配置目录扩展属性的同步

命名空间：microsoft.graph

可以自定义同步架构以包含Microsoft Entra目录扩展属性。 本文介绍如何使用目录扩展属性 (extension_9d98asdfl15980a_Nickname) 来填充 Salesforce 中 User.CommunityNickname 的值。 在此方案中，你已设置Microsoft Entra Connect，以将许多目录扩展属性从本地Windows Server Active Directory预配到Microsoft Entra ID。

本文假定你已添加一个应用程序，该应用程序支持通过Microsoft Entra 管理中心同步到租户，你知道应用程序显示名称，并且你具有 Microsoft Graph 的授权令牌。 有关如何获取授权令牌的信息，请参阅 获取访问令牌以调用 Microsoft Graph。

按显示名称查找服务主体对象

以下示例演示如何查找显示名称为“Salesforce Sandbox”的服务主体对象。

请求

HTTP

GET https://graph.microsoft.com/v1.0/servicePrincipals?$select=id,appId,displayName&$filter=startswith(displayName, 'salesforce')
Authorization: Bearer {Token}

C#

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.ServicePrincipals.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Select = new string []{ "id","appId","displayName" };
	requestConfiguration.QueryParameters.Filter = "startswith(displayName, 'salesforce')";
	requestConfiguration.Headers.Add("Authorization", "Bearer {Token}");
});

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

CLI

mgc service-principals list --filter "startswith(displayName, 'salesforce')" --select "id,appId,displayName"

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Go

// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  abstractions "github.com/microsoft/kiota-abstractions-go"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphserviceprincipals "github.com/microsoftgraph/msgraph-sdk-go/serviceprincipals"
	  //other-imports
)

headers := abstractions.NewRequestHeaders()
headers.Add("Authorization", "Bearer {Token}")


requestFilter := "startswith(displayName, 'salesforce')"

requestParameters := &graphserviceprincipals.ServicePrincipalsRequestBuilderGetQueryParameters{
	Select: [] string {"id","appId","displayName"},
	Filter: &requestFilter,
}
configuration := &graphserviceprincipals.ServicePrincipalsRequestBuilderGetRequestConfiguration{
	Headers: headers,
	QueryParameters: requestParameters,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
servicePrincipals, err := graphClient.ServicePrincipals().Get(context.Background(), configuration)

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Java

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

ServicePrincipalCollectionResponse result = graphClient.servicePrincipals().get(requestConfiguration -> {
	requestConfiguration.queryParameters.select = new String []{"id", "appId", "displayName"};
	requestConfiguration.queryParameters.filter = "startswith(displayName, 'salesforce')";
	requestConfiguration.headers.add("Authorization", "Bearer {Token}");
});

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

JavaScript

const options = {
	authProvider,
};

const client = Client.init(options);

let servicePrincipals = await client.api('/servicePrincipals')
	.header('Authorization','Bearer {Token}')
	.filter('startswith(displayName, \'salesforce\')')
	.select('id,appId,displayName')
	.get();

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

PHP

<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\ServicePrincipals\ServicePrincipalsRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new ServicePrincipalsRequestBuilderGetRequestConfiguration();
$headers = [
		'Authorization' => 'Bearer {Token}',
	];
$requestConfiguration->headers = $headers;

$queryParameters = ServicePrincipalsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->select = ["id","appId","displayName"];
$queryParameters->filter = "startswith(displayName, 'salesforce')";
$requestConfiguration->queryParameters = $queryParameters;


$result = $graphServiceClient->servicePrincipals()->get($requestConfiguration)->wait();

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

PowerShell

Import-Module Microsoft.Graph.Applications

Get-MgServicePrincipal -Property "id,appId,displayName" -Filter "startswith(displayName, 'salesforce')" 

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Python

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.service_principals.service_principals_request_builder import ServicePrincipalsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = ServicePrincipalsRequestBuilder.ServicePrincipalsRequestBuilderGetQueryParameters(
		select = ["id","appId","displayName"],
		filter = "startswith(displayName, 'salesforce')",
)

request_configuration = RequestConfiguration(
query_parameters = query_params,
)
request_configuration.headers.add("Authorization", "Bearer {Token}")


result = await graph_client.service_principals.get(request_configuration = request_configuration)

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

响应

HTTP/1.1 200 OK
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals(id,appId,displayName)",
    "value": [
    {
        "id": "167e33e9-f80e-490e-b4d8-698d4a80fb3e",
        "appId": "cd3ed3de-93ee-400b-8b19-b61ef44a0f29",
        "displayName": "Salesforce"
    },
    {
        "id": "8cbbb70b-7290-42da-83ee-89fa3517a977",
        "appId": "b0f2e3b1-fe31-4658-b216-44dcaeabb63a",
        "displayName": "salesforce 1"
    },
    {
        "id": "60443998-8cf7-4e61-b05c-a53b658cb5e1",
        "appId": "79079396-c301-405d-900f-e2e0c2439a90",
        "displayName": "Salesforce Sandbox"
    }
    ]
}

为 {servicePrincipalId}60443998-8cf7-4e61-b05c-a53b658cb5e1。

列出服务主体上下文中的同步作业

以下示例演示如何获取 jobId 需要使用的 。 通常，响应仅返回一个作业。

请求

HTTP

GET https://graph.microsoft.com/v1.0/servicePrincipals/60443998-8cf7-4e61-b05c-a53b658cb5e1/synchronization/jobs
Authorization: Bearer {Token}

C#

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].Synchronization.Jobs.GetAsync((requestConfiguration) =>
{
	requestConfiguration.Headers.Add("Authorization", "Bearer {Token}");
});

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

CLI

mgc service-principals synchronization jobs list --service-principal-id {servicePrincipal-id}

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Go

// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  abstractions "github.com/microsoft/kiota-abstractions-go"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphserviceprincipals "github.com/microsoftgraph/msgraph-sdk-go/serviceprincipals"
	  //other-imports
)

headers := abstractions.NewRequestHeaders()
headers.Add("Authorization", "Bearer {Token}")

configuration := &graphserviceprincipals.ServicePrincipalItemSynchronizationJobsRequestBuilderGetRequestConfiguration{
	Headers: headers,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
jobs, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").Synchronization().Jobs().Get(context.Background(), configuration)

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Java

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

SynchronizationJobCollectionResponse result = graphClient.servicePrincipals().byServicePrincipalId("{servicePrincipal-id}").synchronization().jobs().get(requestConfiguration -> {
	requestConfiguration.headers.add("Authorization", "Bearer {Token}");
});

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

JavaScript

const options = {
	authProvider,
};

const client = Client.init(options);

let jobs = await client.api('/servicePrincipals/60443998-8cf7-4e61-b05c-a53b658cb5e1/synchronization/jobs')
	.header('Authorization','Bearer {Token}')
	.get();

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

PHP

<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\ServicePrincipals\Item\Synchronization\Jobs\JobsRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new JobsRequestBuilderGetRequestConfiguration();
$headers = [
		'Authorization' => 'Bearer {Token}',
	];
$requestConfiguration->headers = $headers;


$result = $graphServiceClient->servicePrincipals()->byServicePrincipalId('servicePrincipal-id')->synchronization()->jobs()->get($requestConfiguration)->wait();

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

PowerShell

Import-Module Microsoft.Graph.Applications

Get-MgServicePrincipalSynchronizationJob -ServicePrincipalId $servicePrincipalId

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Python

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.service_principals.item.synchronization.jobs.jobs_request_builder import JobsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

request_configuration = RequestConfiguration()
request_configuration.headers.add("Authorization", "Bearer {Token}")


result = await graph_client.service_principals.by_service_principal_id('servicePrincipal-id').synchronization.jobs.get(request_configuration = request_configuration)

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

响应

HTTP/1.1 200 OK
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('60443998-8cf7-4e61-b05c-a53b658cb5e1')/synchronization/jobs",
    "value": [
        {
            "id": "SfSandboxOutDelta.e4bbf44533ea4eabb17027f3a92e92aa",
            "templateId": "SfSandboxOutDelta",
            "schedule": {},
            "status": {}
    }
    ]
}

为 {jobId}SfSandboxOutDelta.e4bbf44533ea4eabb17027f3a92e92aa。

查找所需的目录扩展属性的名称

需要扩展属性的全名。 如果不知道应类似于extension_9d98asdfl15980a_Nickname) 的完整名称 (，请参阅以下有关目录扩展属性以及如何检查它们的信息：

• 使用自定义属性扩展Microsoft Entra目录架构
• 目录架构扩展 |图形 API概念

获取同步架构

以下示例演示如何获取同步架构。

HTTP

GET https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/schema
Authorization: Bearer {Token}

C#

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].Synchronization.Jobs["{synchronizationJob-id}"].Schema.GetAsync((requestConfiguration) =>
{
	requestConfiguration.Headers.Add("Authorization", "Bearer {Token}");
});

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

CLI

mgc service-principals synchronization jobs schema get --service-principal-id {servicePrincipal-id} --synchronization-job-id {synchronizationJob-id}

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Go

// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  abstractions "github.com/microsoft/kiota-abstractions-go"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphserviceprincipals "github.com/microsoftgraph/msgraph-sdk-go/serviceprincipals"
	  //other-imports
)

headers := abstractions.NewRequestHeaders()
headers.Add("Authorization", "Bearer {Token}")

configuration := &graphserviceprincipals.ServicePrincipalItemSynchronizationJobItemSchemaRequestBuilderGetRequestConfiguration{
	Headers: headers,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
schema, err := graphClient.ServicePrincipals().ByServicePrincipalId("servicePrincipal-id").Synchronization().Jobs().BySynchronizationJobId("synchronizationJob-id").Schema().Get(context.Background(), configuration)

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Java

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

SynchronizationSchema result = graphClient.servicePrincipals().byServicePrincipalId("{servicePrincipal-id}").synchronization().jobs().bySynchronizationJobId("{synchronizationJob-id}").schema().get(requestConfiguration -> {
	requestConfiguration.headers.add("Authorization", "Bearer {Token}");
});

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

JavaScript

const options = {
	authProvider,
};

const client = Client.init(options);

let synchronizationSchema = await client.api('/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/schema')
	.header('Authorization','Bearer {Token}')
	.get();

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

PHP

<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\ServicePrincipals\Item\Synchronization\Jobs\Item\Schema\SchemaRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new SchemaRequestBuilderGetRequestConfiguration();
$headers = [
		'Authorization' => 'Bearer {Token}',
	];
$requestConfiguration->headers = $headers;


$result = $graphServiceClient->servicePrincipals()->byServicePrincipalId('servicePrincipal-id')->synchronization()->jobs()->bySynchronizationJobId('synchronizationJob-id')->schema()->get($requestConfiguration)->wait();

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

PowerShell

Import-Module Microsoft.Graph.Applications

Get-MgServicePrincipalSynchronizationJobSchema -ServicePrincipalId $servicePrincipalId -SynchronizationJobId $synchronizationJobId

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

Python

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.service_principals.item.synchronization.jobs.item.schema.schema_request_builder import SchemaRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

request_configuration = RequestConfiguration()
request_configuration.headers.add("Authorization", "Bearer {Token}")


result = await graph_client.service_principals.by_service_principal_id('servicePrincipal-id').synchronization.jobs.by_synchronization_job_id('synchronizationJob-id').schema.get(request_configuration = request_configuration)

请阅读 SDK 文档，了解如何将 SDK 添加到项目并创建 authProvider 实例的详细信息。

注意：为了提高可读性，可能缩短了此处显示的响应对象。 将在实际调用中返回所有属性。

HTTP/1.1 200 OK
Content-Type: application/json

{
  "directories": [
    {
      "id": "66e4a8cc-1b7b-435e-95f8-f06cea133828",
      "name": "Azure Active Directory",
      "objects": [
        {
          "attributes": [
            {
              "anchor": true,
              "caseExact": false,
              "defaultValue": null,
              "metadata": [],
              "multivalued": false,
              "mutability": "ReadWrite",
              "name": "objectId",
              "required": false,
              "referencedObjects": [],
              "type": "String"
            },
            {
              "anchor": false,
              "caseExact": false,
              "defaultValue": null,
              "metadata": [],
              "multivalued": false,
              "mutability": "ReadWrite",
              "name": "streetAddress",
              "required": false,
              "referencedObjects": [],
              "type": "String"
            }
          ],
          "name": "User"
        }
      ]
    },
    {
      "id": "8ffa6169-f354-4751-9b77-9c00765be92d",
      "name": "salesforce.com",
      "objects": []
    }
  ],
  "synchronizationRules": [
    {
      "editable": true,
      "id": "4c5ecfa1-a072-4460-b1c3-4adde3479854",
      "name": "USER_OUTBOUND_USER",
      "objectMappings": [
        {
          "attributeMappings": [
            {
              "defaultValue": "True",
              "exportMissingReferences": false,
              "flowBehavior": "FlowWhenChanged",
              "flowType": "Always",
              "matchingPriority": 0,
              "source": {
                "expression": "Not([IsSoftDeleted])",
                "name": "Not",
                "parameters": [
                  {
                    "key": "source",
                    "value": {
                      "expression": "[IsSoftDeleted]",
                      "name": "IsSoftDeleted",
                      "parameters": [],
                      "type": "Attribute"
                    }
                  }
                ],
                "type": "Function"
              },
              "targetAttributeName": "IsActive"
            }
          ],
          "enabled": true,
          "flowTypes": "Add, Update, Delete",
          "name": "Synchronize Azure Active Directory Users to salesforce.com",
          "scope": null,
          "sourceObjectName": "User",
          "targetObjectName": "User"
        }
      ]
    }
  ]
}

添加目录扩展属性的定义，以及属性之间的映射

使用所选纯文本编辑器 (例如，记事本++ 或 JSON 编辑器 Online) ：

1. 为extension_9d98asdfl15980a_Nickname属性添加属性定义。

   • 在目录下，找到名为“Microsoft Entra ID”的目录，然后在对象的数组中找到名为“User”的目录。
   • 将新属性添加到列表中，并指定名称和类型，如以下示例所示。

2. 在 extension_9d98asdfl15980a_Nickname 和 CommunityNickname 之间添加 属性映射 。

   • 在 synchronizationRules 下，找到将Microsoft Entra ID指定为源目录的规则，并将 Salesforce.com 指定为目标目录 ("sourceDirectoryName": "Azure Active Directory", "targetDirectoryName": "salesforce.com") 。
   • 在规则的 objectMappings 中，查找用户 ("sourceObjectName": "User", "targetObjectName": "User") 之间的映射。
   • 在 objectMapping 的 attributeMappings 数组中，添加一个新条目，如以下示例所示。

   {
       "directories": [
           {
               "id": "66e4a8cc-1b7b-435e-95f8-f06cea133828",
               "name": "Azure Active Directory",
               "objects": [
                   {
                       "attributes": [
                               ,{
                               "name": "extension_9d98asdfl15980a_Nickname",
                               "type": "String"
                               }
                       ],
                       "name":"User"
                   }]
           }
       ],
       "synchronizationRules": [
           {
           "editable": true,
           "id": "4c5ecfa1-a072-4460-b1c3-4adde3479854",
           "metadata": [..],
           "name": "USER_OUTBOUND_USER",
           "objectMappings": [
               {
                   "attributeMappings": [
                   ,{
                       "source": {
                           "name": "extension_9d98asdfl15980a_Nickname",
                           "type": "Attribute"
                       },
                       "targetAttributeName": "CommunityNickname"
                       }
               ],
               "name": "Synchronize Azure Active Directory Users to salesforce.com",
                   "scope": null,
                   "sourceObjectName": "User",
                   "targetObjectName": "User"
               }
           ],
           "priority": 1,
           "sourceDirectoryName": "Azure Active Directory",
           "targetDirectoryName": "salesforce.com"
           },
       ]
   }
   

保存修改后的同步架构

保存更新的同步架构时，请确保包括整个架构，包括未修改的部分。 此请求会将现有架构替换为你提供的架构。

PUT https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/schema
Authorization: Bearer {Token}
{
    "directories": [],
    "synchronizationRules": []
}

如果成功保存架构，请求将 204 No Content 返回响应代码。 在同步作业的下一次迭代中，它将开始重新处理Microsoft Entra ID中的所有帐户，并将新映射应用于所有预配的帐户。

相关内容

• Microsoft Entra ID同步 API 概述