Azure AD Provisioning - Role Mapping

mrmacs

We're working on enabling Azure AD Provisioning and for the most part, all is working correctly. The one item that doesn't seem to be working correctly is when syncing the "role" mapping from AAD to SWSD. The problem is that when we provision a user, the user role in ServiceDesk is set to "Service Agent User". Additionally it will also change existing users to that role as well instead of "Requester". Obviously we don't want all end-users to have this type of role.

When the mapping was auto-setup, the attribute mapping for the "role" was set to an Expression of AppRoleAssignmentsComplex([appRoleAssignments]) Per the documentation, I set the Default Value if null field to "{"displayName":"Requester"} as well, so now the mapping looks like this:

That all said, I don't understand or know why the provisioned users are still getting changed/updated to Service Agent User and this is the last piece we need to get working because we can turn on provisioning for the tenant. Any assistance or tips/tricks on this is greatly appreciated.

SPSDude

Howdy @mrmacs,

This one is tricky to help explain over text, so you may want to reach out to your Account Manager and ask that they schedule a call with one of our Solution team members. (like me)

Roles should not be mapped in the section you're showing. In fact, it's probably best if that section is reset to the default mappings if it's been changed. Where the roles are assigned is in the Users and Groups section of the Enterprise Application.

There, you'll select either a User or a Group and assign it a Role. This is done best by using Security Groups that correspond to Role. For example, SWSD - Admins would map to the Administrator role where SWSD - Agents would map to the Service Agent user role.

Here's a link to the documentation:

I hope this helps, but if not, please reach out to your Account Manager and we'll get a call scheduled!