Azure AD provisioning problem with referential attributes.

Question

Azure AD provisioning problem with referential attributes.

Alex Wilhelmsen 41

Azure AD provisioning is an amazing tool and we are maybe stretching it to its limit. We have Workday as our HRMS.
New hires are getting flawlessly provisioned into on-prem Active Directory.

However, we don't want all attributes synchronized until the first day in the office. This is done with the following expression:

IIF(DateDiff("d", CDate([StatusHireDate]), Now())>=0, [SupervisoryOrganization], "")

This works fine for all attributes except manager.

IIF(DateDiff("d", CDate([StatusHireDate]), Now())>=0, [ManagerReference], "")

According to documentation, it is due to: "The function should not be used for referential attributes such as manager."
Does anybody have a workaround or are there any updates for the Azure AD provisioning solving this?

Accepted answer

1 additional answer

Your answer

Answer 1

Limitless Technology 44,741

Hello @Alex Wilhelmsen

Unfortunately it seems that it is a hardcoded requirement, likely due to avoid NULL attritbute issues later.

You can find more information and the official statement in: https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/functions-for-customizing-application-data

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--

Alex Wilhelmsen 41 Reputation points

2022-03-02T13:15:48.687+00:00

Thank you for the answer. Unfortunately, it seems like you are right. Our problem is that new hires are shown in the Organization charts in O365 before their starting date. This is for multiple reasons not practical, as this may initiate e-mails/Teams chat before the first day in the office. Delaying the manager role sync with the above-mentioned expression to the first day in the office would have solved it.

Nothing else to do than to put it on hold and hopefully a solution will come at a later time.

Answer 2

David Lundell 86

I know this is an oldie but just in case someone else has the same type of question ...

If the real objective is to keep users from showing up in the Organization Charts in O365 you could do a flow like this

IIF(DateDiff("d", CDate([StatusHireDate]), Now())>=0, "True", "False")

If you Flow this into ShowInAddressLists this should keep the user from appearing in the Global Address List (GAL) and hence from showing up in the Org Charts.

Share via

Azure AD provisioning problem with referential attributes.

1 additional answer

Your answer