How do I customize attribute mappings for SAML2 Single Sign-on (SSO - Authentication) / auto-provisioning (SCIM) in the Azure / Entra enterprise application?

In some instances, customer may wish to map different attributes when importing and synchronizing users from the Azure/Entra/O365 Active Directory instance.

For example, customers may wish to map the Department field to the state attribute and the Title field to the city attribute. This would allow them to assign and report on training assigned by city or state. 

Other customers store information they may wish to map to one of the attributes in a different attribute in the Directory. For example, mapping the title field to the description attribute. 

Always follow the most current documentation from Microsoft.  If the steps below or interface have changed since the posting of this article, please let us know by sending an email to infosec_awareness@fortinet.com and we will update the article. 

Here are the steps recorded at the time of the posting of this article:  

The Attribute Mapping page is displayed:

Example:

All information is being pushed to our service from the Entra AD instance. In this example, the target attribute s the attribute in the Fortinet Security Awareness and Training Service. The source attribute is the mapped attribute in AD that we wish to push to the service. 

In this example, we are remapping the information stored in the Entra AD value stored in the physicalDeliveryOfficeName attribute to be pushed into the urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department attribute in the Fortinet Security Awareness and Training Service. 

Select the advanced options for the department currently mapped: 

The target attribute that would populate into our Department field is: 

 urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department

The source attribute from Microsoft side is:  physicalDeliveryOfficeName