Provisioning users from Azure into Jam using IPS

[#1]

Hello Guys,

I'm implementing Jam for a customer and customer wants to access Jam using their Azure credentials. For the same, I've configured SSO in Azure AD -> IAS -> Jam. And as customer wants their Azure AD profiles to be used to get into Jam, I’ve configured IPS. So in IPS, I’ve added Azure AD as source and that’s how it’s pulling users from Azure and pushing them into Jam.

Now the issue that I’m facing now is –

1. All user’s from Azure AD is getting created in Jam. While adding Azure as source in IPS, I’ve added MS graph properties (as per help link - https://help.sap.com/viewer/f48e822d6d484fa5ade7dda78b64d9f5/Cloud/en-US/f75f99c72ef94bedac5357febc8...) - ### Here I could understand that in IPS, I need to add some additional properties/edit the transformation logic (that gets created inside IPS) in order to read a particular group from Azure – but I’m not able to achieve the same.
2. I can see user profiles which gets created in Jam (from Azure), for some of them mail id is coming properly but for some in mail id some garbage value is showing. - ### When I check if there’s any difference between this 2 type of user in Azure, I don’t find any difference. So is there any limitations in IPS here?

It would be great if you can give me some pointer to move ahead as I'm stuck here now and customer not able to use Jam.

Cheers,

Sen

[Former Member]

Yes Christian. To my understanding, the option here should be putting a filter inside IPS in transformation logic and I'm trying the same by putting values in different combinatons. I was trying as per your comment on the other thread but still no hope.

And we can't directly map customer's Azure with IPS as that would unnecessarily pull all users from Azure (only certain people/group in company need Jam as per their requirement) and may hit Jam subscription quota in first load itself.

[former_member47640]

I was told that Azure doesn't provide the groups as part of their API. So it doesn't seem to be possible to select users based on that.

I'm not an expert in APIs and especially not in the Azure AD API, but it looked to me like you can at least filter by departments. Maybe that's a workaround.

Sorry, that I can't be of more help. Maybe others have more ideas.

[Former Member]

Hello,

To add more information, I have added below mentioned lines in the 'Transformation' logic inside IPS (in source system object for Azure AD) -

"condition": "($.groups[*].value contains 'Jam') || ($.groups[*].value contains 'C4C')" as the group name where I'm assigning users in Azure is - 'Jam Users'.

This is the single line I've changed in transformation . Not sure whether I've to make any changes to any other line here (do I need to do anything in group section ?)

And, no additional property I've added in 'Properties' tab. Do I need to add any like - msgraph-filter or ldap.group.filter and if yes what value should I put there ?

When I did run the job after adding group condition, it did run without any error but no user got created in Jam.

Looking for help..!!

Cheers,

Sen