I am trying to understand AzureAD Provisioning and ServiceNow. Group provisioning is OOTB and set to map on the Group NAME field, and it does. However, AzureAD is storing the ServiceNow ID for the group (SYSID) from the initial match and then using it as part of later provisioning synchronisations.
My objective is to determine:
To force a test I have made some group changes in ServiceNow to test how AzureAD Provisioning is working and caused a failure in provisioning I would like to understand.
Failure Analysis
Sorry, dont have enough points to post an image so here is a table of the results
EntryImportByJoiningProperty
Result | Success |
Description | A target entry in ServiceNow has been matched with the source entry by matching attribute name: Test Provisioning Group |
Active | 1 |
Name | Test Provisioning Group |
Sys_id | 8bd8394e2f2b0110fc1e52172799b6e2 |
EntryImport
Result | Success |
Description | Retrieved 'Test Provisioning Group Renamed' from ServiceNow |
Active | 1 |
Description | Testing AzureAD provisioning issues |
Name | |
Test | Provisioning Group Renamed |
Sys_id | 31f1f3792f630110fc1e52172799b6fa |
Whenever an object (user, group..) is created or located for the first time, the target system ID value (sys_id for ServiceNow SOAP API) is stored internally to the provisioning service. That value cannot be manually cleared. Your options are either to remove the original group entirely so that the next time AAD Provisioning attempts to locate the first group via sys_id it fails and reverts to searching again by friendly name, OR restart provisioning via MS Graph API with a resetScope of Full, which will clear the provisioning internal mapping of ID values between systems.
This data surrounding links between source/target systems is not accessible to you, it's only visible to the provisioning service. In general, I'd recommend not doing what you've described - it isn't an expected scenario for AAD Provisioning. It raises the question - why are you renaming the group in ServiceNow and trying to replace it with another group that would end up in the same state?
MS Graph restart API doc: https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-restart?view=graph-rest-beta&tabs=http