IntegractionHub Microsoft Active Directory V2 spoke question

[EricG2]

I'm having issues adding a Contact Object to an Active Directory security group.

We have instances where users from other domains are required to have an account created on the parent domain.  Therefore the difference between user and contact objects.

I've had a lot of success finding user records, verifying the are/are not in a group, and then finally adding that record.

I can also find the Contact Object easily enough too.

However, when I use the Add User to security group activity in IntegrationHub, an error occurs when i add the contact object to it.

According to some searches i've done there should be an activity called Add Object to security group.  I'm not able to find this in my instance or on the platform documentation where that activity is included.

Can someone supply direction or help getting this done?

[Ankita Bisht]

Hi @EricG2  What error you get when you used the Add User to Group action in flow?

How you are able to access the contact object which Microsoft Active Directory V2 spoke action you used?

[J Siva]

Hi @EricG2 

The OOB "Add User to Group" action uses the Add-ADPrincipalGroupMembership cmdlet to add users to groups.

According to the Microsoft documentation, the Add-ADPrincipalGroupMembership cmdlet can be used only to add a user, group, service account, or computer as a new member of one or more Active Directory groups.

If you want to add a contact object to a group, you will need to create a custom action using a custom PowerShell script, as the oob action does not support adding contact objects to groups.

Regards
Siva

[J Siva]

Custom Spoke:

1. Mid server script:

Import-Module ActiveDirectory -WarningAction SilentlyContinue
 
if (test-path env:\SNC_contactObj) 
{
    $contactobj=$env:SNC_contactObj;
}
if (test-path env:\SNC_groupName) 
{
    $groupname=$env:SNC_groupName;
}
 
$contactobj= $contactobj-replace "%27","'";
$groupname = $groupname -replace "%27","'";
  try
  {
    $result = Set-ADGroup -Identity $groupname -Add @{'member'=$contactobj} -Credential $cred -Server $computer
    $status = "Success"
  }
  catch
  {
    $result = $_.Exception.Message
    $status = "Error"
  }
 
$response = @{
status = $status
body = $result
} | convertTo-Json
 
Write-Output $response

 2. Custom Action:

Note:

This is a simple custom Spoke and script used to add a contact object to an AD group. It has been tested and is working fine. You can enhance it further based on your requirements.

[EricG2]

Thanks everyone for responding.

@J Siva I tried your script and it appears to work.

However i got the error of "Access Denied".

When I spoke to our AD Technicians, I was advised the adding the Contact Object automatically was not possible since the security group was not tied to a mail box.

So i'm not able to complete the validation at this time and need to move the project forward.

I will get back to this at some time later to attempt the same thing with another security group.
Thanks again for you help.