Skip to content

User Groups from Entra ID Groups

Info

New in Atfinity 18.

With Load user groups from Entra ID groups switched on in the SCIM tab, the groups assigned to the enterprise application become user groups with the members Entra ID provisions. It needs SCIM provisioning set up first, and it cannot be on while Load roles and groups on login is on in the SAML or OpenID Connect tab. Assigning groups to an application needs Entra ID P1 or P2.

Setting it up

  1. Switch on Load user groups from Entra ID groups first, since Atfinity refuses group requests while it is off.
  2. In the attribute mappings, turn on provisioning of groups and keep its default mappings: displayName as the matching attribute, objectId to externalId, and members.
  3. Assign the groups to the enterprise application.

Linking groups to user groups

Entra ID looks a group up by its name, ignoring case, so a user group you already use keeps its members and permissions and is taken over the first time Entra ID updates it. Otherwise Entra ID creates the group, and Atfinity first looks for a user group with the group's object ID. That finds a user group renamed in Atfinity, which Entra ID can no longer find by its name, and Atfinity takes it over under the group's name instead of creating a second one. When an ordinary user group still holds the object ID, for example one renamed while loading user groups was off, the user group Entra ID finds by name takes the object ID over. A name another user group already has is refused, so Entra ID reports an error for that group.

While loading user groups is on, a user group from Entra ID shows Managed by SCIM and the group's object ID, and cannot be renamed in Atfinity. A configuration import neither renames nor deletes it, since it exists only in this environment. A user group in the imported configuration with the same name is skipped, and one the import would rename to that name keeps its name. Renaming the group in Entra ID renames the user group.

Members

Entra ID adds and removes the members of the user group as they change in the group. Only direct members are provisioned, so the members of a group nested inside an assigned group are not added. The nested group is never a member of the user group either, and if it is assigned to the application itself, it becomes a user group of its own.

Entra ID only ever adds and removes the users it provisions, so a user it no longer manages, for example after provisioning was switched off and on, is skipped until Entra ID updates them again.

In a user group from Entra ID, provisioned users follow Entra ID. The user form and the user import cannot add a provisioned user to it, and cannot remove a membership Entra ID made, so the user form greys out those checkboxes. A membership of a provisioned user that Entra ID did not make, such as one from before Entra ID took the user group over or one added while loading user groups was off, can still be removed, but not added again. Entra ID does not see those memberships, so they stay until you remove them or Entra ID adds that user to the group, which turns the membership into one Entra ID made. When Entra ID removes one particular provisioned user from the group, it removes their membership whoever made it. You still add and remove users Entra ID does not provision, such as local accounts, as in any other user group.

Deleting and unassigning

Deleting the group in Entra ID, or removing it from the application, removes the memberships Entra ID made. Entra ID first deactivates the users assigned to the application only through that group. The user group is deleted when no other members remain. Otherwise it stays with the memberships you made, as an ordinary user group that keeps the group's object ID. If the group is assigned again, Entra ID takes the user group over again as described in Linking groups to user groups: by its name the first time it updates it, or by the object ID when the user group was renamed in Atfinity and Entra ID creates the group again. Deleting or unassigning a group whose user group is no longer managed by SCIM changes nothing in Atfinity.

A user group from Entra ID that you delete in Atfinity is created again, with Entra ID's members only, the next time Entra ID processes the group.

Switching it off

Switching loading user groups or provisioning off keeps every user group and its members, and they become ordinary user groups. Atfinity no longer reports their object ID, so after switching it on again, Entra ID sends the object ID the next time it processes each group, which takes the user group back over. When Entra ID takes a user group back over, the memberships it made are its own again, and the ones you added in the meantime stay yours.