How to provision user with certain group memberships from azure to the provisioning application?

Question

Roshan Kumawat 0

In group provisioning, will all users under that group will be provisioned to the provisioning application or only Group names will be provisioned to the provisioning application?
Can we provision user with certain group memberships by defining the group names in scope filters as shown in below screenshots?

Fabio Andrade 1,665 Reputation points Microsoft Employee Moderator

2024-04-02T18:41:46.1933333+00:00
Hi @Roshan Kumawat,

Thanks for reaching out to Microsoft Q&A

1 - The group object itself won't be provisioned unless the target application supports it

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works#assignment-based-scoping

Group membership is not supported as a scoping filter as of Today

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/define-conditional-rules-for-provisioning-user-accounts?pivots=app-provisioning#create-a-scoping-filter

Let me know if that was helpful for you.

Thanks,

Fabio
Roshan Kumawat 0 Reputation points

2024-04-03T07:40:00.42+00:00

If I put a scope filter on the displayName under group, then only the users under that Group name will be provision to the target application
Fabio Andrade 1,665 Reputation points Microsoft Employee Moderator

2024-04-03T22:55:11.21+00:00

@Roshan Kumawat that's correct, as the documentation states, the group object won't be synced, unless the application supports it.

Let me know if you have further questions.

Thanks,

Fabio

2 answers

Fabio Andrade 1,665 Reputation points Microsoft Employee Moderator

2024-04-02T18:41:46.1933333+00:00

Hi @Roshan Kumawat,

Thanks for reaching out to Microsoft Q&A

1 - The group object itself won't be provisioned unless the target application supports it

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works#assignment-based-scoping

Group membership is not supported as a scoping filter as of Today

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/define-conditional-rules-for-provisioning-user-accounts?pivots=app-provisioning#create-a-scoping-filter

Let me know if that was helpful for you.

Thanks,

Fabio
Roshan Kumawat 0 Reputation points

2024-04-03T07:40:00.42+00:00

If I put a scope filter on the displayName under group, then only the users under that Group name will be provision to the target application
Fabio Andrade 1,665 Reputation points Microsoft Employee Moderator

2024-04-03T22:55:11.21+00:00

@Roshan Kumawat that's correct, as the documentation states, the group object won't be synced, unless the application supports it.

Let me know if you have further questions.

Thanks,

Fabio

Answer 1

Fabio Andrade 1,665 Microsoft Employee Moderator

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue.

If you have any other questions, please let me know.

Thanks,

Fabio

Answer 2

Fabio Andrade 1,665 Microsoft Employee Moderator

I just wanted to check in and see if you had any other questions or if you were able to resolve your issue.

If you have any other questions, please let me know.

Thanks,

Fabio