I need to auto provision users to correct role based on couple of attributes in user profile. Considering that there would be 1k+ attribute combinations and will increase in future, its not possible to manually write a role Rule for all.
Is it possible to setup a single script where it automatically checks for user attributes(ex office + designation) in user profile and based on the combination assigns correct role to the user?
Yes, you are correct. This is the underlaying intent.
But these two dynamic values, ‘office’ and ‘designation’ can change in number based on HR data. It may be 1k combinations today, 1.5k next month, 1.2k next.
What I am trying to figure out is: if there is any possibility of dynamic coding where we need not to revisit these roles every month and have to manually clean up these roles.
Like a single script that runs somewhere which sees:
1. Check $office and $designation:
- Assign $office_$designation role.
2. If user’s $office and/or $designation changes:
- Remove earlier role
- Assign new $office_$designation role.
3. User’s lifecycle changes
- Remove user from role.
This will help in 2 things:
1. We do not need to manually keep all role criteria up to date.
2. For any new $office or $designation introduced later, we only need to create group in Entra ID with respective name. Rest is up to the code to make sure user is assigned correct role.
Once you have the roles created, the membership criteria will automatically assign new roles as people change and unassign their previous.
I think what you need is for HR to follow a standard change process to create these seemingly arbitrary items.
The only way this works headlessly is to:
1) have the new office and designations BEFORE they exist
2) run it through a script that will:
a) create the entra group
b) run an entra entitlement aggrgation in IdN
c) create the access profile adding the new entra group using the API
d) Create a role for it using the API
e) add the access profile to the role using the API
f) add the membership criteria to the role using the API
g) enable the role and access profile using the API
h) run a sync using the API
not sure how you will decide what roles need to be removed.