Scoping filter for user provisioning based on group membership

Question

We have an enterprise application in our Azure AD tenant where we have enabled automatic user provisioning to provision users in the external service. We have assigned several groups to the application, and the provisioning scope is set to Sync only assigned users and groups. This currently provisions all users in the groups assigned to the enterprise application.

We would like to add an additional scope filter, so that we can provision members of the assigned groups that is also a member of a different group (which is not directly assigned to the enterprise application). I've looked at adding a scope filter, but none of the available attributes seems to be usable for checking group membership. I imagined I would find something like an isMemberOf target attribute, but this does not seem to exist.

Is is possible to achieve such scope filtering?

Answer 1

You can work around this with Azure AD's extension attributes which you can then set based on group membership and use them for filtering in the scope filter in the Enterprise application.

I have recently published a whole blog post outlining this process and full automation - https://hajekj.net/2023/09/18/entra-id-user-and-group-provisioning-with-bitwarden/

Answer 2

As the article said, The IsMemberOf filter is not supported currently.

Attribute mappings for groups: Provisioning of the group name and group details, in addition to the members, if supported for some applications.

The following is groupt attribute mapping: