Error in Provisioning Entra ID Group

IdentityIQ (IIQ) IIQ Discussion and Questions
1

We are trying to create a Entra ID group from SailPoint with members, the group is getting provisioned successfully but few attributes are not correctly set on the group. We are trying to create a Teams Enabled group with members in it. When SailPoint is trying to set the Teams Enabled Flag to True , Entra gives the below Error:

    <ProvisioningResult status="failed">
      <Errors>
        <Message key="Team activation for group failed : Team owner not found for group <Group ID>." type="Error"/>
      </Errors>
    </ProvisioningResult>
    <Value>
      <Boolean>true</Boolean>
    </Value>

While Setting the owners in the same provisioning plan gives the below Error:
AttributeRequest name=“owners” op=“Add” — Add/Remove owners failed for group id :<Group_D>Response Code - 404 Error - Resource '<Owner_ID>' does not exist or one of its queried reference-property objects are not present.

The Owners being passed are the UPN values of the Entra Account which exists on the Entra Side.

Any help on resolving this would be highly appreciated.

3

Thanks @kannan_sb85 for your response.

I did try passing the object id of the account which i am setting as the owner of the group. However, there is an inconsistency behaviour which i am observing. The Group got provisioned on some cases with the owners assigned and teams enabled check box marked as true. But on large cases, same error was observed even when passing the object-id of the account.

If there any dependency of the id’s which i am missing.

Regards,

Pitam

4

@dutta_pitam please try with, this change should be in your application.

<entry key="createGroupTimelag" value = "60"/> // seconds in azure connector or may be use 120

looks like you have some lag time.

5

Thanks @pravin_ranjan for your response.

I did add the key in the App xml and post that tried to provision the group as well. Still the same behaviour is being observed and the with the same error which is being depicted above.

Regards,

Pitam

6

@dutta_pitam Are you creating group and provisioning users in the same plan? or in objectRequest are you passing user details? If so, could you please split it. First create the group and then try to provision the users.

Please share your rule which you are using for review.

7

@neel193 : Thanks for your response. That is exactly what i tried. I split out the operation in two halves.

First half : This is the Provisioning Plan to create the M365 Group in Azure without Setting the Owners and Teams Enabled Flag.

Result : The Group being created successfully.

Second Half: Apply Modify Operation on the Same group , this time with Owners being passed as an attribute request as well as Teams Enabled being set as true.

Result: Owners and Teams enabled are successfully applied on the group