AAD Basic Info

AZURE_AD_CONNECTOR

Name of the connector.

AAD1

AZURE_AD_ENABLED

Enabled status of connector. (true/false)

true

AZURE_AD_SERVICE_TYPE

Service Type

AZURE_AD_DATASOURCE_NAME

Name of the datasource.

AZURE_AD_ATTRIBUTE_ONLY

Sync only the attributes of users already synced from other services.

false

AZURE_AD_SYNC_INTERVAL

Frequency of usersync pulls and audit records in seconds. Default value is 3600, minimum value is 300.

3600

B) Azure AAD Info: (Get the following information from Azure Portal)

AZURE_AD_TENANT_ID

Azure Active Directory Id (Tenant ID)

1a2b3c4d-azyd-4755-9638-e12xa34p56le

AZURE_AD_CLIENT_ID

Azure Active Directory application client ID which will be used for accessing Microsoft Graph API.

11111111-1111-1111-1111-111111111111

AZURE_AD_CLIENT_SECRET

Azure Active Directory application client secret which will be used for accessing Microsoft Graph API.

AZURE_AD_USERNAME

Azure Account username which will be used for getting access token to be used on behalf of Azure AD application.

AZURE_AD_PASSWORD

Azure Account password which will be used for getting access token to be used on behalf of Azure AD application.

C) AAD Manage/Ignore List of Users/Groups

AZURE_AD_MANAGER_USER_LIST

List of users to manage from sync results. If this list is defined, all users not on this list will be ignored.

AZURE_AD_IGNORE_USER_LIST

List of users to ignore from sync results.

AZURE_AD_MANAGE_GROUP_LIST

List of groups to manage from sync results. If this list is defined, all groups not on this list will be ignored.

AZURE_AD_IGNORE_GROUP_LIST

List of groups to ignore from sync results.

D) AAD Search

AZURE_AD_SEARCH_SCOPE

Azure AD Application Access Scope

AZURE_AD_SEARCH_USER_GROUPONLY

Boolean to only load users in groups.

false

AZURE_AD_SEARCH_INCREMENTAL_ENABLED

Enable incremental search. Syncing only changes since last search.

false

AZURE_AD_SEARCH_DETECT_DELETED_USERS_GROUPS

Enables both user and group deleted searches. Default is false.

false

AZURE_AD_SEARCH_DETECT_DELETED_USERS

Override setting for user deleted search. Default value is AZURE_AD_SEARCH_DETECT_DELETED_USERS_GROUPS.

AZURE_AD_SEARCH_DETECT_DELETED_USERS_GROUPS

AZURE_AD_SEARCH_DETECT_DELETED_GROUPS

Override setting for group deleted search. Default value is AZURE_AD_SEARCH_DETECT_DELETED_USERS_GROUPS.

AZURE_AD_SEARCH_DETECT_DELETED_USERS_GROUPS

AZURE_AD_SEARCH_CYCLES_BETWEEN_DELETED_DETECTION

Number of cycles between attempts to detect deleted groups. Only used when deleted users and groups detection is enabled in the AAD connector (see above properties). Default value is 6.

6

E) Azure Service Principal

AZURE_AD_SERVICEPRINCIPAL_ENABLED

Sync Azure service principal to ranger user entity.

false

AZURE_AD_SERVICEPRINCIPAL_USERNAME

Properties to specify from which key to get values of username in case service principal is mapped to Ranger user entity.

displayName

F) AAD User/Group Attributes

AZURE_AD_ATTRIBUTE_USERNAME

Attribute of a user’s name (default: userPrincipalName)

AZURE_AD_ATTRIBUTE_FIRSTNAME

Attribute of a user’s first name (default: givenName)

AZURE_AD_ATTRIBUTE_LASTNAME

Attribute of a user’s last name (default: surname)

AZURE_AD_ATTRIBUTE_EMAIL

Attribute from user entry that would be treated as email address.

AZURE_AD_ATTRIBUTE_GROUPNAME

Attribute from group entry that would be treated as group name.

AZURE_AD_SERVICEPRINCIPAL_USERNAME

Attribute of service principal name.

G) Username/Group name Attribute Modification

AZURE_AD_ATTRIBUTE_USERNAME_VALUE_EXTRACTFROMEMAIL

Extract username from an email address. (e.g. username@domain.com -> username) Default is false.

false

AZURE_AD_ATTRIBUTE_USERNAME_VALUE_PREFIX

Prefix to prepend to the username. Default is blank.

AZURE_AD_ATTRIBUTE_USERNAME_VALUE_POSTFIX

Postfix to append pend to the username. Default is blank.

AZURE_AD_ATTRIBUTE_USERNAME_VALUE_TOLOWER

Convert the username to lowercase. Default is false.

false

AZURE_AD_ATTRIBUTE_USERNAME_VALUE_TOUPPER

Convert the username to uppercase. Default is false.

false

AZURE_AD_ATTRIBUTE_USERNAME_VALUE_REGEX

Attribute to replace username to matching regex. Default is blank.

AZURE_AD_ATTRIBUTE_GROUPNAME_VALUE_EXTRACTFROMEMAIL

Extract the group name from an email address. Default is false.

false

AZURE_AD_ATTRIBUTE_GROUPNAME_VALUE_PREFIX

Prefix to prepend to the group's name. Default is blank.

AZURE_AD_ATTRIBUTE_GROUPNAME_VALUE_POSTFIX

Postfix to append pend to the group's name. Default is blank.

AZURE_AD_ATTRIBUTE_GROUPNAME_VALUE_TOLOWER

Convert the name to group's name to lower case. Default is false.

false

AZURE_AD_ATTRIBUTE_GROUPNAME_VALUE_TOUPPER

Convert the group's name to uppercase. Default is false.

false

AZURE_AD_ATTRIBUTE_GROUPNAME_VALUE_REGEX

Attribute to replace the group's name to matching regex. Default is blank.

H) Group Attribute Configuration

AZURE_AD_GROUP_ATTRIBUTE_LIST

The list of attribute keys to get from synced groups.

AZURE_AD_GROUP_ATTRIBUTE_VALUE_PREFIX

Append prefix to values of group attributes such as group name.

AZURE_AD_GROUP_ATTRIBUTE_KEY_PREFIX

Append prefix to key of group attributes such as group name.

I) Filter Properties

AZURE_AD_FILTER_USER_LIST

Filter the AAD user list, supported for non-incremental search. When incremental search is enabled delta search does not support filter properties.

abc.def@privacera.com

AZURE_AD_FILTER_SERVICEPRINCIPAL_LIST

Filter the AAD service principal list, supported for non-incremental search. When incremental search is enabled delta search does not support filter properties.

abc-testapp

AZURE_AD_FILTER_GROUP_LIST

Filter the AAD group list, supported for non-incremental search. When incremental search is enabled delta search does not support filter properties.

PRIVACERA-AB-GROUP-00

J) Domain Properties

AZURE_AD_MANAGE_DOMAIN_LIST

Only users in manage domain list will be synced.

Privacera.US

AZURE_AD_IGNORE_DOMAIN_LIST

Users in ignore domain list will not be synced.

Privacera.US

AZURE_AD_DOMAIN_ATTRIBUTE

Specify the attribute from which you want to compare user domain, email or username are supported. Default is email.

username