Azure Active Directory

Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.

Thank you for joining our community and helping improve Azure AD!

Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...

How can we improve Azure Active Directory?

Enter your idea

(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

SCIM defects

1. The Azure AD SCIM client does not follow the SCIM Base URI properly.
As per, https://tools.ietf.org/html/rfc7644#section-1.3,
The resource relative paths (e.g. /Users) needs to be appended to the configured Base URI.
Azure AD is instead appending "/scim/Users" to the URI configured on the Provisioning tab of the app. If my SaaS application requires the tenant ID in the path (e.g. https://bla/scim/tenantID/), this is not possible with Azure's client.

2. The Azure AD SCIM client doesn't implement a proper OAuth2 client. It simply asks for the OAuth bearer token to be provided in the configuration. This is no good since bearer tokens need to expire for security reasons. The SCIM client should instead implement the OAuth2 client credentials grant or password grant to a configurable OAuth2 token endpoint.

1. The Azure AD SCIM client does not follow the SCIM Base URI properly.
As per, https://tools.ietf.org/html/rfc7644#section-1.3,
The resource relative paths (e.g. /Users) needs to be appended to the configured Base URI.
Azure AD is instead appending "/scim/Users" to the URI configured on the Provisioning tab of the app. If my SaaS application requires the tenant ID in the path (e.g. https://bla/scim/tenantID/), this is not possible with Azure's client.

2. The Azure AD SCIM client doesn't implement a proper OAuth2 client. It simply asks for the OAuth bearer token to be provided in the configuration. This is no…

30 votes

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

6 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

started · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

The first issue is fixed, as describe here: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-provisioning-config-problem-scim-compatibility

A feature to improve oAuth support is still planned
serviceNow

I think there is significant area for improvement of the Auto Provisioning functionality when dealing with referenced fields.

For example, the user table within ServiceNow looks similar to the sample snippet below:

TABLE - User [sys_user]
-----------------------------
FIELD - Username [user_name] - string
FIELD - Name [name] - string
FIELD - Email [email] - string
FIELD - Department [department] - references Department [cmn_department] table
FIELD - Location [location] - references Location [cmn_location] table
FIELD - etc. etc.

Provisioning from Azure - in the cloud - is an awesome alternative to the previous configuration of having ServiceNow communicate with on-prem AD via LDAP/LDAPs/MID server/etc. because both Authentication and Provisioning can happen from the same source.

One limitation is the ability for Azure to create new values within tables that are referenced from the user table (such as Department and Location in the example above). The value has to already exist within ServiceNow for Azure to properly map it.

Given the following use case... it is tough to fully transition from on-prem configuration to a fully automated cloud configuration without the need for additional “swivel-chair” work.

Example:

I have and am mapping all of my users into ServiceNow from Azure, with the exception of service accounts, etc.

Those users are spread across 4 locations and 8 departments for example.

Departments:
Finance, IT, DevOps, HR, Facilities, Engineering, Sales, Marketing

Locations:
Baltimore, Philadelphia, D.C., Boston

If I know all of this information when initially setting up my ServiceNow environment, there isn't too much of an issue. I can create the 4 location records in the Location table and 8 records on the Department table. Then, I set up the provisioning integration with Azure and users will get assigned to those locations as long as the string value in physicalDeliveryOfficeName or city (whatever I have mapped to that attribute) something of the sort contains the same value as the record in my referencing table.

The situations where this becomes an issue, is for example... if I want to create 10 new Locations and 40 new departments for my users. Not only do I have to update users accounts in Azure to list them in the new locations, I also have to make sure to create every value (as it exists on the users’ record – no differences in spelling – example “D.C.” vs “DC”) within ServiceNow as well (within the corresponding tables)

So, when I add the location of "Chicago" I also need to make sure that the location table within ServiceNow contains a location called "Chicago" that we can reference. If not, that user will exist in ServiceNow with no location.

This isn’t so bad for the small example that I mentioned above, but when you apply this concept to a large enterprise with 100s of Locations and 100s of Departments changing regularly… it is really hard to manage user provisioning entirely from Azure into ServiceNow.

The (old “non-cloud”) alternate of have ServiceNow pull AD users via LDAP allows for the following concept when dealing with reference fields.
“The ‘department’ attribute is mapping to the Department table within ServiceNow”
Is a match found for this department (eg. “Maintenance”)?
Yes – associate that user to the “Maintenance” related record.
No – you can choose how you would like it to proceed
1. Create – meaning if I find a value that doesn’t exist yet while pulling in new users, create the record on the referencing table
2. Ignore – meaning if I find a value that doesn’t exist yet while pulling in users, don’t create the new record just skip over assigning the user’s department
3. Reject – meaning if I find a value that doesn’t exist yet while pulling in users, reject the users insert/update entirely… move on to the next object in the list of users

This is one disadvantage of pulling the “logic” of user provisioning out of ServiceNow and having it handled from with Azure

I think there is significant area for improvement of the Auto Provisioning functionality when dealing with referenced fields.

For example, the user table within ServiceNow looks similar to the sample snippet below:

TABLE - User [sys_user]
-----------------------------
FIELD - Username [user_name] - string
FIELD - Name [name] - string
FIELD - Email [email] - string
FIELD - Department [department] - references Department [cmn_department] table
FIELD - Location [location] - references Location [cmn_location] table
FIELD - etc. etc.

Provisioning from Azure - in the cloud - is an awesome alternative to the previous configuration of having ServiceNow communicate with on-prem AD…

15 votes

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

0 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

under review · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

Thanks for the feedback. We are looking into revamping our ServiceNow connector. Will update this thread as we make progress.

/Arvind
Integrate site mapping for Samanage App

I am provisioning users from AAD to Samanage and I am trying to map the AD attribute "physicalDeliveryOfficeName" to the Samanage "site" attribute. This mapping is currently not supported and I would find it useful.

13 votes

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

2 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

under review · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

Thanks for the feedback, we will review.
Azure AD User provisioning service : Adding a Staging/Preview mode

Please add a Staging/Preview mode for the Azure AD User Provisioning Service.
It should be possible in an initial setup to test a new provisioning interface and receive a report on what will be changed in an end application. This gives the possibility and security that a new interface can be set up productively.
There is currently a risk that unwanted changes will be made.
As a suggestion; extension of the Scope field by
- Sync all users and groups (Preview only)
- Sync only assigned users and groups (Preview only)

2 votes

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

0 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

under review · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

This is something we are starting to design this quarter
Azure AD User provisioning service : Support Contains Function in Attribut Flow Expression

Adding a new Expression for https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/functions-for-customizing-application-data called Contains(source[Multivalue], ValueRule).

This allowes multiple AppRoleAssignments and to set the correct Roles in the SaaS application.

As a reference SAP Concur with Roles like:
- Travel user
- Expense user

instead of
- Travel user
- Expense user
- Travel and Expense user

1 vote

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

0 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

under review · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

Thanks for the feedback, we will review
Azure AD User provisioning service : Allow accessing diagnostic logs

It should be possible to get diagnostic logs, like API calls from the Azure Portal in case of an exception, so that a troubleshooting is possible without contacting the MS support.

1 vote

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

1 comment · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

need-feedback · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

Could you please clarify what types of API calls / what scenarios you’ve needed this information?
Make Azure Groups PATCH remove operation SCIM v2 compliant

The request body for Update Group [Remove Members] is not compliant with the SCIM v2 specification.
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/use-scim-to-provision-users-and-groups#update-group-remove-members

Azure is specifying the member value they want deleted in the "value" property. SCIM specification states that the member value that would be removed in the PATCH operation needs to be set in the "path" property, not "value". The "value" property should actually never be sent in a PATCH remove operation per specification.
https://tools.ietf.org/html/rfc7644#section-3.5.2.2

If a Service Provider that implemented SCIM per specification were to receive PATCH remove request from Azure as is documented above, that request would result in ALL users being removed from the group.

Azure should to be corrected to be SCIM compliant for this request type.

The request body for Update Group [Remove Members] is not compliant with the SCIM v2 specification.
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/use-scim-to-provision-users-and-groups#update-group-remove-members

Azure is specifying the member value they want deleted in the "value" property. SCIM specification states that the member value that would be removed in the PATCH operation needs to be set in the "path" property, not "value". The "value" property should actually never be sent in a PATCH remove operation per specification.
https://tools.ietf.org/html/rfc7644#section-3.5.2.2

If a Service Provider that implemented SCIM per specification were to receive PATCH remove request from Azure as is documented above, that request would result in ALL users being…

1 vote

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

0 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

under review · AdminAzure AD Team (Product Owner, Microsoft Azure) responded

Thank you for the feedback, we will review.

/Arvind
Push Profile Photo and Manager via scim

It appears that user's profile photo and manager are currently not pushed by Azure AD when it does a SCIM sync. Add support for pushing those attributes.

1 vote

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

0 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →
Azure connector sync issues

We are trying to auto provision Salesforce users using Azure AD connector. We want certain attributes like ManagerId and Department to be in sync with AD always. So we had set that to "Always" in the set up. But our observation says that, when these values are changed in AD, it is updating to the new values in Salesforce. But if these values are changed in Salesforce, they are not getting overwritten with the values from AD in Salesforce. Which means, now they are out of sync.
Since we have set that to "Always", we expect these attributes to be in sync always
We are trying to auto provision Salesforce users using Azure AD connector. We want certain attributes like ManagerId and Department to be in sync with AD always. So we had set that to "Always" in the set up. But our observation says that, when these values are changed in AD, it is updating to the new values in Salesforce. But if these values are changed in Salesforce, they are not getting overwritten with the values from AD in Salesforce. Which means, now they are out of sync.
Since we have set that to "Always", we expect these attributes to be…

1 vote

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

0 comments · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →
About performance of Provisioning

About performance of Provisioning
We have a AD about a hundred thousand users, among them, around 2 thousand are assigned to Salesforce for provisioning.
The situation is every provisioning only provisioned about 50 users, and cost almost whole day(with some errors). Any idea about why its so slow?

1 vote

Sign in
prestine

(thinking…)

Sign in with: Microsoft

Forgot password?

Create a password

I agree to the terms of service

Signed in as (Sign out)

Close

Close

We’ll send you updates on this idea

1 comment · Provisioning to Applications · Flag idea as inappropriate… · Delete… · Admin →

Don't see your idea?

Azure Active Directory

How can we improve Azure Active Directory?

SCIM defects

serviceNow

Integrate site mapping for Samanage App

Azure AD User provisioning service : Adding a Staging/Preview mode

Azure AD User provisioning service : Support Contains Function in Attribut Flow Expression

Azure AD User provisioning service : Allow accessing diagnostic logs

Make Azure Groups PATCH remove operation SCIM v2 compliant

Push Profile Photo and Manager via scim

Azure connector sync issues

About performance of Provisioning

Feedback

Azure Active Directory

Feedback and Knowledge Base

Searching…

Give feedback

Microsoft Azure

Your password has been reset