Improve/fix Workday to Azure AD provisioning to allow setting a dynamic password

Question

Despite apparently not being explicitly documented for the provisioning app, I am able to set a constant/static password for a user on creation by registering a new target property named "passwordProfile.password" with the data type "String".
Unfortunately, I'm unable to use dynamic expression to also set this password. The error returned is

The property 'passwordProfile.password" is invalid.

My main use case is to able to generate a user-specific password based on private data known only to him and thus speed-up onboarding without requiring manual intervention from an administrator.

Answer 1

@Fernando Almeida
I'm assuming you are provisioning from Workday to Azure AD (and not on-premises AD). The target attribute "passwordProfile.password" is already present in the schema. You need not add another property with the same name.

I tested this behavior in my lab setup - setting password to a dynamic value using an expression mapping and it worked as expected.

Make sure that the password generated by the expression complies with your password policy.

If the issue persists, open a support ticket from the Azure portal. Specify service: "Azure AD User Provisioning and Synchronization" -> "Problem Type: Provisioning from Cloud HR to AD or Azure AD".

You can also explore this capability of generating Temporary Access Pass (TAP) and sending it to the user's manager using Azure AD Lifecycle Workflows.