Sync employeeHireDate from SailPoint ISC to Entra ID

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hey SailPoint ISC users,

Please find below my question;

Context:

  • I want to sync a date identity attribute to Entra ID “employeeHireDate” account attribute.
  • I’ve used the “Update Attribute Sync Config” API endpoint to add the mapping as follows :
    { 
        "enabled": true,
        "name": "employeeHireDate",
        "target": "employeeHireDate",
        "displayName": "Start Date"
    }
  • Identity attribute has the same name than the Entra ID attribute, “employeeHireDate”.

Issue :

  • When I trigger attribute sync, nothing happens on Entra ID, even SailPoint logs don’t show anything.

Investigation :

Question:

  • Can someone confirm if “employeeHireDate” Entra ID attribute can be synched from SailPoint ISC?

  • If yes, is there any requirement? I know that “employeeHireDate” Entra ID attribute must use ISO 8601 format.

Thank you for your help.

2

Hi @khalilgahbiche Have you added the attribute to the account schema and done a successful aggregation of it?

3

@khalilgahbiche To my knowledge, Yes, the “employeeHireDate” attribute from Entra ID can be synced from SailPoint ISC, provided it’s configured under the Attribute Sync section of the source. There’s generally no restriction on which attributes can be synced.

Regarding formatting: you’re right that Entra ID expects ISO 8601 format for employeeHireDate, but in practice, SailPoint doesn’t enforce strict format validation during sync. For example, I‘ve successfully synced the accountExpires field from an AD source to an identity attribute without any formatting issues but that’s because AD would accept it that way.

However, in your case for Entra ID, I would advice to do the date format conversion to ISO 8601 on the identity attribute level and then proceed to validate the sync.

Couple of things I would like to advice:

  • Have a transform applied on your identity attribute for ISO 8601 date conversion and once done, click on “Apply Changes” at the identity profile level before the testing and wait for the full refresh to complete.
  • Add the “employeeHireDate“ account attribute to the account schema on your Entra source and do a full aggregation.
  • Ensure the identity and account attribute values are different before testing (sync only triggers on change).
  • Ensure that the sync is “Enabled” on the “Attribute Sync” section of your Entra source configuration for this attribute.
  • Use “Synchronize Attributes” dropdown option on the identity manually to force a sync on downstream sources and then check the event logs.

Thanks,

Arshad.

4

Hi @j_place , Yes I added the attribute to the account schema, chose “String” type as there’s no choice for dates, then triggered a full account aggregation, but no values showed up.

5

Hi @khalilgahbiche Are you aware of any Entra accounts that actually have the employeeHireDate populated? String format should be fine. Always best to have a successful aggregation before confirming attribute sync.

Also, why did you feel the need to use the API for attribute sync, rather than the UI? Does your API inserted attribute sync display correctly in the UI?

6

For new schema attribute data to show up on the Accounts, you need to run an unoptimized account aggregation. Try starting the Aggregation from here:

import-accounts | SailPoint Developer Community

with disableOptimization set to true.

If nothing shows up on the accounts where you expect the attribute to be populated, it is most likely a spelling / capitalization issue on the Attribute name.

7

And from your description and responses, I don’t see whether you have added the attribute you wish to sync to the “Create Account” Profile / Provisioning Policy.

That is a requirement for using the Attribute Sync, too, see here:

Here the relevant part:

In the attribute sync configuration, you specify which account attributes on a source should be kept in sync with corresponding identity attributes. You can configure this for any source account attribute that:

  • Is included in the source’s Create Account definition, and

  • Is mapped directly from an identity attribute in that definition