Removing Azure AD Entitlements using Services Standard Before provisioning rule

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello,

We are trying to remove the shared mailbox (Type: Entitlement) using Services Standard Before provisioning rule. We aggregated this as an entitlement from Azure AD source. So far, we have tried:

                       {
                            "Action": "RemoveEntitlements",
                            "Attribute": "Entitlement",
                            "Value": null
                        }

And,

                        {
                            "Action": "RemoveEntitlements",
                            "Attribute": "Entitlements",
                            "Value": null
                        }

And,

                        {
                            "Action": "RemoveEntitlements",
                            "Attribute": "groups",
                            "Value": null
                        },

We even noticed that this doesn’t come up in CCG logs (maybe because its an entitlement). We were able to remove this using certification but not using Before provisioning rule. Just FYI, we want to remove this entitlement upon LCS changes.
Any help regarding this is much appreciated. Thanks!

1 Like
2

Can you please share the entire eventConfiguration json that you have added to the cloudServicesIDNSetup

3

Here it is,

                 "cloudServicesIDNSetup": {
            "eventConfigurations": [                
                {
                    "eventActions": [
                        {
                            "Action": "RemoveEntitlements",
                            "Attribute": "Entitlement",
                            "Value": null
                        },
                        {
                            "Action": "RemoveEntitlements",
                            "Attribute": "groups",
                            "Value": null
                        }
                    ],
                    "Identity Attribute Triggers": [
                        {
                            "Attribute": "cloudLifecycleState",
                            "Value": "inactive",
                            "Operation": "eq"
                        }
                    ],
                    "Operation": "Disable"
                }
            ]
        },

Just FYI, I have tried with both “Attribute”: “Entitlement” and “Attribute”: “groups” together and separately.

Thanks!

4

Here is a screenshot from the READ ME file

image
image1354Ă—468 34.5 KB

Are Entitlements and groups the attribute names that you want to remove?

1 Like
5

This makes sense. The attribute name is sharedMailbox, I will try this and let you know. Thanks!

6

SSI BeforeProvisioning Rule - README.pdf (110.2 KB)

File for your future reference :slight_smile:

2 Likes
7

It worked, thanks for your help! :blush:

2 Likes
8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.