Azure AD connector Unable to fetch description attribute issue

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

IdentityIQ 8.4

Please share any images or screenshots, if relevant.

image
image760×721 20.2 KB

Share all details about your problem, including any error messages you may have received.

Hi Experts,

We are using Azure AD OOTB connector in our environment. We have noticed that the description attribute for the groups is not populating though it is updated on Azure level. We have updated the locale and also tried by updating the Description attribute in the task. However, the issue persists.

Additionally, we printed the ResourceObject through a rule and noticed that the description attribute is not present in the ResourceObject though it is an default attribute in the schema.

Please suggest how the description attribute can be fetched.

2

@padma_priya We are discussing the same issue in this post: Unable to fetch group descriptions from Azure - #9 by neel193

3

@padma_priya- can you screenshot your Azure group schema and the group aggregation task?

4

Hi Ryan,

Please find attached for the requested.

Azure task
Azure task1611×688 28.3 KB

Azure group schema
Azure group schema1072×832 63.5 KB

5

Thank you Neel, I shall have a look.

6

I have a few questions based on your screenshots. Why is the memberOf attribute type configured as string? Also, what type is it showing in the Entitlement Catalog for this application?

7

This is default schema configuration on the OOTB connector. For groups, memberOf is of type string. In Entitlement catalog, the type is group.

8

@padma_priya - check if your connector enabled “useMSGraphAPI”. if not, try it by enabling it from debug page.

<entry key="useMSGraphAPI"> <value> <Boolean>true</Boolean> </value> </entry>

Note: Found a solution? Help the community by marking the comment as solution.

9

Hi Venkat, it is enabled on the connector.

10

Hi @padma_priya ,

I run it in my local environment, and there is no issue with the group aggregation description. It looks like the rule you wrote might be overriding the description value. It would be better to set the description in the rule, I think it will be more stable. if not works please share rule

Below is the I test in my local environment.

image
image1867×728 44.8 KB

with description group:

image
image993×622 32.8 KB

Thanks,

PVR.

11

Hi @padma_priya ,

The description attribute will only populate if the Azure AD API returns it during group aggregation. Verify that the attribute exists in the group schema, ensure Azure Graph API returns the description field, and run a full group aggregation after updating the schema.

12

Hi,

I have enabled connector logs and checked the URL for Graph looks like it is not fetching description.

image

Kindly suggest.

13

yes,since iiq can only ingest the data provided by the source system, we recommend verifying the Azure configuration (such as Graph API permissions and app settings). Once the groups are returned correctly from Azure, iiq should be able to aggregate them successfully.

14

Hi All,

Thank you for the support.

We have raised a ticket with SailPoint and got to know that it is a known issue in 8.4. The fix is available on the patches (8.4p2)