Can I leverage group membership to select attribute during provisioning ?

Question

Hi Team,

I'm planning to use AAD to provision users to a SaaS app. Few of the users in AAD have a different mail domain. The SaaS app has domain restrictions and isn't allowing us to create users with a mail different domain. Hence I was thinking of using a group to identify users with a different mail domain and transform domain restricted fields in SaaS app with UPN ONLY FOR THOSE users in the group. Curious if AAD supports this use case.
I can define an expression to transform domain restricted fields in attribute mapping by regex. But I would like to use group membership in the expression logic as it gives me more control.

Any suggestions/thoughts would be really helpful.

Thanks in advance !!

Answer 1

@juggernaut007

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "https://learn.microsoft.com/en-us/answers/support/accepted-answers#why-only-one-accepted-answer", I'll repost your solution in case you'd like to "Accept" the answer.

As per this QnA post https://learn.microsoft.com/en-us/answers/questions/983433/how-can-you-get-the-group-name-when-using-expressi.html above mentioned requirement is not supported.

Let me know if you have any further questions.

Answer 2

As per https://learn.microsoft.com/en-us/answers/questions/983433/how-can-you-get-the-group-name-when-using-expressi.html looks like it's not supported.