My requirement is to only aggregate accounts that are members of 'Test App" Azure AD group. For this, I added the following to the app configuration:
But it does not work, aggregation brings in all accounts and their membership show all groups that they are member of.
Hi @waqarali1 - could you share your configuration?
Test App.xml (2.1 KB)
See the uploaded application object xml. It’s pretty straightforward ‘Azure Active Directory’ application template, the only exception is groupMembershipFilters, which specified a membership filter on ‘Test App’ group.
Expected outcome is, account aggregation should bring in only accounts which are members of the ‘Test App’ Azure AD group. Currently it is bringing in everything, it seems that adding the filter has no effect.
groupMembershipFilters is not a valid Azure AD attribute - works for Active Directory and LDAP
Pretty sure you have to be on minimum one of these versions: (8.5, 8.4p3 and 8.3p5) groupMembershipFilters is a valid attribute in 8.5 at least, we use it for our AAD/Entra Connector. What version are you on @waqarali1?
We are on 8.4p3. Is it working for you? What is your use case, or tell what did you put in the groupMembershipFilters and what outcome are you getting?
Not, according to the Azure AD connector documentation it should work for Azure:
Aggregation, Filter, and Partitioning Settings
I am looking for someone who was able to use it successfully
That doc is for ISC not IIQ - IIQ doc here also references it, but if I’m understanding your situation, this is not how you would want to approach this given you’re looking to only bring in accounts that are a member of a specific group.
groupMembershipFilters is not the right control for this requirement. It filters which group memberships are read back on each aggregated account, but it does not restrict account aggregation to only users who are members of a specific group.
So in your case, setting it to match “Test App” would limit the group membership data returned per account, but it would not prevent other accounts from being aggregated. That is why you are still seeing all accounts come in.
I understand your point but neither is happening with my configuration. Lets say if jdoe has ‘Test App’, and ‘Hello App’ groups, and msmith has just ‘Hello App’. The configuration should bring in both accounts but only show ‘Test App’ in the membership of jdoe and no group in the membership of msmith. What I’m seeing is that this filter has no impact, it brings in all accounts and all membership (means all groups).
@waqarali1 I am not sure if IIQ support this filter or not. But you can achieve this via Customization rule. You can check if user is not having the mentioned group, then return null. otherwise let it aggregate. At the end of aggregation, you’ll only have user account part of your specific groups only.
Thanks @neel193 Yes I’m aware of this, I was hoping this filter work
Hi,
I was also trying to make the groupMembershipFilters work and discovered a bug where the filter is not evaluated when the Role schema is not part of your application definition and/or the ‘roles’ attribute is not in the account schema. Looking at your app xml, it looks like this is also the case for you.
Please take a look at the full description I posted in the bugs section and see if you can make it work:
EntraID Group Membership Filter not evaluated - Feedback / Bugs - SailPoint Developer Community
Kind regards,
Pieter de Loos.
