Entra ID Integration – Access Provisioning via assyst Workflows

Question

Hello Community,We’re exploring ways to increase automation within our access management processes, specifically whether assyst workflows can be used to trigger outbound actions such as adding users to Microsoft Entra ID (Azure AD) groups based on ticket or workflow outcomes.We already make use of inbound integrations (for example, Intune feeding data into assyst). However, our focus here is on using assyst as a driver for outbound actions, rather than purely as a consumer of external data.Our current understanding is that this type of integration would most likely be achieved using AssystETM (e.g. via workflow steps and external calls), but we’re keen to understand how others have approached this.We’d be interested in hearing from the community:Have you implemented outbound integrations from assyst to Entra ID (such as managing group membership)?	Was this done using AssystETM, and if so, how was it structured (e.g. workflow design, triggers, error handling)?	Did you use ETM alone, or in combination with APIs, middleware, or other integration components?	Are there any patterns, challenges, or lessons learned you’d recommend considering early on?We’re at an exploratory stage and would value learning from real‑world implementations and experiences. Many Thanks,Jessica Lee van Pelt (She/Her)Service AnalystIT Service Operations, Architecture & DesignIFSCloud - Assyst Version 11.8.4

Paul McCulloch · Answer

HiJessica,In principal this should be fairly straight forward:In assyst create a Destination which is triggered at the point the workflow reaches the stage where you want to create the user. This would typically be something like an Action Create destination with a filter which matches a specific action TypeThe ‘target’ should be something like ‘ETM_AddUserToGroup’ (the ETM_ prefix is important)In ETM create a channel with the source being assyst Destination and the queue beingAddUserToGroup (without the prefix)Add an http request datamapper to invoke the MS Graph API to add the user to the groupTypically the mapper would use some assyst searches to validate that the triggering action (which will be the ‘inbound' data) is to be sent to entra, and to retrieve any other data needed from assyst to make teh Graph callUse a ‘No Value When’ field if you want to *not* add the user to the groupSee the cookbook in the wiki for examples of outbound REST requests for detailed examples.

Did you find what you're looking for? If not:

Sign up

Login to the community