Azure AD Connector - Group Filtering

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.5

Please share any images or screenshots, if relevant.

image
image697×347 6.91 KB

Share all details about your problem, including any error messages you may have received.

Hi Sailors,

I have a use case related to Azure AD application onboarding.

Currently, I have an Azure AD application configured in IIQ that aggregates all Azure AD groups from the tenant. I would like to create a separate Azure AD application in IIQ for a specific business application and aggregate only the Azure AD groups associated with that application.

To achieve this, I cloned the existing Azure AD application and configured a Group Filter in the application configuration. The Test Connection was successful.

However, when I ran Group Aggregation, IIQ still aggregated all groups from the tenant instead of only the groups matching the configured filter.

Has anyone encountered this issue before?

  • Does the Azure AD connector support Group Filters during Group Aggregation?
  • Are there any additional configurations required for the filter to take effect?
  • Is there an alternative approach to aggregate only application-specific groups?
2

@Richie1997 When you cloned the app from the existing app, possibly some references are also cloned and causing this issue.

Could you please review your app xml once? and are you running full aggregation or delta aggregation?Can you try running full aggregation.

3

@neel193 Yes i reviewed the xml page i could able to see the filters which i added on UI. I am doing full aggregation only.

4

If your account aggregation scope includes users who are members of groups outside your group filter, the connector will still pull in those groups to resolve membership.

5

Hello Reynold. Yes, IdentityIQ supports Group Filters during account-group aggregation, and your filter is valid:

id eq '5a086180-2dce-4cb2-a24e-b661a39bae85'

This expression does not use one of the advanced operators SailPoint lists, such as NOT, NE, or endsWith, so I would test the Group Aggregation with Advanced Group Filter unchecked.

You have already confirmed that groupFilters is present in the application XML and that you are running a full aggregation, so the next step I would take is to test the connector directly:

connectorDebug <applicationName-or-ID> iterate group -q

The -q flag returns only the count. If it returns 1, run it again without -q and confirm that the returned ResourceObject is the expected group.

If it returns the tenant-wide group count, run it again without -q and collect the connector logs. That result would point to the connector and filter level rather than the aggregation task.

SailPoint documents connectorDebug for troubleshooting aggregation.

The NOT(...) in your User Filter is separate and applies during account aggregation, so I would keep it out of this Group Aggregation test.

For several fixed application groups, you can combine them with or:

id eq '<group-id-1>' or id eq '<group-id-2>'