Workday to On-Prem Active Directory: Issue with Multi-valued attributes syncing from Workday through Azure to On-prem AD via SCIM

Question

Hello there,

We have been using Workday to synchronise User accounts through Azure to our On-Prem Active Directory. For about 4-6 weeks we have been facing the issue now that Multi-valued attributes are no longer written correctly to the on-prem AD which was working before. This specifically effects the Assigned Provisioning Group from Workday using xpath:

wd:Worker/wd:Worker_Data/wd:Account_Provisioning_Data/wd:Provisioning_Group_Assignment_Data[wd:Status='Assigned']/wd:Provisioning_Group/text()

We are currently seeing the following behaviour:

1. An Employee in Workday has Provisioning groups A, B and C assigned = A, B and C are synchronised to Active Directory into a Multi-valued attribute
2. The same Employee in Workday is updated and now has Provisioning groups A, B, C and D assigned
3. The provisioning in Azure now evaluates the diff between whats in AD and Whats in Azure and evaluates that D is a new value and was appended to the attribute
4. The provisioning now overwrites the entire attribute in AD with the value of group "D"
5. Once the provisioning runs again it evaluates the diff to be A, B and C as appended values and replaces the value D with A, B, C in AD.
6. These steps repeat continuously writing A,BC then D then A,B,C again and so on

Checking the provisioning agent that pushes the Workday data from Azure to the on-prem AD, you can see the following verbose outputs: (SCIM operation is Replace and not Add)

Sync 1:

{'schemas':['urn:ietf:params:scim:api:messages:2.0:BulkRequest'],'Operations':[{'method':'PATCH','bulkId':'f2be78c1-177a-4f90-b5c8-61b7f3cdb576','path':'/DynamicElements/1f56ed3b-cafd-40b0-ab44-5b3a7bcc2bc6','data':[{'op':'Replace','path':'destinationIndicator','value':[{'value':'All_COO_Org_Managers_CELOCORE_AUTO'},{'value':'All_GTM_Org_CELOCORE_AUTO'}]}]}],'failOnErrors':null}

Sync 2:

{'schemas':['urn:ietf:params:scim:api:messages:2.0:BulkRequest'],'Operations':[{'method':'PATCH','bulkId':'858895c7-7e06-4b8a-866d-d3649482e7d5','path':'/DynamicElements/1f56ed3b-cafd-40b0-ab44-5b3a7bcc2bc6','data':[{'op':'Replace','path':'destinationIndicator','value':[{'value':'All_Celonis_CELOCORE_AUTO'}]}]}],'failOnErrors':null}

Sync 3:

{'schemas':['urn:ietf:params:scim:api:messages:2.0:BulkRequest'],'Operations':[{'method':'PATCH','bulkId':'f2be78c1-177a-4f90-b5c8-61b7f3cdb576','path':'/DynamicElements/1f56ed3b-cafd-40b0-ab44-5b3a7bcc2bc6','data':[{'op':'Replace','path':'destinationIndicator','value':[{'value':'All_COO_Org_Managers_CELOCORE_AUTO'},{'value':'All_GTM_Org_CELOCORE_AUTO'}]}]}],'failOnErrors':null}

Has anyone else faced this issue and has a solution at hand on how this could be resolved?

Any help is much appreciated as our Microsoft support has already declared this as 3rd party and asked us to reach out to Workday as this is not within the support of them.

Many thanks and best regards

Timo

Answer 1

Hello Tomokettner,

It is possible that the attribute in question is outside the scope for AAD synchronization. Here is a list of synchronized attributes and also some application specific only, like for Exchange or Sharepoint Online:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-sync-attributes-synchronized

-------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

We have a similar problem.
Our setup: Workday > AD Onpremises > AD Connect > AD Azure

We have a start state (multivalued user attribute populated at user object creation): cExtHYDCMVSpecialization : {MET, DISTRACT}

In workday we add a value : MRI
We initiate on-demand provisioning for this user object.
The connector does pick up this value as we can see:

But only writes MRI to the AD Onpremises user account object:

We initiate a new on-demand provisioning for this user object.
The connector again does pick up those current values as we can see:

But now writes everything but the MRI values to the AD Onpremises user account object:

And this loops trough every time we do a new on-demand provisioning. We never come to the desired state (which should be: {MET, DISTRACT, MRI}

Any insight is helpful. Thank you.

Answer 3

Hello all,

Thanks for the contributions!
We finally got a reply from Microsoft:

This issues has been flagged as a code fault on their end and will be patched in the next 1-2 weeks.