Skip to main content

Azure AD User Provisioning and SSO

user provisioning is a direct web service using REST APIs connecting to the sys_user table (and optionally sys_user_group)

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/servicenow-provisioning-tutorial

https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-works

https://www.youtube.com/watch?v=oUIq3Ue1djE

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0655991

Microsoft Azure provisioning is not a ServiceNow product. Please contact Microsoft for specific questions.

The typical Azure user provisioning flow is as follows:

  1. Azure AD sync service looks up assigned users in scope for provisioning in Azure AD.
  2. If new users have been assigned or otherwise added to the scope since the last sync, Azure AD sync service queries ServiceNow to see if those users exist.
  3. If user does not exist in ServiceNow, a new user is created in sys_user table.
  4. If user does exist, then it is updated with any user attributes found to be out of sync.
  5. After the steps above have completed, the Azure AD sync service queries for any ServiceNow reference attributes specified in the Azure AD sync attribute mappings.
  6. The Azure AD sync service then updates the user record with the reference attribute values.
     
    If location is configured as one of the target attributes to sync to in the attribute mappings, the sync service should be updating that field.
     
    The provisioning service does resolve references between a sys_user record and other ServiceNow tables, but it does not create records in  other tables like cmn_location. 

SSO:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/servicenow-tutorial

Comments

Post a Comment

Popular posts from this blog

ServiceNow check for null or nil or empty (or not)

Haven't tested these all recently within global/local scopes, so feel free to have a play! option 1 use an encoded query embedded in the GlideRecord , e.g.  var grProf = new GlideRecord ( 'x_cls_clear_skye_i_profile' ); grProf . addQuery ( 'status=1^ owner=NULL ' ); grProf . query (); even better use the glideRecord  addNotNullQuery or addNullQuery option 2 JSUtil.nil / notNil (this might be the most powerful. See this link ) example: if ( current . operation () == 'insert' && JSUtil . notNil ( current . parent ) && ! current . work_effort . nil ())  option 3 there might be times when you need to get inside the GlideRecord and perform the check there, for example if the code goes down 2 optional routes depending on null / not null can use gs.nil : var grAppr = new GlideRecord ( 'sysapproval_approver' ); var grUser = new GlideRecord ( 'sys_user' ); if ( grUser . get ( 'sys_id' , current . approver )){
Post a Comment
Read more

Service Catalog: variable advanced reference qualifiers

Call a script include to apply a reference qualifier on a catalog item variable: - variable reference qualifier dependent on another variable selection, in this case a variable referencing sys_user (requested_for) On the catalog item form. variable name to apply ref qual filter : retail_equipment variable reference qualifier (on cmdb table ): javascript : new  refqual_functions (). lostStolen_getAssignedCIs (); client-callable script include ( refqual_functions)  function : lostStolen_getAssignedCIs : function (){         //--called from variable set client script, for lost/stolen request (service catalog)     gs . log ( current . variables . requested_for , 'retail_lostStolen_getAssignedCIs' );         return ( 'install_statusNOT IN8,7^owned_by=' + current . variables . requested_for );             //owned_by=1269b79937f1060041c5616043990e41^install_statusNOT IN8,7            },
Post a Comment
Read more