Azure AD groups and Business roles

Question

Hello, 
 
 We are using One identity manager V 8.1.3. 
 
 We have a synchronisation project to an Azure AD tenant. I have this situation and i don't know how to deal with it.. 
 
 A given person can have up to two AAD accounts (under 2 domains A and B ) 
 
 Business role A gives AAD account of type A 
 Business role B gives AAD account of type B 
 
 Business role A is attached with an Azure AD group grp_A 
 Business role B is attached with an Azure AD group grp_B 
 
 If a person has the 2 Business roles..one identity manager, sometimes gives grp_A to the AAD account linked to Business role B (and vice versa).. 
 
 Is that normal ? 
 
 Any idea how to solve this.. 
 
 Many thanks

Trevor Pike · Answer

Hi,

If the business roles are assigned to the same Employee and the AADAccounts are set to inherit groups, then yes, this is normal.

You could define some criteria that only assigns the group to the correct account.

Trevor

Barry Jackson · Answer

Hi, 
 Please take a look at the documentation here: https://support.oneidentity.com/technical-documents/identity-manager/8.2.1/administration-guide-for-connecting-to-azure-active-directory/21#TOPIC-1793411 
 HTH, Barry.