During the group aggregation refresh rule on the EntraID connector, I am attempting to retrieve the “owners” attribute from the accountGroup and then match it to an existing Link on the application. Then I will set the owner of the accountGroup to the identity found from the link.
The issue is that the “owners” field is a string list of userPrincipalNames. I’m unable to perform a search that quickly grabs these Links within the aggregation refresh rule.
What is the common solution for this problem? Should I create a Link Extended Attribute to search easily? Is there a way to retrieve the owner’s objectId from the ResourceObject - and then perform a search on nativeIdentity?
How do you have the identity and display attributes configured in the Entra connector?
How are you trying to search? Can you share your QueryOptions and Filter parameters or the source of the refresh rule?
If you’re not using userPrincipalName as the display attribute for the Entra connector, can you do so? This would allow you to search for the Link you want by displayName. The next best option would probably be to add an account attribute to make userPrincipalName searchable.
Hello Brandon. Your owners values are UPNs, but Entra uses objectId as the native identity, so a UPN will not match Link.nativeIdentity. I would resolve each UPN to its Entra Link inside the Group Aggregation Refresh Rule, which is the documented place to set the group owner.
If your Entra Link already carries the UPN in displayName, query that directly. Otherwise create a searchable Account Mapping such as entraUPN sourced from userPrincipalName. Use a different name than userPrincipalName, since an extended attribute cannot reuse a name already provided by the connector schema. For each UPN in the list:
QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.and(
Filter.eq("application.name", "<Entra app>"),
Filter.eq("displayName", upn) // or entraUPN if you use the mapping
));
Iterator it = context.search(Link.class, qo);
try {
if (it.hasNext()) {
Identity ownerIdentity = ((Link) it.next()).getIdentity();
if (ownerIdentity != null) {
accountGroup.setOwner(ownerIdentity);
}
}
} finally {
sailpoint.tools.Util.flushIterator(it);
}
End the rule with return accountGroup;.
A few things to keep in mind:
Run account aggregation and correlation first, so the Links exist and are correlated when this rule runs.
A managed attribute has a single owner while Entra can return multiple, so decide which one wins, and what to do when none correlate (the existing owner stays unchanged otherwise).
If you use an advanced group filter (endsWith, NOT, NE), the connector requires owners to be removed from the group schema, so it would not be available here.