Required Attributes for Migration to Omnissa Identity Service

When migrating your directory to Omnissa Identity Service, you must synchronize the required user and group attributes from on-premises Active Directory to your cloud identity provider, and then map them to SCIM attributes for Omnissa Identity Service. These attributes are necessary for Omnissa Identity Service to properly identify and manage users and groups.

Required Attributes for Microsoft Entra ID

If Microsoft Entra ID is your identity provider, ensure that the following attributes are synchronized from Active Directory to Entra ID and mapped correctly in the provisioning app for Omnissa Identity Service.

Required User Attributes (Entra ID)

Note:

• If you are migrating multiple domains, you must add the mapping for the domain attribute for both users and groups in the provisioning app.
• You can remove the mapping for the urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:altExternalId SCIM attribute from the provisioning app after migration is complete.

Required Group Attributes (Entra ID)

How to Map Additional Attributes in Entra ID

Certain attributes such as distinguishedName, objectGUID, and sAMAccountName are not directly available in the Entra ID user interface. You can use the following method to add these attributes:

1. In the Microsoft Entra admin center, navigate to the provisioning app you created for user provisioning to Omnissa Identity Service.

2. Select Manage > Provisioning.

3. On the Provisioning page, under Mappings, click Provision Microsoft Entra ID Users for users or Provision Microsoft Entra ID Groups for groups.

4. Edit the URL in the launch bar.

   • Add the query parameter:
     Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true

     Ensure that you put the query parameter before the URL fragment #.

   • The old URL should be:
     https://aad.portal.azure.com/#view/Microsoft_AAD_Connect_Provisioning/…

   • The new URL should be:
     https://aad.portal.azure.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true#view/Microsoft_AAD_Connect_Provisioning/…

5. Navigate to the new URL.

6. At the bottom of the page, select the Show advanced options check box, then click Edit attribute list for Microsoft Entra ID.

   

7. On the Edit Attribute List page, add a new row to the table with Name set to the new attribute.

   • For the Active Directory attribute distinguishedName, use onPremisesDistinguishedName.
   • For the Active Directory attribute objectGUID, use immutableId.
   • For the Active Directory attribute sAMAccountName, use: onPremisesSamAccountName

   Note: These are the typical mappings for these attributes but they might be different in your environment. You can use the expression builder to verify the mappings used in your environment.

8. Click Save.

After you add the attribute, it will be available in the Source attribute column when you add or edit a mapping.

Required Attributes for Okta

If Okta is your identity provider, ensure that the following attributes are synchronized from Active Directory to Okta and mapped correctly in the provisioning app for Omnissa Identity Service.

Required User Attributes (Okta)

Required Attributes for Generic SCIM 2.0 Identity Providers

If you are using a generic SCIM 2.0-compliant identity provider, ensure that the following attributes are synchronized from Active Directory to your identity provider and mapped correctly in the provisioning app for Omnissa Identity Service.

Required User Attributes (Generic SCIM 2.0 IDP)