I would like to build an integration that can call the Provision on Demand Graph API for a given enterprise app: https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-provisionondemand?view=graph-rest-1.0&tabs=http . This API endpoint requires a rule ID to be specified. The issue is, I'm not quite sure how to consistently identify the correct synchronization rule to use. Specifically: Is there any possibility of an application/service principal having more than 1 synchronization job? The fact that there is a list endpoint suggests that it is possible - however in the provisioning UI I can only see one synchronization job ID. For a given synchronization job, is there any possibility of there being more than 1 synchronization rule that supports on demand provisioning . I can see that some apps have a separate synchronization rule for inbound provisioning, but it seems most apps only have one rule for outbound provisioning. Is this always the case? Say I don't know which synchronization job to use, I was planning to get all synchronization rules for all synchronization jobs, and find the synchronization job and rule that supports outbound provisioning via provision on demand. This only works if there is only one job and one rule that supports outbound provisioning using on-demand provisioning. Is this a feasible approach? Any insight?

How do I know which synchronization rule I should use to kick off a provision-on-demand via the API

shrinjay mukherjee 0

I would like to build an integration that can call the Provision on Demand Graph API for a given enterprise app: https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-provisionondemand?view=graph-rest-1.0&tabs=http. This API endpoint requires a rule ID to be specified. The issue is, I'm not quite sure how to consistently identify the correct synchronization rule to use. Specifically:

Is there any possibility of an application/service principal having more than 1 synchronization job? The fact that there is a list endpoint suggests that it is possible - however in the provisioning UI I can only see one synchronization job ID.
For a given synchronization job, is there any possibility of there being more than 1 synchronization rule that supports on demand provisioning. I can see that some apps have a separate synchronization rule for inbound provisioning, but it seems most apps only have one rule for outbound provisioning. Is this always the case?
Say I don't know which synchronization job to use, I was planning to get all synchronization rules for all synchronization jobs, and find the synchronization job and rule that supports outbound provisioning via provision on demand. This only works if there is only one job and one rule that supports outbound provisioning using on-demand provisioning. Is this a feasible approach?

Any insight?

FrankEscarosBuechsel-MSFT 160 Reputation points Microsoft Employee

2024-11-29T18:05:33.46+00:00

Hi @shrinjay mukherjee • Thank you for reaching out.

I'm understanding that you have some questions around the specifications for the on demand provisioning Graph APIs, especially how synchronization jobs and rules can be mapped and if 1:n relationships are possible or if there is pure 1:1 relationships between synchronization jobs and synchronization rules.

For your first question the following Learn document provides an example on how more than 1 synchronization job is possible for a single application/service principal. It walks through an example on how to create 2 jobs for the same service principal, one for user/group provisioning and one for password hash sync. So while the UI may only be showing one instance you cannot safely assume that only 1 job exists and you have to validate the correct synchronization job to be chosen for your intended use case. Create sync job

For your other 2 questions I cannot immediately find straight forward documentation which would answer the question, so I will do some more research on the specifics for you and provide an update once I have a confirmed answer for those questions.
FrankEscarosBuechsel-MSFT 160 Reputation points Microsoft Employee

2024-12-02T17:49:01.2066667+00:00

Hi @shrinjay mukherjee,

I have had some internal chats with one of the responsible teams for this functionality.

Can you please elaborate on your use case a bit here, are you deploying a SaaS application and want to provision users from Entra ID into that app, basically following example 1 of the Learn article you outlined earlier here: Provision users from Microsoft Entra ID to third-party applications, or is it via Cloud Sync as per example 2 here Sync on-demand from Active Directory to Microsoft Entra ID (Microsoft Entra Cloud Sync).

Share via

How do I know which synchronization rule I should use to kick off a provision-on-demand via the API

Your answer