Azure AD user provisioning in Google Workspace - Change the default OU

[MarkBerridge]

Hi everyone, I have had Azure AD user provisioning and single sign-on set up so Azure does the auth for Google accounts and devices. I would like to know if I can set the default OU in Google where users are created? I would like to do this because if we forget to move a student user the user doesn't get as many policies. For example I would like the users created/moved in to the ROOT\New Users OU

 

Any ideas?

 

Thanks,

 

Mark

Edited December 14, 2022 by MarkBerridge

[janaps]

Yes, this is possible. You have to do this with attribute mappings: in your enterprise application which you use for provisioning in gsuite, go to provisioning->Edit attribute mappings->Mapping, select "Provision Azure Active Directory Users" en click on Add New Mapping. I polulated the attribute "CompanyName" in azure with the OU the user should end up in in Gsuite. So you could choose

Mapping type: constant

Constant value: "/newUsersOU" -> this is the name of the ou, but in gsuite the name has a traling slash

Target attribute: OrgUnitPath

match object useing this attribute: no

Apply this mapping: only during object creation

 

If you want it more dynamically you can use expressions based on any azuread property using the expression builder. For instance in our azure ad we populate the companyname property, but it has no /. So

mapping type: expression

Expression: Append("/",[companyName])

Default value if null: / (users will be created in root of gsuite if no companyName value is present, so we don't have sync errors

Target attribute: OrgUnitPath

Match objects using this attribute: No

Apply this mapping: allways