Azure User Provisioning - Adding department "create"

john_duchock · ‎09-24-2018

We are using azure integration to create users, groups and group members.

Upon configuring the system, we found that if the cmn_department table was populated with same values as what are in azure, the department field on the user record populated properly, however if the value on the user record in azure does not exist in cmn_department, the user record would not be updated.

On a typical transform map, you can set "choice actions" to create, ignore and reject. If "create" is chosen, the transform map will create the necessary values in your table (much like discover creates new core_company records). However, i cannot seem to find where to set up ServiceNow to "create" new departments that come over on a user record from azure.

Can anyone point me to a resource or explain what needs to be done (and if it should be done on the IDP transform map).

Thanks

John

Mike91 · ‎12-10-2019

Hi John,

I've stumbled on your question here a year later with (I think) the same goal in mind: use Azure AD User Provisioning to add/create Departments that don't exist within your ServiceNow instance.

ServiceNow posted a Knowledge Base article that says that the Azure AD User Provisioning service is able to update sys_user or sys_group tables, but NOT cmn_ tables (such as cmn_department). Here's a link to the article that includes more information: https://hi.service-now.com/kb_view.do?sysparm_article=KB0655991

Another point I'd like to touch on was when you said "however if the value on the user record in azure does not exist in cmn_department, the user record would not be updated" - I believe this might be due to your setup in Azure AD. If you navigate to the ServiceNow integration from Azure AD, go to Manage > Provisioning > Mapping and click the name of the attributes mapping (ours is "Synchronize Azure Active Directory Users to ServiceNow"). Find Department on the list and click on it. If "Match objects using this attribute" is set to Yes, then I believe it will cause the behavior of skipping the update on the entire user record. I have this toggled to No and all of our users profiles are updated, albeit with many errors where the Department field doesn't align with what's available in ServiceNow (due to a bigger issue with how our HR system tracks and feeds Departments and Business Units into AD).

Given the amount of time that has passed, I'm not sure that this response will prove useful to you, but I hope it will benefit others such as myself who stumble upon your question in the future. Did you ever resolve this?

Mike

View solution in original post

Tejaswini9 · ‎02-15-2021

Hello Roy,

Thank you so much for your quick response, The requirement from the client is "Based on the Usage Location ( which is an attribute in the azure) say if Usage Location is "France" , "Belgium" , "Italy" , "Poland" only the users in azure from these countries should be created an account through automatic user provisioning.

Is there any possibility to add these conditions in the servicenow ( could you please elaborate if possible)

Any suggestions you provide will be very helpful for me.

Thanks and Regards,

Tejaswini

Roy13 · ‎03-04-2021

Hello,

Sorry for the late reply, The way to do this would be with a Business rule, with the following conditions:

Table: sys_user

1) When = Before

2) Insert is ticked

3) Advanced is ticked

3) In the filter conditions use the filters as required. (ie location = "France"....)

In the advanced tab use the following code:

current.setAbortAction(true)

PS: Keep in mind that this will also abort addition of users that are manually added. (If ever)

Tejaswini9 · ‎03-04-2021

Thank you:)

Tejaswini9 · ‎03-14-2021

Hello,

please help me on this.

We have setup the sso with microsoft azure and everything is working fine, i also provided the login url to access the servicenow application in this format.

https://Mycompany.servicenow.com/login_with_sso.do?glide_sso_id=4811018f1bb265643b604eac8ec4bcb36 ---------> Is this Service provider initiated login url

when they enter this url it will redirect them to the azure login screen and it works fine

Is this the same url we provide to our end users?

Or do we have any url format for accessing the snow application from the azure end as well? like IDP initiated Login??

Please guide me i do not have any knowledge on the azure side and i need to confirm this with my customers

Roy13 · ‎03-20-2021

Hey, I am not too sure about this but I think you can provide this URL.