Description
Microsoft AZURE provisioning only targets sys_user and optionally sys_group tables
Problem
Microsoft AZURE does not create records in ServiceNow tables other than sys_user, or optionally sys_group. Some customers would like to map other tables like location, company, etc.
Cause
The provisioning service does resolve references between a sys_user records and other ServiceNow tables, but it does not create records in other tables like cmn_location.
Resolution
Microsoft Azure provisioning is not a ServiceNow product. Please contact Microsoft for specific questions.
The typical Azure user provisioning flow is as follows:
- Azure AD sync service looks up assigned users in scope for provisioning in Azure AD.
- If new users have been assigned or otherwise added to the scope since the last sync, Azure AD sync service queries ServiceNow to see if those users exist.
- If user does not exist in ServiceNow, a new user is created in sys_user table.
- If user does exist, then it is updated with any user attributes found to be out of sync.
- After the steps above have completed, the Azure AD sync service queries for any ServiceNow reference attributes specified in the Azure AD sync attribute mappings.
- The Azure AD sync service then updates the user record with the reference attribute values.
If location is configured as one of the target attributes to sync to in the attribute mappings, the sync service should be updating that field.
The provisioning service does resolve references between a sys_user record and other ServiceNow tables, but it does not create records in other tables like cmn_location.
| Warning: Some reference fields have Enable dynamic creation enabled. When dynamic creation is enabled, entering a nonexistent value in a reference field creates a new record on the referenced table instead of returning an error. |