When One Field Has to Do the Work of Two

Thomas Schreiner

Thomas Schreiner

— 2 min read
Share

The unexpected SCIM trick that saved our user lifecycle automation

You've probably seen it on the LeanIX roadmap: improved User Lifecycle Management is coming. One of the highlights? Triggering actions when a user's department changes. Updates, subscription management, the works.

Sounds great. But it can become tricky if organizations aren't that simple.

The Problem: Departments Aren't Unique

Many companies don't just have one company in LeanIX. They have hundreds. And guess what? Department names repeat. "Demand Management" exists in Company A, Company B, and probably Companies C through Z.

Triggering an automation based on "Department = IT" would be chaos. We needed both pieces of information: department AND company.

Also, we might want to auto-tag fact sheets based on the company, not just the department.

Simple requirements. Not-so-simple solution.

Attempt #1: SAML

SAML is the backbone of most enterprise SSO setups. Surely we could pass department and company as attributes?

Result: Nope. LeanIX doesn't map department or companyName from SAML claims. The attributes arrive, but they disappear into the void. Dead end.

Attempt #2: SCIM

SCIM (System for Cross-domain Identity Management) is the standard for user provisioning. Microsoft Entra ID supports it, LeanIX supports it – match made in heaven?

Almost.

SCIM successfully syncs the department field. But companyName? LeanIX has no field for it. We tried every mapping combination. We read the docs twice. We read them backwards.

Result: Department works. Company doesn't. Half a solution.

Attempt #3: The Join Expression Hack

Then someone smart came up with a solution that changed everything:

"Well, you could just... put both values in the department field!"

In Entra ID's SCIM attribute mapping, you can use expressions. Instead of mapping a single attribute, you can join multiple values:

Join(";", [department], [companyName])

This writes something like Demand Management;Company A into the department field.

Result: IT WORKS. 🎉

What This Unlocks

Now we can query any user via the MTM API:

GET /services/mtm/v1/workspace/{id}/users/{userId}

The response includes the department field with our comma-separated payload. A simple split later, and we have both values ready for automation:

One field. Two values. Endless possibilities.

The Takeaway

Sometimes the elegant solution isn't a new feature or a custom integration. Sometimes it's creatively using what's already there.

SCIM gave us one field. We made it count for two.

Automating your LeanIX user lifecycle processes or auto-creating relations, permissions or tags based on organizations? Reach out to us – we've got you covered.

PS. Special thanks to Belén – your support was our turbo boost! 🚀

Read more