Entra ID User Filter "endsWith"

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,

I am trying to set up an Entra ID source that will filter out accounts from a particular on premise OU. I am trying to do this using the User Filter settings in the source. I am trying to use endsWith(onPremisesDistinguishedName,‘OU=QA Test Accounts,OU=Employees,OU=All Users,DC=test,DC=domain,DC=com’)

I use the above for the source to just return users under the OU QA test Accounts. But I am getting an error everytime I run the aggregation.

image

I tried adding the ConsistencyLevel: eventual in the search string but it then gives me this error:

image

Appreciate if you can assist me on this one. Thanks!

2

Try removing the Manager attribute from the schema and retrying the aggregation.

3

removed it. now giving me this error

image

4

Hi @renzambos,

Add $count=true to the query parameters and try.

Regards,
Arun

5

error still…

image

6

Hi,

Did you add the below entry to source XML?

key: supportsAdvancedAccountFilter

value: true

7

In the Source settings > Aggregation > User Filters, I did set this:

image

8

If you are using Advanced filters, you must add the entry to source XML using API.

9

its already set as true…

image

11

Hi @renzambos

Just need one clarification. Is your User Filters valid like this?: endsWith(onPremisesDistinguishedName,‘OU=QA Test Accounts,OU=Employees,OU=All Users,DC=test,DC=domain,DC=com’) or you have added something to it? Wanted to know what caused the invalid filter clause.

As you have already set supportsAdvancedAccountFilter to true in the source, this will automatically add the ConsistencyLevel:eventual in the header and $count=true in query params. Hope these are not explicitly mentioned in the filter that might have caused the invalid filter clause error.

Thanks!

1 Like
12

Hi @renzambos,

See if you can print the filter in the logs then you will get to see what is the filter value.

Refer the Microsoft graph queries to understand if it align in the below way or not.

13

Hi @renzambos,

I am sure this has already been eliminated but no harm verifying again - AAD service account has “User.Read.All” rights.

Another thing you can try is in the request URL (not the filter), please add $select=* and use the same filter value.

HTH

14

Update: was able to resolve this using the filterString from this article:

IdentityNow Account Filtering during Account Aggregation - Compass (sailpoint.com)

Thanks everyone for your responses!

1 Like
15

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.