Generating proxyaddresses during user provisioning

Hi shashidhar joliholi,

You haven't provided enough information for us to give you specific recommendations.

I'm going to assume you're provisioning into Active Directory though, because that's the only supported scenario for using the SelectUnique() function:

• Reference for writing expressions for attribute mappings in Microsoft Entra Application Provisioning - Microsoft Entra ID | Microsoft Learn

While I'm making assumptions, if you're trying to add both a primary address as well as an additional address (which is how I'm interpreting your use of the word "alias") then you cannot use the SelectUnique() function to achieve this, since it cannot be used as a nested function, nor can it validate multiple values.

Similarly, if your HR system/source of truth is capable of providing an array of values, you must not use the SelectUnique() function for a proxyAddresses mapping.

Setting my assumptions aside, you should be checking your audit log, as it will make it fairly clear why your scenario is not working:

• Find out when a specific user is able to access an app in Microsoft Entra Application Provisioning - Microsoft Entra ID | Microsoft Learn
• User provisioning logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

Cheers,

Lain

Hi, when it comes to generating alias email addresses for the proxyaddresses attribute during user provisioning, here are some ideas you might consider:

Function Compatibility:
First, double-check that the selectunique function is supported in your provisioning tool for mapping proxyaddresses. Sometimes, the input data or the expected output format might not match what the function provides.

Correct Format:
The proxyaddresses attribute usually requires values to be in a specific format, like "smtp:email address removed for privacy reasons". Make sure that your transformation using selectunique is outputting the address in this format; otherwise, it won't work properly.

Test and Log Outputs:
It might be helpful to log or preview the output of the selectunique function to verify that it's generating the correct aliases. This can help you identify if there's a logic or formatting issue in the mapping.

Alternative Approaches:

If the built-in function isn’t meeting your needs, you might consider pre-generating the alias addresses with a custom script and then passing them as a multi-valued attribute for proxyaddresses.
If you're using a tool like Azure AD Connect, you could explore custom synchronization rules that handle the alias generation for you.

I hope these suggestions help you move forward with your provisioning process