Skip to content

Commit 7fa1191

Browse files
cmmdesaicmmdesai
committed
Added Graph Explorer and Postman tutorials
1 parent 5ab3355 commit 7fa1191

19 files changed

+760
-76
lines changed

‎articles/active-directory/app-provisioning/inbound-provisioning-api-configure-app.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,12 +101,13 @@ Depending on the app you selected, use one of the following sections to complete
101101
## Start accepting provisioning requests
102102

103103
1. Open the provisioning application's **Provisioning** -> **Overview** page.
104+
:::image type="content" source="media/inbound-provisioning-api-configure-app/provisioning-api-endpoint.png" alt-text="Screenshot of Provisioning API endpoint." lightbox="media/inbound-provisioning-api-configure-app/provisioning-api-endpoint.png":::
104105
1. On this page, you can take the following actions:
105106
- **Start provisioning** control button – Click on this button to place the provisioning job in **listen mode** to process inbound bulk upload request payloads.
106107
- **Stop provisioning** control button – Use this option to pause/stop the provisioning job.
107108
- **Restart provisioning** control button – Use this option to purge any existing request payloads pending processing and start a new provisioning cycle.
108109
- **Edit provisioning** control button – Use this option to edit the job settings, attribute mappings and to customize the provisioning schema.
109-
- **Provision on demand** control button – This feature is not yet enabled in private preview.
110+
- **Provision on demand** control button – This feature is not supported for API-driven inbound provisioning.
110111
- **Provisioning API Endpoint** URL text – Copy the HTTPS URL value shown and save it in a Notepad or OneNote for use later with the API client.
111112
1. Expand the **Statistics to date** > **View technical information** panel and copy the **Provisioning API Endpoint** URL. Share this URL with your API developer after [granting access permission](inbound-provisioning-api-grant-access.md) to invoke the API.
112113

‎articles/active-directory/app-provisioning/inbound-provisioning-api-curl-tutorial.md‎

Lines changed: 149 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,16 @@ ms.reviewer: cmmdesai
2121
## Pre-requisites
2222

2323
* You have configured [API-driven inbound provisioning app](inbound-provisioning-api-configure-app.md).
24-
* You have [configured a service principal and it has access](inbound-provisioning-api-grant-access.md) to the inbound provisioning API.
24+
* You have [configured a service principal and it has access](inbound-provisioning-api-grant-access.md) to the inbound provisioning API. Make note of the `ClientId` and `ClientSecret` of your service principal app for use in this tutorial.
2525

26-
## Upload user data to the inbound provisioning API using cURL
26+
## Upload user data to the inbound provisioning API
2727

2828
1. Retrieve the **client_id** and **client_secret** of the service principal that has access to the inbound provisioning API.
2929
1. Use OAuth **client_credentials** grant flow to get an access token. Replace the variables `[yourClientId]`, `[yourClientSecret]` and `[yourTenantId]` with values applicable to your setup and run the following cURL command. Copy the access token value generated
3030
```
3131
curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "client_id=[yourClientId]&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&client_secret=[yourClientSecret]&grant_type=client_credentials" "https://login.microsoftonline.com/[yourTenantId]/oauth2/v2.0/token"
3232
```
33-
1. Copy the bulk request payload from the example [Bulk upload using SCIM core user and enterprise user schema](/graph/api/synchronization-synchronizationjob-post-bulkupload#example-1-bulk-upload-using-scim-core-user-and-enterprise-user-schema) and save the contents in a file called scim-bulk-upload-users.json.
33+
1. Copy the [bulk request with SCIM Enterprise User Schema](#bulk-request-with-scim-enterprise-user-schema) and save the contents in a file called scim-bulk-upload-users.json.
3434
1. Replace the variable `[InboundProvisioningAPIEndpoint]` with the provisioning API endpoint associated with your provisioning app. Use the `[AccessToken]` value from the previous step and run the following curl command to upload the bulk request to the provisioning API endpoint.
3535
```
3636
curl -v "[InboundProvisioningAPIEndpoint]" -d @scim-bulk-upload-users.json -H "Authorization: Bearer [AccessToken]" -H "Content-Type: application/scim+json"
@@ -57,6 +57,152 @@ ms.reviewer: cmmdesai
5757
* The **Provision User** step calls out the final processing step and changes applied to the user account.
5858
* Use the **Modified properties** tab to view attribute updates.
5959
60+
## Appendix
61+
62+
### Bulk request with SCIM Enterprise User Schema
63+
The bulk request shown below uses the SCIM standard Core User and Enterprise User schema.
64+
65+
**Request body**
66+
# [HTTP](#tab/http)
67+
<!-- {
68+
"blockType": "request",
69+
"name": "Quick_start_with_curl"
70+
}-->
71+
```http
72+
{
73+
"schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkRequest"],
74+
"Operations": [
75+
{
76+
"method": "POST",
77+
"bulkId": "897401c2-2de4-4b87-a97f-c02de3bcfc61",
78+
"path": "/Users",
79+
"data": {
80+
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User",
81+
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],
82+
"externalId": "701984",
83+
"userName": "[email protected]",
84+
"name": {
85+
"formatted": "Ms. Barbara J Jensen, III",
86+
"familyName": "Jensen",
87+
"givenName": "Barbara",
88+
"middleName": "Jane",
89+
"honorificPrefix": "Ms.",
90+
"honorificSuffix": "III"
91+
},
92+
"displayName": "Babs Jensen",
93+
"nickName": "Babs",
94+
"emails": [
95+
{
96+
"value": "[email protected]",
97+
"type": "work",
98+
"primary": true
99+
}
100+
],
101+
"addresses": [
102+
{
103+
"type": "work",
104+
"streetAddress": "100 Universal City Plaza",
105+
"locality": "Hollywood",
106+
"region": "CA",
107+
"postalCode": "91608",
108+
"country": "USA",
109+
"formatted": "100 Universal City Plaza\nHollywood, CA 91608 USA",
110+
"primary": true
111+
}
112+
],
113+
"phoneNumbers": [
114+
{
115+
"value": "555-555-5555",
116+
"type": "work"
117+
}
118+
],
119+
"userType": "Employee",
120+
"title": "Tour Guide",
121+
"preferredLanguage": "en-US",
122+
"locale": "en-US",
123+
"timezone": "America/Los_Angeles",
124+
"active":true,
125+
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
126+
"employeeNumber": "701984",
127+
"costCenter": "4130",
128+
"organization": "Universal Studios",
129+
"division": "Theme Park",
130+
"department": "Tour Operations",
131+
"manager": {
132+
"value": "89607",
133+
"displayName": "John Smith"
134+
}
135+
}
136+
}
137+
},
138+
{
139+
"method": "POST",
140+
"bulkId": "897401c2-2de4-4b87-a97f-c02de3bcfc61",
141+
"path": "/Users",
142+
"data": {
143+
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User",
144+
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],
145+
"externalId": "701985",
146+
"userName": "[email protected]",
147+
"name": {
148+
"formatted": "Ms. Kathy J Jensen, III",
149+
"familyName": "Jensen",
150+
"givenName": "Kathy",
151+
"middleName": "Jane",
152+
"honorificPrefix": "Ms.",
153+
"honorificSuffix": "III"
154+
},
155+
"displayName": "Kathy Jensen",
156+
"nickName": "Kathy",
157+
"emails": [
158+
{
159+
"value": "[email protected]",
160+
"type": "work",
161+
"primary": true
162+
}
163+
],
164+
"addresses": [
165+
{
166+
"type": "work",
167+
"streetAddress": "100 Oracle City Plaza",
168+
"locality": "Hollywood",
169+
"region": "CA",
170+
"postalCode": "91618",
171+
"country": "USA",
172+
"formatted": "100 Oracle City Plaza\nHollywood, CA 91618 USA",
173+
"primary": true
174+
}
175+
],
176+
"phoneNumbers": [
177+
{
178+
"value": "555-555-5545",
179+
"type": "work"
180+
}
181+
],
182+
"userType": "Employee",
183+
"title": "Tour Lead",
184+
"preferredLanguage": "en-US",
185+
"locale": "en-US",
186+
"timezone": "America/Los_Angeles",
187+
"active":true,
188+
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
189+
"employeeNumber": "701985",
190+
"costCenter": "4130",
191+
"organization": "Universal Studios",
192+
"division": "Theme Park",
193+
"department": "Tour Operations",
194+
"manager": {
195+
"value": "701984",
196+
"displayName": "Barbara Jensen"
197+
}
198+
}
199+
}
200+
}
201+
],
202+
"failOnErrors": null
203+
}
204+
```
205+
60206
## Next steps
61207
- [Troubleshoot issues with the inbound provisioning API](inbound-provisioning-api-issues.md)
62208
- [API-driven inbound provisioning concepts](inbound-provisioning-api-concepts.md)

‎articles/active-directory/app-provisioning/inbound-provisioning-api-faqs.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,11 @@ Yes, the provisioning API supports on-premises AD domains as a target.
4848

4949
## How do we get the /bulkUpload API endpoint for our provisioning app?
5050

51-
The /bulkUpload API is available only for apps of the type: "API-driven inbound provisioning to Azure AD" and "API-driven inbound provisioning to on-premises Active Directory". You can retrieve the unique API endpoint for each provisioning app from the Provisioning blade home page. In **Statistics to date** > **View technical information**,copy the **Provisioning API Endpoint** URL. It has the format:
51+
The /bulkUpload API is available only for apps of the type: "API-driven inbound provisioning to Azure AD" and "API-driven inbound provisioning to on-premises Active Directory". You can retrieve the unique API endpoint for each provisioning app from the Provisioning blade home page. In **Statistics to date** > **View technical information**,copy the **Provisioning API Endpoint** URL.
5252

53+
:::image type="content" source="media/inbound-provisioning-api-configure-app/provisioning-api-endpoint.png" alt-text="Screenshot of Provisioning API endpoint." lightbox="media/inbound-provisioning-api-configure-app/provisioning-api-endpoint.png":::
54+
55+
It has the format:
5356
```http
5457
https://graph.microsoft.com/beta/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/bulkUpload
5558
```
@@ -145,11 +148,15 @@ If the attribute is set to **true**, the default mapping rule enables the accoun
145148

146149
## Can we soft-delete a user in Azure AD using /bulkUpload provisioning API?
147150

148-
No. Currently the provisioning service only supports enabling or disabling an account in Azure AD/on-premises AD.
151+
Yes, you can soft-delete a user by using the **DELETE** method in the bulk request operation. Refer to the [bulkUpload](/graph/api/synchronization-synchronizationjob-post-bulkupload) API spec doc for an example request.
149152

150153
## How can we prevent accidental disabling/deletion of users?
151154

152-
You can enable accidental deletion prevention. See [Enable accidental deletions prevention in the Azure AD provisioning service](accidental-deletions.md)
155+
To prevent and recover from accidental deletions, we recommend [configuring accidental deletion threshold](accidental-deletions.md) in the provisioning app and [enabling the on-premises Active Directory recycle bin](/azure/active-directory/hybrid/connect/how-to-connect-sync-recycle-bin.md). In your provisioning app's **Attribute Mapping** blade, under **Target object actions** disable the **Delete** operation.
156+
157+
**Recovering deleted accounts**
158+
* If the target directory for the operation is Azure AD, then the matched user is soft-deleted. The user can be seen on the Microsoft Azure portal **Deleted users** page for the next 30 days and can be restored during that time.
159+
* If the target directory for the operation is on-premises Active Directory, then the matched user is hard-deleted. If the **Active Directory Recycle Bin** is enabled, you can restore the deleted on-premises AD user object.
153160

154161
## Do we need to send all users from the HR system in every request?
155162

‎articles/active-directory/app-provisioning/inbound-provisioning-api-grant-access.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ This configuration registers an app in Azure AD that represents the external API
4343
1. Search and select permission **AuditLog.Read.All** and **SynchronizationData-User.Upload**.
4444
1. Click on **Grant admin consent** on the next screen to complete the permission assignment. Click Yes on the confirmation dialog. Your app should have the following permission sets.
4545
[![Screenshot of app permissions.](media/inbound-provisioning-api-grant-access/api-client-permissions.png)](media/inbound-provisioning-api-grant-access/api-client-permissions.png#lightbox)
46-
1. You're now ready to use the service principal with your API client.
46+
1. You're now ready to use the service principal with your API client.
47+
1. For production workloads, we recommend using [client certificate-based authentication](../develop/howto-authenticate-service-principal-powershell.md) with the service principal or managed identities.
4748

4849
## Configure a managed identity
4950

0 commit comments

Comments
 (0)