I have created 2 groups in Entra and associated them both to the enterprise app for Snowflake SCIM provisioning. If a user belongs to GroupA, I'd like them to be assigned the "Developer" role in Snowflake; members of GroupB should be assigned to the "Finance" role. Is there any chance it is as easy as an expression in the User attribute mapping?

Hi @Lynne Caputi , yes, you can use dynamic groups in Entra ID to assign users to groups based on their properties, and then use entitlement management to assign roles to those groups. You can create two dynamic groups in Entra ID, one for GroupA and one for GroupB, and configure the group rules to match the properties of the users you want to include in each group. Then, you can use entitlement management to assign the "Developer" role to GroupA and the "Finance" role to GroupB. For the user attribute mapping, it depends on the specific requirements of your Snowflake SCIM provisioning configuration. If you need to map a custom attribute to a specific value based on the user's group membership, you can use an expression in the attribute mapping to achieve this but the exact expression will depend on the specific requirements of your configuration. Please let me know if you have any questions and I can help you further. If this answer helps you please mark "Accept Answer" so other users can reference it. Thank you, James

Is it possible to assign a custom SCIM attribute (e.g. Snowflake default_role) based on Entra group membership?

Accepted answer

James Hamil 26,881 Reputation points Microsoft Employee

2024-12-16T22:27:23.1566667+00:00

Hi @Lynne Caputi , yes, you can use dynamic groups in Entra ID to assign users to groups based on their properties, and then use entitlement management to assign roles to those groups.

You can create two dynamic groups in Entra ID, one for GroupA and one for GroupB, and configure the group rules to match the properties of the users you want to include in each group. Then, you can use entitlement management to assign the "Developer" role to GroupA and the "Finance" role to GroupB.

For the user attribute mapping, it depends on the specific requirements of your Snowflake SCIM provisioning configuration. If you need to map a custom attribute to a specific value based on the user's group membership, you can use an expression in the attribute mapping to achieve this but the exact expression will depend on the specific requirements of your configuration.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James
Please sign in to rate this answer.

1 person found this answer helpful.
Lynne Caputi 55 Reputation points

2024-12-17T14:52:00.1366667+00:00

James, your answer is close to what I need, but I think I need details on the entitlement management you mention that maps the role to the group. What I can't seem to find are the specific steps to accomplish this. I created 2 app roles for the SCIM app, Finance and Developer. I've created my 2 groups and I've assigned them to the SCIM app. When I added each one to the app, I assigned the role I wanted those members to be assigned in Snowflake. Then, I modified the custom defaultRole app I had added in attribute mapping/Users to be the expression SingleAppRoleAssignment([appRoleAssignments]). I was seriously guessing at this given I was piecing together information from various articles. Did I hit the right combination of steps? I was wondering if I needed to add the custom defaultRole to the Groups attribute mapping instead of just the user attribute mapping. Thank you again for stepping in to help me with this.

James Hamil 26,881 Reputation points Microsoft Employee

2024-12-18T22:35:50.2533333+00:00

Hi @Lynne Caputi , this sounds correct, but unfortunately I don't have access to Snowflake so it's hard for me to test and confirm. Are you having any issues with it currently?

Lynne Caputi 55 Reputation points

2024-12-18T23:22:21.8033333+00:00

James, it is actually working exactly as we want! I am going to mark your answer as accepted, thank you for the guidance. Assigning the app role to the group as you're adding the group to the application is the first step. Then adding the SingleAppRoleAssignment([appRoleAssignments]) expression to the custom defaultRole attribute I had to add by following this Snowflake article (https://community.snowflake.com/s/article/HowTo-How-to-Set-up-Snowflake-Custom-Attributes-in-Azure-AD-SCIM-for-Default-Roles-and-Default-Warehouses) was all that needed to be done. If we move a user from GroupA to GroupB, the role changes at the next sync and everything works perfectly. Here's what our attribute mapping looks like, just in case anyone else has the same question:

Thanks again for the guidance!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is it possible to assign a custom SCIM attribute (e.g. Snowflake default_role) based on Entra group membership?

0 additional answers

Your answer