation, but still, I am unable to bring value to this ExtensionAttribute14 attribute.

Any further suggestions please!?

Cheers,
Sudha

4

make sure you are using the beta graph endpoint in the AAD Connector Config
(the 1.0 endpoint does NOT return all of the data… only the beta endpoint does).

Also if you look at the JSON resonse from graph explorer,
(GET Beta https://graph.microsoft.com/beta/users/[email protected])

it looks like these attributes are part of a parent map? that may need to be reflected in the AAD schema in sailpoint?

“onPremisesExtensionAttributes”: {
“extensionAttribute1”: null,
“extensionAttribute2”: null,
“extensionAttribute3”: “Technology”,
“extensionAttribute4”: “2020-12-29”,
“extensionAttribute5”: null,
“extensionAttribute6”: null,
“extensionAttribute7”: "null,
“extensionAttribute8”: null,
“extensionAttribute9”: “CU”,
“extensionAttribute10”: null,
“extensionAttribute11”: null,
“extensionAttribute12”: “O365”,
“extensionAttribute13”: null,
“extensionAttribute14”: null,
“extensionAttribute15”: “IDN”
},

5

Hi @shucch01,

We are facing the same issue as well, were you able to get it aggregated.

6

@rashmi_sajjan_t

We got the response from SailPoint connector team on this, currently AAD connector does not yet support fetching such embedded attributes. so, the extension Attributes synced from AD to Azure, cannot not be aggregated with value by adding them to schema.
looks like there is an enhancement request placed for this.

Cheers,
Sudha