azure-ad.sgnl.yaml

# Azure AD Configuration YAML for DS2.0
displayName: "Azure AD"
icon: |
  PHN2ZyB3aWR0aD0iNjQiIGhlaWdodD0iNjQiIHZpZXdCb3g9IjAgMCA2NCA2NCIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHJlY3Qgd2lkdGg9IjY0IiBoZWlnaHQ9IjY0IiBmaWxsPSIjMDEzRjg2Ii8+CjxwYXRoIGQ9Ik0xMi4yNzYzIDMyLjk1NTVMMzIgNDUuODI2MVY5LjVMMTIuMjc2MyAzMi45NTU1WiIgZmlsbD0iIzRGRTZGRiIvPgo8cGF0aCBkPSJNOCAzOC4wNTA0TDMyIDUzLjk3ODZWNDguODUwN0wxMC43NjY1IDM0Ljc1NzhMOCAzOC4wNTA0WiIgZmlsbD0iIzRGRTZGRiIvPgo8cGF0aCBkPSJNNTYgMzguMDUwNEwzMiA1My45Nzg2VjQ4Ljg1MDdMNTMuMjMzNSAzNC43NTc4TDU2IDM4LjA1MDRaIiBmaWxsPSIjMzY5QkU1Ii8+CjxwYXRoIGQ9Ik01MS43MjM3IDMyLjk1NTVMMzIgNDUuODI2MVY5LjVMNTEuNzIzNyAzMi45NTU1WiIgZmlsbD0iIzQyQTJFOCIvPgo8cGF0aCBkPSJNMTIuMjgxMiAzMi45NTA2TDEyLjI3NjMgMzIuOTU1NUwzMiA0NS44MjYxVjI4LjI0NzNMMTIuMjgxMiAzMi45NTA2WiIgZmlsbD0iIzk5RUNGQSIvPgo8cGF0aCBkPSJNNTEuNzIgMzIuOTUwNkw1MS43MjM3IDMyLjk1NTVMMzIgNDUuODI2MVYyOC4yNDczTDUxLjcyIDMyLjk1MDZaIiBmaWxsPSIjNTJCMURGIi8+Cjwvc3ZnPg==
description: "Azure AD as a System of Record"
hostname: "graph.microsoft.com"
defaultSyncFrequency: HOURLY
defaultSyncMinInterval: 1
defaultApiCallFrequency: SECONDLY
defaultApiCallMinInterval: 1
type: "AzureAD-1.0.1"
# Example Config:
# {"requestTimeoutSeconds": 10, "apiVersion": "v1.0"}
adapterConfig: "eyJyZXF1ZXN0VGltZW91dFNlY29uZHMiOiAxMCwgImFwaVZlcnNpb24iOiAidjEuMCJ9"
# All auth mechanisms specified below must be supported by the specified Adapter.
auth:
  - oAuth2ClientCredentials:
      clientId: "{{Input Required: Client-ID}}"
      scope: "https://graph.microsoft.com/.default"
      tokenUrl: "https://login.microsoftonline.com/{{Input Required: Tenant-ID}}/oauth2/v2.0/token"
      authStyle: InParams
      clientSecret: "{{Input Required: Client-Secret}}"
entities:
  # Configuring complex attributes will cap the page size in AAD's API response to 100.
  # See: https://learn.microsoft.com/en-us/graph/known-issues?view=graph-rest-1.0#some-limitations-apply-to-query-parameters
  # We use the `$expand` filter to retrieve complex attributes.
  User:
    displayName: User
    externalId: User
    description: User Entity in Azure AD
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        description: ID of the user
        type: String
        indexed: true
        uniqueId: true
      - name: userPrincipalName
        externalId: userPrincipalName
        type: String
        indexed: true
      - name: displayName
        externalId: displayName
        type: String
      - name: givenName
        externalId: givenName
        type: String
      - name: jobTitle
        externalId: jobTitle
        type: String
      - name: mail
        externalId: mail
        type: String
        indexed: true
      - name: mobilePhone
        externalId: mobilePhone
        type: String
      - name: officeLocation
        externalId: officeLocation
        type: String
      - name: preferredLanguage
        externalId: preferredLanguage
        type: String
      - name: surname
        externalId: surname
        type: String
      - name: accountEnabled
        externalId: accountEnabled
        type: Bool
      - name: ageGroup
        externalId: ageGroup
        type: String
      - name: city
        externalId: city
        type: String
      - name: companyName
        externalId: companyName
        type: String
      - name: consentProvidedForMinor
        externalId: consentProvidedForMinor
        type: String
      - name: country
        externalId: country
        type: String
      - name: createdDateTime
        externalId: createdDateTime
        type: DateTime
      - name: creationType
        externalId: creationType
        type: String
      - name: deletedDateTime
        externalId: deletedDateTime
        type: DateTime
      - name: department
        externalId: department
        type: String
      - name: employeeHireDate
        externalId: employeeHireDate
        type: DateTime
      - name: employeeId
        externalId: employeeId
        type: String
      - name: employeeType
        externalId: employeeType
        type: String
      - name: externalUserState
        externalId: externalUserState
        type: String
      - name: externalUserStateChangeDateTime
        externalId: externalUserStateChangeDateTime
        type: DateTime
      - name: faxNumber
        externalId: faxNumber
        type: String
      - name: ipAddress
        externalId: ipAddress
        type: String
      - name: isResourceAccount
        externalId: isResourceAccount
        type: Bool
      - name: lastPasswordChangeDateTime
        externalId: lastPasswordChangeDateTime
        type: DateTime
      - name: legalAgeGroupClassification
        externalId: legalAgeGroupClassification
        type: String
      - name: mailNickname
        externalId: mailNickname
        type: String
        # Configuring `manager__id` will cause the page size in the AAD Users API to be capped at 100.
      - name: manager__id
        externalId: manager__id
        type: String
        indexed: true
      - name: onPremisesDistinguishedName
        externalId: onPremisesDistinguishedName
        type: String
      - name: onPremisesDomainName
        externalId: onPremisesDomainName
        type: String
      - name: onPremisesImmutableId
        externalId: onPremisesImmutableId
        type: String
      - name: onPremisesLastSyncDateTime
        externalId: onPremisesLastSyncDateTime
        type: DateTime
      - name: onPremisesSamAccountName
        externalId: onPremisesSamAccountName
        type: String
      - name: onPremisesSecurityIdentifier
        externalId: onPremisessecurityIdentifier
        type: String
      - name: onPremisesSyncEnabled
        externalId: onPremisesSyncEnabled
        type: Bool
      - name: onPremisesUserPrincipalName
        externalId: onPremisesUserPrincipalName
        type: String
      - name: passwordPolicies
        externalId: passwordPolicies
        type: String
      - name: postalCode
        externalId: postalCode
        type: String
      - name: preferredDataLocation
        externalId: preferredDataLocation
        type: String
      - name: showInAddressList
        externalId: showInAddressList
        type: Bool
      - name: signInSessionsValidFromDateTime
        externalId: signInSessionValidFromDateTime
        type: DateTime
      - name: state
        externalId: state
        type: String
      - name: streetAddress
        externalId: streetAddress
        type: String
      - name: usageLocation
        externalId: usageLocation
        type: String
      - name: userType
        externalId: userType
        type: String
      - name: businessPhones
        externalId: businessPhones
        type: String
        list: true
      - name: proxyAddresses
        externalId: proxyAddresses
        type: String
        list: true
      - name: otherMails
        externalId: otherMails
        type: String
        list: true
      - name: employeeOrgData__costCenter
        externalId: employeeOrgData__costCenter
        type: String
      - name: employeeOrgData__division
        externalId: employeeOrgData__division
        type: String
      - name: passwordProfile__forceChangePasswordNextSignIn
        externalId: passwordProfile__forceChangePasswordNextSignIn
        type: Bool
      - name: passwordProfile__forceChangePasswordNextSignInWithMfa
        externalId: passwordProfile__forceChangePasswordNextSignInWithMfa
        type: Bool
  Group:
    description: "Group Entity in Azure AD"
    displayName: Group
    externalId: Group
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: classification
        externalId: classification
        type: String
      - name: createdDateTime
        externalId: createdDateTime
        type: DateTime
      - name: creationOptions
        externalId: creationOptions
        type: String
        list: true
      - name: deletedDateTime
        externalId: deletedDateTime
        type: DateTime
      - name: description
        externalId: description
        type: String
      - name: displayName
        externalId: displayName
        type: String
      - name: expirationDateTime
        externalId: expirationDateTime
        type: DateTime
      - name: groupTypes
        externalId: groupTypes
        type: String
        list: true
      - name: isAssignableToRole
        externalId: isAssignableToRole
        type: Bool
      - name: mail
        externalId: mail
        type: String
      - name: mailEnabled
        externalId: mailEnabled
        type: Bool
      - name: mailNickname
        externalId: mailNickname
        type: String
      - name: membershipRule
        externalId: membershipRule
        type: String
      - name: membershipRuleProcessingState
        externalId: membershipRuleProcessingState
        type: String
      - name: onPremisesDomainName
        externalId: onPremisesDomainName
        type: String
      - name: onPremisesLastSyncDateTime
        externalId: onPremisesLastSyncDateTime
        type: DateTime
      - name: onPremisesNetBiosName
        externalId: onPremisesNetBiosName
        type: String
      - name: onPremisesSamAccountName
        externalId: onPremisesSamAccountName
        type: String
      - name: onPremisesSecurityIdentifier
        externalId: onPremisesSecurityIdentifier
        type: String
      - name: onPremisesSyncEnabled
        externalId: onPremisesSyncEnabled
        type: Bool
      - name: preferredDataLocation
        externalId: preferredDataLocation
        type: String
      - name: preferredLanguage
        externalId: preferredLanguage
        type: String
      - name: proxyAddresses
        externalId: proxyAddresses
        type: String
        list: true
      - name: renewedDateTime
        externalId: renewedDateTime
        type: DateTime
      - name: resourceBehaviorOptions
        externalId: resourceBehaviorOptions
        type: String
        list: true
      - name: resourceProvisioningOptions
        externalId: resourceProvisioningOptions
        type: String
        list: true
      - name: securityEnabled
        externalId: securityEnabled
        type: Bool
      - name: securityIdentifier
        externalId: securityIdentifier
        type: String
      - name: theme
        externalId: theme
        type: String
      - name: visibility
        externalId: visibility
        type: String
      - name: assignedLabels
        externalId: assignedLabels
        type: String
        list: true
      - name: licenseProcessingState
        externalId: licenseProcessingState
        type: String
  GroupMember:
    description: "Group Member Entity in Azure AD"
    displayName: GroupMember
    externalId: GroupMember
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: groupId
        externalId: groupId
        type: String
        indexed: true
      - name: memberId
        externalId: memberId
        type: String
        indexed: true
  Application:    
    description: "Application Entity in Azure AD"
    displayName: Application
    externalId: Application
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: appId
        externalId: appId
        type: String
        indexed: true
      - name: tags
        externalId: tags
        type: String
        list: true
      - name: applicationTemplateId
        externalId: applicationTemplateId
        type: String
      - name: certification__certificationDetailsUrl
        externalId: certification__certificationDetailsUrl
        type: String
      - name: certification__certificationExpirationDateTime
        externalId: certification__certificationExpirationDateTime
        type: DateTime
      - name: certification__isCertifiedByMicrosoft
        externalId: certification__isCertifiedByMicrosoft
        type: Bool
      - name: certification__isPublisherAttested
        externalId: certification__isPublisherAttested
        type: Bool
      - name: certification__lastCertificationDateTime
        externalId: certification__lastCertificationDateTime
        type: DateTime
      - name: createdDateTime
        externalId: createdDateTime
        type: DateTime
      - name: deletedDateTime
        externalId: deletedDateTime
        type: DateTime
      - name: description
        externalId: description
        type: String
      - name: disabledByMicrosoftStatus
        externalId: disabledByMicrosoftStatus
        type: String
      - name: displayName
        externalId: displayName
        type: String
      - name: groupMembershipClaims
        externalId: groupMembershipClaims
        type: String
      - name: identifierUris
        externalId: identifierUris
        type: String
        list: true
      - name: isDeviceOnlyAuthSupported
        externalId: isDeviceOnlyAuthSupported
        type: Bool
      - name: isFallbackPublicClient
        externalId: isFallbackPublicClient
        type: Bool
      - name: keyCredential__displayName
        externalId: keyCredential__displayName
        type: String
      - name: keyCredential__endDateTime
        externalId: keyCredential__endDateTime
        type: DateTime
      - name: keyCredential__keyId
        externalId: keyCredential__keyId
        type: String
      - name: keyCredential__startDateTime
        externalId: keyCredential__startDateTime
        type: DateTime
      - name: keyCredential__type
        externalId: keyCredential__type
        type: String
      - name: keyCredential__usage
        externalId: keyCredential__usage
        type: String
      - name: notes
        externalId: notes
        type: String
      - name: oauth2RequiredPostResponse
        externalId: oauth2RequiredPostResponse
        type: Bool
      - name: parentalControlSettings__countriesBlockedForMinors
        externalId: parentalControlSettings__countriesBlockedForMinors
        list: true
        type: String
      - name: parentalControlSettings__legalGroupRule
        externalId: parentalControlSettings__legalGroupRule
        type: String
      - name: passwordCredential__displayName
        externalId: passwordCredential__displayName
        type: String
      - name: passwordCredential__endDateTime
        externalId: passwordCredential__endDateTime
        type: DateTime
      - name: passwordCredential__keyId
        externalId: passwordCredential__keyId
        type: String
      - name: passwordCredential__startDateTime
        externalId: passwordCredential__startDateTime
        type: DateTime
      - name: publisherDomain
        externalId: publisherDomain
        type: String
      - name: requestSignatureVerification__allowedWeakAlgorithms
        externalId: requestSignatureVerification__allowedWeakAlgorithms
        type: String
      - name: requestSignatureVerification__isSignedRequestRequired
        externalId: requestSignatureVerification__isSignedRequestRequired
        type: Bool
      - name: samlMetadataUrl
        externalId: samlMetadataUrl
        type: String
      - name: serviceManagementReference
        externalId: serviceManagementReference
        type: String
      - name: signInAudience
        externalId: signInAudience
        type: String
      - name: verifiedPublisher__addedDateTime
        externalId: verifiedPublisher__addedDateTime
        type: DateTime
      - name: verifiedPublisher__displayName
        externalId: verifiedPublisher__displayName
        type: String
      - name: verifiedPublisher__verifiedPublisherId
        externalId: verifiedPublisher__verifiedPublisherId
        type: String
      - name: webApplication__homePageUrl
        externalId: webApplication__homePageUrl
        type: String
      - name: webApplication__logoutUrl
        externalId: webApplication__logoutUrl
        type: String
  Device:    
    description: "Device Entity in Azure AD"
    displayName: Device
    externalId: Device
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: accountEnabled
        externalId: accountEnabled
        type: Bool
      - name: approximateLastSignInDateTime
        externalId: approximateLastSignInDateTime
        type: DateTime
      - name: complianceExpirationDateTime
        externalId: complianceExpirationDateTime
        type: DateTime
      - name: deviceCategory
        externalId: deviceCategory
        type: String
      - name: deviceId
        externalId: deviceId
        type: String
        indexed: true
      - name: deviceMetadata
        externalId: deviceMetadata
        type: String
      - name: deviceOwnership
        externalId: deviceOwnership
        type: String
      - name: deviceVersion
        externalId: deviceVersion
        type: Int64
      - name: displayName
        externalId: displayName
        type: String
      - name: enrollmentProfileName
        externalId: enrollmentProfileName
        type: String
      - name: isCompliant
        externalId: isCompliant
        type: Bool
      - name: isManaged
        externalId: isManaged
        type: Bool
      - name: manufacturer
        externalId: manufacturer
        type: String
      - name: mdmAppId
        externalId: mdmAppId
        type: String
      - name: model
        externalId: model
        type: String
      - name: onPremisesLastSyncDateTime
        externalId: onPremisesLastSyncDateTime
        type: DateTime
      - name: onPremisesSyncEnabled
        externalId: onPremisesSyncEnabled
        type: Bool
      - name: operatingSystem
        externalId: operatingSystem
        type: String
      - name: operatingSystemVersion
        externalId: operatingSystemVersion
        type: String
      - name: physicalIds
        externalId: physicalIds
        type: String
        list: true
      - name: profileType
        externalId: profileType
        type: String
      - name: registrationDateTime
        externalId: registrationDateTime
        type: DateTime
      - name: registeredOwner
        externalId: $.registeredOwners[0].id
        type: String
        attributeAlias: deviceRegisteredOwner
        indexed: true
      - name: systemLabels
        externalId: systemLabels
        type: String
        list: true
      - name: trustType
        externalId: trustType
        type: String
  Role:
    description: "Directory Role Entity in Azure AD"
    displayName: Role
    externalId: Role
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: displayName
        externalId: displayName
        type: String
        indexed: true
      - name: description
        externalId: description
        type: String
      - name: roleTemplateId
        externalId: roleTemplateId
        type: String
      - name: deletedDateTime
        externalId: deletedDateTime
        type: DateTime
  RoleMember:    
    description: "Directory Role Member Entity in Azure AD"
    displayName: RoleMember
    externalId: RoleMember
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: roleId
        externalId: roleId
        type: String
        indexed: true
      - name: memberId
        externalId: memberId
        type: String
        indexed: true      
  RoleAssignment:    
    description: "Role Assignment in Azure AD"
    displayName: RoleAssignment
    externalId: RoleAssignment
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: principalId
        externalId: principalId
        type: String
      - name: roleDefinitionId
        externalId: roleDefinitionId
        type: String
  RoleRequest:    
    description: "Role Assignment Schedule Request in Azure AD"
    displayName: RoleRequest
    externalId: RoleAssignmentScheduleRequest
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: action
        externalId: action
        type: String
      - name: approvalId
        externalId: approvalId
        type: String
      - name: justification
        externalId: justification
        type: String
      - name: principalId
        externalId: principalId
        type: String
      - name: completedDateTime
        externalId: completedDateTime
        type: DateTime
      - name: createdDateTime
        externalId: createdDateTime
        type: DateTime
  GroupRequest:    
    description: "Group Assignment Schedule Request in Azure AD"
    displayName: GroupRequest
    externalId: GroupAssignmentScheduleRequest
    pageSize: 999
    pagesOrderedById: false
    attributes:
      - name: id
        externalId: id
        type: String
        indexed: true
        uniqueId: true
      - name: accessId
        externalId: accessId
        type: String
      - name: approvalId
        externalId: approvalId
        type: String
      - name: groupId
        externalId: groupId
        type: String
      - name: principalId
        externalId: principalId
        type: String
      - name: status
        externalId: status
        type: String
      - name: action
        externalId: action
        type: String
      - name: completedDateTime
        externalId: completedDateTime
        type: DateTime

relationships:
  UserRoleMember:
    name: Member
    displayName: User Role Member
    fromAttribute: RoleMember.memberId
    toAttribute: User.id
  RoleMember:
    name: Member
    displayName: Role Member
    fromAttribute: RoleMember.roleId
    toAttribute: Role.id
  RoleMemberOf:
    name: MemberOf
    displayName: Role Member Of
    fromAttribute: RoleMember.memberId
    toAttribute: Role.id
  UserMemberRole:
    name: Role
    displayName: User Member Role
    path:
      - relationship: UserRoleMember
        direction: Backward
      - relationship: RoleMemberOf
        direction: Forward
  RoleMemberRole:
    name: Role
    displayName: Role Member Role
    path:
      - relationship: RoleMember
        direction: Backward
      - relationship: RoleMemberOf
        direction: Forward
  DeviceOwner:
    name: DeviceOwner
    displayName: Device Owner
    fromAttribute: deviceRegisteredOwner
    toAttribute: User.id
  UserManager:
    name: Manager
    fromAttribute: User.manager__id
    toAttribute: User.id
    # [TODO sc-11020] Give these a unique ID, rename both of these to Member,
    # and keep corresponding path relationships unique below
  UserMember:
    name: Member
    displayName: User Member
    fromAttribute: GroupMember.memberId
    toAttribute: User.id
  GroupMember:
    name: Member
    displayName: Group Member
    fromAttribute: GroupMember.memberId
    toAttribute: Group.id
  MemberOf:
    name: MemberOf
    displayName: Member Of
    fromAttribute: GroupMember.groupId
    toAttribute: Group.id
  UserMemberGroup:
    name: Group
    displayName: User Member Group
    path:
      - relationship: UserMember
        direction: Backward
      - relationship: MemberOf
        direction: Forward
  GroupMemberGroup:
    name: Group
    displayName: Group Member Group
    path:
      - relationship: GroupMember
        direction: Backward
      - relationship: MemberOf
        direction: Forward