Skip to main content

Setting up the manager attribute for the Escalation Feature (SCIM provisioning)

Updated

Below you will find the steps to import the manager of your users into the SoSafe Manager.

Be aware: The manager needs to be member of the SoSafe user list.

When using SCIM user provisioning

  1. Open Entra ID in your Microsoft Azure tenant.
  2. Go to Enterprise Application and select the SoSafe App

  3. Select Provisioning on the left hand side

    Microsoft Entra ID enterprise application left navigation menu, with Provisioning highlighted in the Manage section alongside Single sign-on, Self-service, and Properties.

     

  4. Click on Edit attribute mappings

    Microsoft Entra ID Provisioning overview page with Edit attribute mappings highlighted under Manage provisioning, next to Update credentials, Add scoping filters, and Provision on demand.

     

  5. Expand the Mappings an click on Provision Microsoft Entra ID Users
     

    Microsoft Entra ID Provisioning page with the Mappings section expanded, showing Provision Microsoft Entra ID Users highlighted below Provision Microsoft Entra ID Groups, and a Restore default mappings checkbox.

     

  6. Adding target attribute “urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager” 

    Here you have 2 options which target attribute type should be used.

    Option 1: You use the manager attribute which is available in Entra ID => target attribute type is Reference

    Option 2: You use another attribute where the managers email address is maintained => target attribute type is String
     

    1. Under the Attribute List click Show advanced options. You will find Edit attribute List for SoSafe there (if unavailable, follow steps 6b-d).

      Attribute mapping list in Microsoft Entra ID with the Show advanced options checkbox and the Edit attribute list for SoSafe link both highlighted, below the Edit attribute list for Microsoft Entra ID link.

       

    2. If the link Edit attribute list for SoSafe is missing, please use one of the following links to make this option visible.

      You are using the Microsoft Azure Portal:
      https://portal.azure.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true

      You are using the Microsoft Entra Admin Center:
      https://entra.microsoft.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true
       

    3. After you opened the attribute list of the SoSafe App please create the following new attribute:

      • Option 1 - Reference attribute:

        Edit attribute list for SoSafe page with the manager attribute row highlighted, set to type Reference and referencing the enterprise User schema, listed below String-type attributes such as employeeNumber, costCenter, and department.

        NOTE: The reference attribute needs to refer to the user attribute (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User), which you can select from the drop down in the last column

      • Option 2 - String attribute

        Same edit attribute list for SoSafe page, now with the manager attribute row set to type String instead of Reference, with no user attribute selected in the reference field.

       

    4. Once you added the new attribute click on Save to save the changes:

      Edit attribute list page in Microsoft Entra ID with the Save button highlighted next to Discard, above the list of SoSafe user attributes including the newly added manager attribute.
  7. Below the attribute list click on Add New Mapping

  8. Now select “manager” as Source attribute and enter “urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager” as Target attribute
    The other fields retain with the default values.
     

    Edit Attribute dialog in Microsoft Entra ID with mapping type Direct, and Source attribute set to manager and Target attribute set to the enterprise manager URI both highlighted, above Match objects using this attribute set to No.

If the target attribute is not available, click the following element to find out how to add it:

→ Target attribute missing

Manager provisioning fails

It could happen that the objectId has not been provisioned. This is an issue on the Entra ID side, which could be solved using the below workaround:

  1. Please reopen the attribute list in the SoSafe application in Entra ID and click on Add New Attribute

    Attribute Mappings table in Microsoft Entra ID listing standard SCIM fields such as userName, displayName, and address attributes, with the Add New Mapping link highlighted at the bottom.

  2. Add a new mapping: 
    Source attribute = objectId 
    Target attribute = externalId 
     

    Edit Attribute dialog with mapping type Direct, Source attribute set to objectId and Target attribute set to externalId, both highlighted, and the OK button highlighted below to save the mapping.
  3. Click on OK to save the changes and restart provisioning

  1. Click on OK to get back to the attribute list. You should see the new mapping now. Do not forget to click on Save to save all changes.
     

    Attribute Mapping page in Microsoft Entra ID with the Save button highlighted at the top, and the newly added manager to manager row highlighted at the bottom of the attribute mappings table.

     

  2. To test the setup do a Provision on Demand for a specific user object. Once it finish check if the manager attribute is being provisioned and appear in the SoSafe Manager. The email address should appear the SoSafe Manager in the User Management > Users in column Responsible person email
     

 

Related articles