Hi everyone,
we’re working on a SailPoint IdentityNow deployment where we integrate a Microsoft Entra ID tenant through the source:
Source name: acme - Sandbox - Microsoft Entra ID
On this source we’ve configured group scoping using groupFilters and groupMembershipFilters so that we only aggregate a subset of Entra groups, based on a custom extension attribute:
groupFilters: (ext0c65sc8o_igaEntitlement/igaEntitlement eq true)
groupMembershipFilters: (ext0c65sc8o_igaEntitlement/igaEntitlement eq true)
This means that only groups where the extension attribute ext0c65sc8o_igaEntitlement/igaEntitlement is true are brought into IdentityNow as entitlements.
We also have a Native Change Detection workflow:
Workflow name: Acme - Native Change Detection - Notifica modifica gruppi (Acme - Sandbox - Microsoft Entra ID)
Trigger: idn:native-change-account-updated
The trigger currently uses a filter.$ expression that:
-
limits the events to a specific source id,
-
checks for ENTITLEMENTS_ADDED / ENTITLEMENTS_REMOVED on the groups attribute, and
-
finally filters by group name using a regex over a list of prefixes
This works, but it’s not ideal: the list of prefixes is hard-coded in the workflow, whereas the “real” functional rule that should define the interesting groups is the Entra extension attribute (igaEntitlement == true) which we are already using in the connector’s groupFilters.
What I would like to do is to:
-
stop relying on regex over group names in the workflow, and
-
instead reuse the same condition we have in the connector: (ext0c65sc8o_igaEntitlement/igaEntitlement eq true)
My questions for the community:
-
Has anyone successfully referenced Microsoft Entra extension attributes for groups within the
idn:native-change-account-updatedevent payload and then used them in the workflowfilter.$JSONPath? -
Do the Native Change Detection events for group membership changes actually contain the extension attribute
ext0c65sc8o_igaEntitlement/igaEntitlement(or the mapped entitlement attribute on the group object) so that we can filter on it in the workflow? -
Is there any supported way to “reuse” or align the source’s
groupFilters/groupMembershipFilterswith the workflow trigger filter, so we don’t end up maintaining two sets of scoping logic (connector filter vs. regex on names)? -
If this is not currently possible, what patterns / best practices are you using to keep:
-
the set of groups that are aggregated, and
-
the set of group changes that fire NCD workflows
in sync over time?
-
I’m basically trying to understand whether I’m missing a cleaner way to do this with extension attributes, or if relying on naming conventions and regex in the workflow filter is still the recommended approach.
Any insights, examples, or confirmation from your own implementations would be really appreciated.
Thanks!
Please find below the Acme - Sandbox - Microsoft Entra ID json:
{
"description": "Sistema target integrazione Microsoft Entra ID acme",
"owner": {
"type": "IDENTITY",
"id": "48b91e90b85e4e85bf88574c6d16f051",
"name": "SailPoint Services"
},
"cluster": {
"type": "CLUSTER",
"id": "5851f45690f244c8b6d31d6965ba62d7",
"name": "sp_connect_proxy_cluster"
},
"accountCorrelationConfig": {
"type": "ACCOUNT_CORRELATION_CONFIG",
"id": "3d5ad3a2c434447eb7f989a7fa5606ec",
"name": "acme - Sandbox - Microsoft Entra ID [source] Account Correlation"
},
"accountCorrelationRule": null,
"managerCorrelationMapping": null,
"managerCorrelationRule": null,
"beforeProvisioningRule": null,
"schemas": [
{
"configuration": {},
"type": "CONNECTOR_SCHEMA",
"id": "ce4641125b35496ca54ecf52055aba03",
"name": "account"
},
{
"configuration": {},
"type": "CONNECTOR_SCHEMA",
"id": "bcc24df54ccb48e6b8243b772991b67d",
"name": "group"
},
{
"configuration": {},
"type": "CONNECTOR_SCHEMA",
"id": "53b1474a50154e93b6b6cdcd23a68743",
"name": "applicationRole"
}
],
"passwordPolicies": null,
"features": [
"PASSWORD",
"ENABLE",
"AUTHENTICATE",
"AI_AGENT_AGGREGATION",
"APPLICATION_DISCOVERY",
"DELETE",
"PROVISIONING"
],
"type": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
"connector": "Microsoft-Entra",
"connectorClass": "",
"connectorAttributes": {
"healthCheckTimeout": 60,
"channelFilter": null,
"groupsDeltaToken": "jZ7CqON7QqYpS8Zo-RjjKwwcNNlWgs4Nm5Z2o96q6nkWw2cwLjEamJ9L7cmLr_ICc6U88TeIYW44WT_8TWfqCC8MPI6UqmvFdhn6hha7OV10FQ9pg7p7LEMD8iKVasRfrF8V271fg_8X4bMqbAp4vM5ccnqFkyusiDt4bxE3i5HxEwZ17_Q2sZ_CGOJ0KGhPqQabGN7AzO2OGCuR7YLHTPM_AkZteulUPI9hOVYQfBSYIp1-rB5leIodd5nT2koHtHLvet5GsuH0WFSDZwM_TLP7GyffmKKHsCYsoJik_dl8XwJ5fu-ushAVQoHnfjpxWB0kpeliXHdqtH_Ud0R9uQEYA4SRd4BSkZTtDCVlCJUXxI6iGVpIHSJldn98Kmi4kXs45J1wp_m2K6y5SC8Sj0R9EJ7ItRjPLrcSYh3d489qBpLtswYUUz3Vnf1VHrVU_ADRLomQKh3uxtIpreMA_0zpzU5AsGFJRHQHLIC4I_GAabbRNdp29wbhk-YVIn-KRYxeVgrlgkaL7qqsEWxnciJaHsbSKoZbsWjpQpks6a0Y_lrG9gPt9Uj38j9R6NeuISsN_yy_FPRJBbLxKfotH68qOvUEGFdDWu9F0oZBvT9_eFbi8YKmlplczM2B-8F7f861i0E-43NxvOkU_xp95_a9UhgT0sVtOTqHy6mY-Kfpk3OpijSPjQtWZIs0njdFbU2GQ2cbm-HvL3TZKr4wBPA4mLVm2dfBNxzgcmiC2SRny31kl7tgiRKP4BbLcZeBTXMw7gLtQZiRozxNgnlvG8jGaRxmXtWpzYgILk6dDHm3agiCtNJUl6VBUPDtyHmsg46q0op-WZT5utFfp311U1J-hyIqMeCgTyd4QJJlUjuB6z4vXDjE32rwlOkwNDlEkv8IDgTuRqRoxgvWpJR9RyqPIyGhrE3HnvQQdVOJxXgWJQ7nHkrttH84oMmQYvJL2Rj_nG-I3_0BQzr72XWS52ZLCaZ8C_6zAhTdPpfFRfhou2wJHXsu4tBGzHj_ZYRh89id1hrUCtHnh2IGJ_s_ku_JbfRoyE8HyNoQi4DGHtGgsO_ESmuTg95wztuvLa9Q3xDTc5LMXGeMydjLZ8PsI-nmrYmE_leq-S4PI0msOeRSEMcoZ9NZ_N7Tq11vEb1sSJvhQ1jpNLcWsYcyAxnmPpqBILMsLPKi5m4eZLEa0zaGNKTpIp5r5J9xPgu4BK5u2xFxyhHgNvaWBDXgXP0x8lQ-h7txT1w51yWvBLgn-FO7tv2a-MVauUcNjdSQFzuMfqkdXHVbXDRTIhOSsRN9VjUnQIy9PGzi6sDCED_iHOQK3OTEw6tSefPhAZHwT-1JAi9PK9aXrCtNbD2LqOoLaiq_MinH5Tab620tAS8jZU9TPKT3z7_W4X5tC6aDOrE_pNyoncNwFaMItBIjBBBTRCyq0hZC-M6N3_nA4cla011602XloBD0HUaLrrwuYtL4FtozDT9clJTj7u-dptga0eSslnre0N0CqMPMKnWtASdtW65gk9mNiWzOkdLitPWNWek3SbNDQHATTmFmQl3DUQRKebXWcT24Q1K-MT4fr7eenUX1yDah0hSMn-SfSV8b8y5k7SewG-w3wBTahimgRVk7onm2JUS-NgizCutHI5hI-FsMRBHUtZGdwtkpmJWmOKWbaeVImvlJpnCmO21fVTH-wqQhPGLGM0FzZT5naE0OWpMCRaE2zBmz0CJ0J5_wlKL7kmxNl-jcRB18RgFJFRegaqtJG3QxmDC03vHtNugKbD_UaOrKzfXgaJ4tMgezog7fsu1VzWYwJ37BUJ5WSJXHpcYhd3Qt8TAvOPEWya-e8Ih1fLB40zQcKrIEgbz16SMubbS3BuDzRF2jzTY0Np8FL-VxwiEbmWJe5A74ZU0S4pwvAMBKUSLyz-mTFHI1XpWsxSytr4Cxbc57nQmScAY_RWJRWeH1Z19vYp3-FKIh-gN0W-McbHkFdusdPrUJETdRZ4YNox7IjpPVb3uoB45HQ6cJDD9ZcSMazU3OL90BF7O_zBlnrPIzZMmz8c_bIvkqZQuoqXBXT_s4SX2Yel3bTMOB8HSpAQOxsAxUFD3kfZBvJnHm-yurg32XsnxkGfiwiG2YB22_6-n6QkSxYXGPY-0s_POS84jkPYiIzainpGHbbFyk165pHRXxokgN2LFMDd_a0So5HcshiJLJn66e1RIJTIdHZuSN3s6lMKaAhZcBok-PlFnZnfCahggRbo3j3v9MGkUjXEA5NjgoQ-OET_yLvDhdylZfXIDcI_MTrBxR0QeKESelauVwt48acewuEiBtA2i8_WoL6LpgVfKnMl06mGWRKM8xblyGwj_gQOZPpjnKMSiuFyUmGzU9.Eqc5G1cW2Gs5HK0I2z9uWwm7mr4L_cblGlceD5rJoWM",
"idnProxyType": "sp-connect",
"clientCertificate": null,
"clientID": "e276898f-4ad6-418b-b683-440b6fb82672",
"deltaAggregationEnabled": false,
"mailContactFilter": null,
"pageSize": "100",
"manageAdminConsentedPermissions": null,
"checkDeletedDisabled": true,
"connectionType": "direct",
"exoAuthenticationType": null,
"spnAccountFilter": null,
"spConnectorInstanceId": "00fbd0f9-e8ef-4dbb-8d01-3859f7538864",
"enableProvisioningFeature": true,
"appTemplateData": "{\"whiteListedAttributes\":[\"enableProvisioningFeature\"]}",
"userDeltaToken": "",
"clientSecret": "\"}",
"isCaeEnabled": false,
"aggregateHiddenAccessPackages": null,
"spnManageAzureADPIM": null,
"aggregateAllGroups": true,
"aggregateGroupHierarchy": false,
"manageO365Groups": true,
"sourceConnected": true,
"userFilters": null,
"directoryRolesDeltaToken": "",
"enableAdministrativeUnits": false,
"enableManagedIdentityManagement": false,
"private_key": null,
"slpt-source-diagnostics": "{\"connector\":\"Microsoft-Entra\",\"status\":\"SOURCE_STATE_HEALTHY\",\"healthy\":true,\"healthcheckDisabled\":false,\"healthcheckCount\":39,\"lastHealthcheck\":1765267973785,\"statusChanged\":1764634521387}",
"formPath": null,
"refresh_token": null,
"cloudCacheUpdate": 1764951441929,
"privateKeyPassword": null,
"domainName": "contoso.onmicrosoft.com",
"connectorName": "Microsoft Entra",
"spnManageAppRoles": null,
"grantType": "CLIENT_CREDENTIALS",
"since": "2025-12-02T00:15:21.387Z",
"status": "SOURCE_STATE_HEALTHY",
"groupFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
"spConnectorSupportsCustomSchemas": "true",
"supportsAdvancedGroupFilter": true,
"supportsDeltaAgg": "true",
"enableTeamsGovernance": false,
"exchangeUserName": null,
"enablePIM": false,
"enableAccessPackageManagement": false,
"azureRolesFilter": null,
"recommendationStatus": null,
"hasFullAggregationCompleted": true,
"deltaAggregation": [
"std:account:list"
],
"manageAzureServicePrincipalAsAccount": false,
"manageExchangeOnline": false,
"spnManageAzurePIM": null,
"exchangeCertificate": null,
"spnManageGroups": null,
"exchangeUserPassword": null,
"directoryRolesFilter": null,
"spConnectorSpecId": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
"deleteThresholdPercentage": 100,
"supportsStatefulCommands": "true",
"spnManageDirectoryRole": null,
"templateApplication": "Microsoft Entra",
"encrypted": "clientSecret, clientCertificate, privateKeyPassword, private_key, refresh_token, exchangeUserPassword",
"healthy": true,
"spnManageRBACRoles": null,
"supportsAdvancedAccountFilter": false,
"cloudDisplayName": "acme - Sandbox - Microsoft Entra ID",
"groupMembershipFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
"azureADRolesFilter": null,
"exchangeCertificatePassword": null,
"enableSystemAssignedManagedIdentity": false,
"beforeProvisioningRule": null,
"enableMailContactGovernance": null
},
"deleteThreshold": 100,
"authoritative": false,
"healthy": true,
"status": "SOURCE_STATE_HEALTHY",
"since": "2025-12-02T00:15:21.387Z",
"connectorId": "Microsoft-Entra",
"connectorName": "Microsoft Entra",
"connectionType": "direct",
"connectorImplementationId": "Microsoft-Entra",
"managementWorkgroup": null,
"credentialProviderEnabled": false,
"category": null,
"accountsFile": null,
"id": "fdb57b6827e24201a8c241935f5aca85",
"name": "acme - Sandbox - Microsoft Entra ID",
"created": "2025-10-06T09:41:20.552Z",
"modified": "2025-12-09T08:12:53.800Z"
}
and the workflow json
{
"description": "Sistema target integrazione Microsoft Entra ID acme",
"owner": {
"type": "IDENTITY",
"id": "48b91e90b85e4e85bf88574c6d16f051",
"name": "SailPoint Services"
},
"cluster": {
"type": "CLUSTER",
"id": "5851f45690f244c8b6d31d6965ba62d7",
"name": "sp_connect_proxy_cluster"
},
"accountCorrelationConfig": {
"type": "ACCOUNT_CORRELATION_CONFIG",
"id": "3d5ad3a2c434447eb7f989a7fa5606ec",
"name": "acme - Sandbox - Microsoft Entra ID [source] Account Correlation"
},
"accountCorrelationRule": null,
"managerCorrelationMapping": null,
"managerCorrelationRule": null,
"beforeProvisioningRule": null,
"schemas": [
{
"configuration": {},
"type": "CONNECTOR_SCHEMA",
"id": "ce4641125b35496ca54ecf52055aba03",
"name": "account"
},
{
"configuration": {},
"type": "CONNECTOR_SCHEMA",
"id": "bcc24df54ccb48e6b8243b772991b67d",
"name": "group"
},
{
"configuration": {},
"type": "CONNECTOR_SCHEMA",
"id": "53b1474a50154e93b6b6cdcd23a68743",
"name": "applicationRole"
}
],
"passwordPolicies": null,
"features": [
"PASSWORD",
"ENABLE",
"AUTHENTICATE",
"AI_AGENT_AGGREGATION",
"APPLICATION_DISCOVERY",
"DELETE",
"PROVISIONING"
],
"type": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
"connector": "Microsoft-Entra",
"connectorClass": "",
"connectorAttributes": {
"healthCheckTimeout": 60,
"channelFilter": null,
"groupsDeltaToken": "",
"idnProxyType": "sp-connect",
"clientCertificate": null,
"clientID": "e276898f-4ad6-418b-b683-440b6fb82672",
"deltaAggregationEnabled": false,
"mailContactFilter": null,
"pageSize": "100",
"manageAdminConsentedPermissions": null,
"checkDeletedDisabled": true,
"connectionType": "direct",
"exoAuthenticationType": null,
"spnAccountFilter": null,
"spConnectorInstanceId": "00fbd0f9-e8ef-4dbb-8d01-3859f7538864",
"enableProvisioningFeature": true,
"appTemplateData": "{\"whiteListedAttributes\":[\"enableProvisioningFeature\"]}",
"userDeltaToken": "",
"clientSecret": "\"}",
"isCaeEnabled": false,
"aggregateHiddenAccessPackages": null,
"spnManageAzureADPIM": null,
"aggregateAllGroups": true,
"aggregateGroupHierarchy": false,
"manageO365Groups": true,
"sourceConnected": true,
"userFilters": null,
"directoryRolesDeltaToken": "",
"enableAdministrativeUnits": false,
"enableManagedIdentityManagement": false,
"private_key": null,
"slpt-source-diagnostics": "{\"connector\":\"Microsoft-Entra\",\"status\":\"SOURCE_STATE_HEALTHY\",\"healthy\":true,\"healthcheckDisabled\":false,\"healthcheckCount\":39,\"lastHealthcheck\":1765267973785,\"statusChanged\":1764634521387}",
"formPath": null,
"refresh_token": null,
"cloudCacheUpdate": 1764951441929,
"privateKeyPassword": null,
"domainName": "contoso.onmicrosoft.com",
"connectorName": "Microsoft Entra",
"spnManageAppRoles": null,
"grantType": "CLIENT_CREDENTIALS",
"since": "2025-12-02T00:15:21.387Z",
"status": "SOURCE_STATE_HEALTHY",
"groupFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
"spConnectorSupportsCustomSchemas": "true",
"supportsAdvancedGroupFilter": true,
"supportsDeltaAgg": "true",
"enableTeamsGovernance": false,
"exchangeUserName": null,
"enablePIM": false,
"enableAccessPackageManagement": false,
"azureRolesFilter": null,
"recommendationStatus": null,
"hasFullAggregationCompleted": true,
"deltaAggregation": [
"std:account:list"
],
"manageAzureServicePrincipalAsAccount": false,
"manageExchangeOnline": false,
"spnManageAzurePIM": null,
"exchangeCertificate": null,
"spnManageGroups": null,
"exchangeUserPassword": null,
"directoryRolesFilter": null,
"spConnectorSpecId": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
"deleteThresholdPercentage": 100,
"supportsStatefulCommands": "true",
"spnManageDirectoryRole": null,
"templateApplication": "Microsoft Entra",
"encrypted": "clientSecret, clientCertificate, privateKeyPassword, private_key, refresh_token, exchangeUserPassword",
"healthy": true,
"spnManageRBACRoles": null,
"supportsAdvancedAccountFilter": false,
"cloudDisplayName": "acme - Sandbox - Microsoft Entra ID",
"groupMembershipFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
"azureADRolesFilter": null,
"exchangeCertificatePassword": null,
"enableSystemAssignedManagedIdentity": false,
"beforeProvisioningRule": null,
"enableMailContactGovernance": null
},
"deleteThreshold": 100,
"authoritative": false,
"healthy": true,
"status": "SOURCE_STATE_HEALTHY",
"since": "2025-12-02T00:15:21.387Z",
"connectorId": "Microsoft-Entra",
"connectorName": "Microsoft Entra",
"connectionType": "direct",
"connectorImplementationId": "Microsoft-Entra",
"managementWorkgroup": null,
"credentialProviderEnabled": false,
"category": null,
"accountsFile": null,
"id": "fdb57b6827e24201a8c241935f5aca85",
"name": "acme - Sandbox - Microsoft Entra ID",
"created": "2025-10-06T09:41:20.552Z",
"modified": "2025-12-09T08:12:53.800Z"
}