Using Software Model Subscription Condition with SSO Applications

[ChadO]

We're using SAM Pro with SaaS License Management integrated with Azure AD for license management, spend, etc.  We have quite a few SSO Applications that encompass multiple AD groups for granting different license types (e.g. reader, writer, admin, etc.).  Each SSO Application is associated with a Software Model and then we have one or more Software Entitlements associated with each Software Model for tracking spend, over and under utilization, etc.  Back when we were on Rome, there was no way to associate different license costs with different license types for subscriptions associated with SSO applications.  However, San Diego introduced the "Subscription Condition" field on the Software Model, which we can use to limit what the Software Model associates with.  In the "Subscription Condition" field, we can build conditions against the SSO Application role/group.  I've created a few Software Models and set the Subscription Conditions to apply to different AD groups for one of our SSO Applications but I'm not sure how we associate those Software Models with the SSO Application.  Does the association happen automatically somehow?  Is there something else I need to do to associate the multiple Software Models with the SSO Application?  Thanks in advance.

[James Rostron]

This field is not editable it is set after reconciliation runs. 

If you can elaborate a bit more on the integration bringing in those software subscription records (which your trying to add a condition to) I can maybe try and help but I'm not sure what it is your trying to achieve.

[Rithika B]

Thank you so much James for your prompt responses 🙂 Really appreciate it. I'm glad for your help considering the limited documentation SN provides. I am trying to reconcile a software which has different SSO groups associated with it. Steps are listed below :

1. For an application "ABC" we have licensed users and View only users

2. The licensed users and View only users are added to 2 different AD groups in Azure.

3. But since the application is only 1 for both of these, at the SSO application group level I can only add 1 model.

4. I have 3 software models in SN pertaining to the application - ABC model (product - ABC, version - anything, edition - anything), ABC Licensed User model (product - ABC, version - anything, edition - LIcensed users), ABC View Only user model (product - ABC, version - anything, edition - View only user)

5. In the SSO integrations, ABC model is added as the software model against the SSO application.

The AD groups - 'AD-licenseduser' and 'AD-Viewonlyuser' are listed under SSO applications groups

6. For the software model - ABC licensed user, I added the subscription condition as follows:

SSO subscription.SSO application  is "ABC"

AND

SSO subscription.SSO application role.SSO application groups.Directory group is AD-licenseduser

7. When I try to reconcile, my expectation is that only the users for the licensed users AD group would show against the software model - 'ABC licensed user' but that's not happening. All the users (licensed as well as view only) are reported against the software model - 'ABC any version/any edition' resulting in Non Compliance.

The subscriptions for 'ABC licensed user' model are showing as 0 instead of the number of licensed users. The status is "Compliant" because I have entitlements mapped to this model.

I hope that clarifies my concern. Any guidance is appreciated.

[Rithika B]

@James Rostron  - Are you able to help?

[James Rostron]

HI Rithika,

Sorry for the delay getting back to you.

It sounds like what you want to do is filter out completely the "view only users". You can do this by using the "license under management" flag on the software model but you need to get the model to correctly associate to the subscription records first before they are filtered out of your compliance scores.

Did you add the "licensable software model" column to your subscription table? If you didn't please add this and let me know what model is appearing in this field for both your view only users and your licensable users. If easier just add a screenshot so I can take a look (redact any usernames/upns if you can).

Thanks,

James

[Rithika B]

Hello James, thank you for your response 🙂 

The licensable software model is not editable for me 

I have added screenshots in my previous explanation about how I am setting up the subscription conditions, am I missing something there?