• Replies 3 replies
  • Subscribers 70 subscribers
  • Views 162 views
  • Users 0 members are here
Options
Related

Deprovision Entra ID user

chinmoy jena

Hi,

I'm building a new environment where we will be managing all Entra ID users using Active roles. There is no Active directory user to be managed.

I have a script that has all the deprovision task defined and works perfectly. I created a virtual attribute and trying to trigger a workflow (that will trigger the script) when the entra users virtual attribute is modified.

But problem is the workflow doesn't trigger when virtual attribute is modified.

can someone please help me?

Parents

  • I don't think Change Workflows work with Entra objects.

    A good work around would be to:

    1) Create a Managed Unit who's membership rule is to look for objects with the virtual attribute set - i.e. containing a value such as "DEPROV ME"
    2) Create an Automation Workflow that searches the Managed Unit - you can implement this as a search in the workflow or within your script's code - your choice.
    3) Schedule your workflow to run as often you see fit - maybe every 15 minutes?

  • in reply to JohnnyQuest

    Thanks  

    1. We have Entra DS added as a managed domain. Which has a dirsync server connected. In this case Active roles should be able to detect the chnages as the changes are flown from Entra ID to Entra DS?

    2. Search in the workflow:  Does the workflow search works with the entra objects in a management group ? If yes, can you confirm me the settings need to be used?

      a. Use this activity to:  (trying with "Search in the organizational unit or container")

      b. Find: (will the user option works?) In: (targeting to managed unit containing the Entra object)

    I have tried all the possible options. Do you have a proven method that it works ?

    One more additional questions:

    How can I read / write a virtual attribute of an Entra user using powershell ? Get-Qaduser / Set-Qaduser works for AD / Entra DS users, but not for Entra ID user account. I can access via GUI, but not Via powershel.

  • in reply to chinmoy jena

    Hi Chinmoy, thanks for the extra details. There are two different object types here:

    1. For users in Entra DS, changes synced from Entra ID happen outside Active Roles. An Active Roles change workflow normally won't be triggered by that external sync. For periodic checks, JohnnyQuest's scheduled Automation Workflow / Managed Unit approach is a reasonable starting point.
    2. For Entra ID cloud objects, Get-QADUser and Set-QADUser aren't the right cmdlets. I can't confirm the supported way to read/write an Active Roles virtual attribute on those objects without knowing your Active Roles version. Could you share the version and confirm whether the attribute is on an Entra ID cloud user or an Entra DS user? Then we can check the supported method and the workflow search settings.

    Please test the scheduled search on a test user first and share any errors.

Reply
  • in reply to chinmoy jena

    Hi Chinmoy, thanks for the extra details. There are two different object types here:

    1. For users in Entra DS, changes synced from Entra ID happen outside Active Roles. An Active Roles change workflow normally won't be triggered by that external sync. For periodic checks, JohnnyQuest's scheduled Automation Workflow / Managed Unit approach is a reasonable starting point.
    2. For Entra ID cloud objects, Get-QADUser and Set-QADUser aren't the right cmdlets. I can't confirm the supported way to read/write an Active Roles virtual attribute on those objects without knowing your Active Roles version. Could you share the version and confirm whether the attribute is on an Entra ID cloud user or an Entra DS user? Then we can check the supported method and the workflow search settings.

    Please test the scheduled search on a test user first and share any errors.

Children
No Data