How can I sync an Identity's manager attribute back to Active Directory?

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi All,

We use Paycom as our Identity Profile and we want to be able to have sailpoint update the manager field in Active Directory whenever we have a new hire, change of manager etc.

Currently in our mappings we have this from the Paycom Identity Profile:

image
image2237×227 5.91 KB

image
image2230×428 17.2 KB

In the Active Directory Source this is what we have in the Create Account

image
image1012×231 7.46 KB

If i go to attribute Sync the manager field does not pop up. I know there is a step I am missing to be able to have this sync properly onto AD but cannot figure it out, any assistance would be greatly appreciated.

2

Hello @ReyG

This post from one of Sailpoint Team member : Active Directory: Attribute Sync for the Manager Attribute - Identity Security Cloud (ISC) / ISC Community Knowledge Base - SailPoint Developer Community

Explain how to sync the manager in AD, like you should :

  • Step 1 : create an Identity Attribute in your Identity Profile called distingushed Name which retrieve the DIstinguished name from AD for all identities :

    image
    image1788×294 21.6 KB

  • Step 2 : create a second Identity attribute called for example “AD Manager Distingushed Name” which will copy each Identity Manager AD DN from the first Identity Attribute :

image
image1788×294 23.4 KB

This second Identity Attribute should be associated with the following transform to add in your tenant :

{
    "attributes": {
        "attributeName": "distinguishedName",
        "name": "Cloud Services Deployment Utility",
        "operation": "getReferenceIdentityAttribute",
        "uid": "manager"
    },
    "name": "Determine Manager DN",
    "type": "rule"
}
  • Step 3 : Ran aggregations, process Identity profile to populate this new attributes and check that the manager DN is copied in the new Attribute.
  • Step 4: And then in your Active Directory source you can sync the manager attribute with your new identity attribute “AD Manager Distingushed Name”

image
image2900×334 27.1 KB

3

Agreed- these are the same steps we followed to to sync

4

Hey Rey,
@baoussounda’s steps are the right fix.
The reason manager does not show up in Attribute Sync is that the out-of-box manager generator can work during account creation, but it is not an identity attribute the sync engine can track. Attribute Sync needs the AD manager field mapped from an Identity Attribute in the Create Account profile.

Also, AD expects the manager value as the manager account’s distinguishedName, not the Paycom manager value directly. Before enabling sync, I would confirm these two things:

  1. The identity has a correlated manager.

  2. That manager has a correlated AD account with a populated distinguishedName. If either side is missing, the manager DN attribute will be blank and ISC will have nothing valid to write back to AD. After setting it up, refresh/process the identities and spot-check one test identity to make sure the custom AD Manager DN identity attribute is actually populated before turning sync on.

7

Thank you all! I got it to work