Query on Group Filters in Azure AD

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

IdentityIQ 8.3p2

Hello All,

We need to aggregate a single group from Azure AD to SailPoint. As we are unable to test it in non prod we need suggestions to confirm if this filter will work to aggregate single group.

2

image

3

Hi @DharshiniB ,

The filter below only aggregates the specified group name.

<entry key="groupFilters" value="displayName eq  &apos;Test-Group&apos;"/>

<entry key="groupFilters" value="displayName eq  'Test-Group'"/>
4

Hi @Arun-Kumar ,
you mean it will only aggregate that single group?

5

Hi @DharshiniB ,

yes, Only groups with the display name “Test-Group” will be included in the aggregation process. The filter narrows down the scope of the aggregation to include only the group(s) with the specific display name you provided.

1 Like
6

@Arun-Kumar Thank you for the response

7

Hi @Arun-Kumar ,

I tried with the same filter, but it seems like its getting several groups.

image
image1075Ă—816 22.1 KB

8

Hi @DharshiniB

Can you please try with below line?

image

If that doesn’t work, try with

image

Replace TEST with actual group display name.

9

Hi Arpitha, Sorry i think the script is not coming up. can u insert it as picture.

10

@DharshiniB edited previous reply. Please check

1 Like
12

Hi @DharshiniB ,

In the group aggregation, choose “Object types” as the group. This will ensure that only the group is scanned.

image
image1447Ă—579 21.7 KB

Try with this filter and object type as group in group aggregation.

<entry key="groupFilters" value="displayName eq  &apos;Test-Group&apos;"/>
13

@DharshiniB Has it worked ?

14

Hi @Arpitha1 Actually i didn’t got any error, but group was also not coming up in sailpoint after aggregation.

15

Hi All,
It seems like because not having aggregate all groups parameter present in application xml, we couldn’t able to see the group in SailPoint. is this correct way of adding this?

image
image391Ă—142 3.31 KB

16

Hi @DharshiniB ,

The group aggregation task, by default, aggregates all object types configured within the application.
Could you please check the application schema to confirm whether the object type “group” is configured?
If the schema (Object Type: group) is configured, enable the “Filter Object Type” option in the group aggregation task, select “Group,” and then run the task.

image
image690Ă—276 9.2 KB

17

Hi @Arun-Kumar ,
Yeah we have object type group configured in our schema. i have tried selecting this option in task. but still group was not coming up in SailPoint. I have attached screenshot of group aggregation task, its just scanning couldn’t able to see any account get updated.

image
image1168Ă—208 5.56 KB

18

Hi @DharshiniB ,

Ensure the correct permissions(Group.Read.All) are granted to read the group.

image
image1147Ă—105 4.05 KB

please refer this.
if possible, please share the app xml file.

19

Hi @Arun-Kumar ,
Yeah we have assigned those permissions, I’m attaching the application xml.
Application-AzureAD.xml (261.8 KB)

20

Hi @DharshiniB ,

I am successfully aggregating the groups using the attached application XML. I suspect there may be a permission issue. Could you please verify the permissions again?

Regards,
Arun

21

Hi @Arun-Kumar ,
okay, we are checking with our Azure Team on this.
One more query, do you have any idea about what attribute we need to set for creating custom domain in mail address instead of onmicrosoft.com.