Workday / Entra - EmployeeOrgData Attribute aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Attempting to concatenate COST_CENTER & SupervisoryOrg (Division) from Workday and aggregate to employeeOrgData(Multi-value) attribute to Entra ID.

Currently leveraging transform which does properly concatenate to the identities within SailPoint:

{

"id": "552fb8cb-1883-47c3-a5d1-6beafb3124f5",

"name": "employeeOrgData Concatenation",

"type": "concat",

"attributes": {

    "values": \[

        {

            "type": "accountAttribute",

            "attributes": {

                "sourceName": "Workday SaaS",

                "attributeName": "COST_CENTER"

            }

        },

        " - ",

        {

            "type": "accountAttribute",

            "attributes": {

                "sourceName": "Workday SaaS",

                "attributeName": "DIVISION"

            }

        }

    \]

},

"internal": false

}

When attempting to sync attributes on Entra source, getting the following error:

errors

[“[ConnectorError] AxiosError: Request failed with status code 400 (requestId: 4203c584adbb4200a72adaed53b70d31)”]

any assistance/guidance would be appreciated.

2

Hi @steverosenquist-ulse ,

As per provided transform could you confirm if you are able to see valid concatenated values as per defined transform. It can be done by previewing for identities. As it might be syntactical issue due to “\” post values. But still check for the same and confirm if it’s working fine.

If it works fine can you check with Entra application team whether such concatinated values can be set for “employeeOrgData” attribute.

IHTH :slightly_smiling_face:

3

Hi and thanks for the reply. To answer the ‘are able to see valid concatenated values as per defined transform. It can be done by previewing for identities.’ - yes - identities are displaying proper concatenated value.

In terms of checking with ‘Entra application team’ there is no one seasoned within our org to answer such question. Upon investigating appears this attribute ‘employeeOrgData’ is a multivalued attribute and does allow concatenation, just not in single string form being passed from the transform - I am just not familiar enough in SailPoint on how to accomplish using either an object or pull in separate string values.

This is where looking to see of someone has accomplished or can provide a path.

Will take a look at the ‘\’ post value and report back.

4

Here is proper code as above did not fully paste… In the actual transform - there is no “\” post value.

{
“id”: “a0c184f8-f0be-4642-b050-e70747ecff95”,
“name”: “employeeOrgData Concat Object”,
“type”: “concat”,
“attributes”: {
“values”: [
{
“type”: “accountAttribute”,
“attributes”: {
“sourceName”: “Workday SaaS”,
“name”: “COST_CENTER”,
“defaultValue”: “UNKNOWN_COST_CENTER”
}
},
" - ",
{
“type”: “accountAttribute”,
“attributes”: {
“sourceName”: “Workday SaaS”,
“name”: “DIVISION”,
“defaultValue”: “UNKNOWN_DIVISION”
}
}
],
“delimiter”: “”
},
“internal”: false
}

5

@steverosenquist-ulse , Thanks for sharing the information.

Above transformation looks good to me and it should work fine as you said.

WRT Entra ID attribute employeeOrgData during the sync process the source will call it’s application create account provisioning policy so please mark employeeOrgData attribute as multivalue check so it will send the set string as array and connector should be able to process the request.

Let me know if any issues come up.

6 
{
  "id": "a0c184f8-f0be-4642-b050-e70747ecff95",
  "name": "employeeOrgData Concat Object",
  "type": "concat",
  "attributes": {
    "values": [
      {
        "type": "firstValid",
        "attributes": {
          "values": [
            {
              "type": "accountAttribute",
              "attributes": {
                "sourceName": "Workday SaaS",
                "attributeName": "COST_CENTER"
              }
            },
            "UNKNOWN_COST_CENTER"
          ]
        }
      },
      " - ",
      {
        "type": "firstValid",
        "attributes": {
          "values": [
            {
              "type": "accountAttribute",
              "attributes": {
                "sourceName": "Workday SaaS",
                "attributeName": "DIVISION"
              }
            },
            "UNKNOWN_DIVISION"
          ]
        }
      }
    ]
  },
  "internal": false
}

try this once and let me know

7

Hello and thank you! The employeeOrgData attribute within the Entra Source is currently set to multivalue. Is there anywhere else this should be set?

2025-09-19_08-38-30

8

Hi @steverosenquist-ulse ,

Thanks for confirmation.

So basically transform can’t be leverage for the mentioned use case as transforms themselves return a single value.
For more complex scenarios involving multi-valued attributes, such as filtering, conditional logic, or intricate manipulation that transforms cannot achieve, you would typically leverage IdentityNow Rules (e.g., Before Provisioning Rules or Cloud Identity Attributes rules). Rules offer greater flexibility and allow you to write custom logic using BeanShell or JavaScript, enabling you to process multi-valued attributes and generate the desired output, including potentially creating or updating multiple identity attributes based on the multi-valued input.

Find the provided rule link for your reference - Cloud Executed Rules | SailPoint Developer Community

9

Hi @steverosenquist-ulse Multi-valued attributes are not supported using Attribute Sync. They are, however, supported using an UPDATE provisioning policy utilising the cloudDelimiter attribute.

See Cloud Delimiter not working in Account Profile

10

However, saying that, I’ve had a look at the Entra attribute employeeOrgData and it is not a multi-valued attribute, it is a resource object. You may be able to “dot walk” it but I have no experience there.

see employeeOrgData resource type - Microsoft Graph v1.0 | Microsoft Learn

12

@steverosenquist-ulse , as I said above your end use case can be implemented by utilizing the Identity attribute rule.

Also find the provided link to implement your case - Multivalued Attribute Sync

IHTH :slightly_smiling_face:

13

Thank you for the response…implementation is new (don’t have J/M/L fully implemented). Attempting to clean up existing users based on business requirements. Once cleaned up - will work to implement an identity attribute rule around provisioning.

1 Like
14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.