📋 Microsoft Entra Documentation Changes

**Scenario 1**: You want to clean up a phone number value coming from Workday by removing spaces, brackets, and dashes.

 

**Target attribute**: telephoneNumber, mobile

 

```

Replace([PrimaryWorkTelephone], , "[()\\s-]+", , "", , )

Replace([Mobile], , "[()\\s-]+", , "", , )

```

 

**Example:**

- **Input Values**: [PrimaryWorkTelephone] = "+1 (555) 123-4567"

- **Output of Expression**: `+15551234567`

ms.date: 08/12/2025

The [Conditional Access optimization agent](../identity/conditional-access/agent-optimization.md) ensures all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings. The agent evaluates policies requiring multifactor authentication (MFA), enforces device based controls (device compliance, app protection policies, and Domain Joined Devices), and blocks legacy authentication and device code flow.

| Attribute | Description |

|---------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|

| Trigger | Runs every 24 hours or manually. |

| Permissions | Reviews policy configuration. Creates new policies in report-only mode. Suggests policy changes that must be approved. |

| Identity | Runs as the administrator who configured the agent. |

| Products | [Microsoft Entra Conditional Access](/entra/identity/conditional-access/), [Security Copilot](/copilot/security/microsoft-security-copilot) |

| Plugins | [Microsoft Entra](/entra/fundamentals/copilot-security-entra) |

| Role-based access | Requires [Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator) or [Global Administrator](../identity/role-based-access-control/permissions-reference.md#global-administrator) to turn on the agent. More roles can be added in Security Copilot role assignments |

title: 'SuccessFactors Expression Mapping Functions for Microsoft Entra ID Provisioning'

description: A comprehensive guide to commonly used expression mapping functions when configuring SuccessFactors to Microsoft Entra ID user provisioning. These functions help transform and map data from SuccessFactors to create appropriate user attributes in Microsoft Entra ID.

**Scenario 1**: You need to remove apostrophes and dashes from email addresses for Azure AD Connect compatibility.

- **Use SelectUniqueValue** for all attributes that require uniqueness (UPN, samAccountName, email).

- **Handle null and empty values** using functions like `IsNullOrEmpty`, `IsPresent`, `Switch`, or `Coalesce`.

 

### Why am I hitting this error when configuring my SAML application?

 

SAML applications are exempt from the identifier URI restrictions by default. However, they must be explicitly indicated as SAML applications in order for the exemption to apply.

 

If the SAML setup was configured using the 'Single Sign On' page of 'Enterprise applications', then the app will automatically be indicated as a SAML app. If not, you can indicate the app as a SAML app by setting the `preferredSingleSignOn` mode property of the service principal to `SAML`.

 

To do this, make the following request. You can get the object ID of the service principal from the [Enterprise applications experience](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview).

 

```http

PATCH https://graph.microsoft.com/v1.0/servicePrincipals/{objectIdOfServicePrincipal}

```

 

```json

{

"preferredSingleSignOnMode": "SAML"

}

author: rolyon

ms.date: 08/12/2025

ms.author: rolyon

> | [Places Administrator](#places-administrator) | Manage all aspects of the Microsoft Places service. | 78b0ccd1-afc2-4f92-9116-b41aedd09592 |

ms.date: 08/12/2025

:::image type="content" source="media/how-to-application-discovery/recommendation-onboard-discovered.png" alt-text="Screenshot of the Recommendations tab, showing the recommendation to onboard new discovered application segments to enterprise applications.":::

 

ms.date: 08/08/2025

1. Upload the signed certificates (```signedcertificate.pem```and ```rootCAchain.pem```) according to the steps in [Create a CSR and upload the signed certificate for TLS termination](#step-1-global-secure-access-admin-create-a-csr-and-upload-the-signed-certificate-for-tls-termination).

| Accounts in this directory only | Single tenant | All user and guest accounts in your directory can use your application or API.<br>Use this option if your target audience is internal to your organization. <br> Use if building an app registration for a third party that instructs you to build your own app registration for their app. |

> |Subject | `sub` |Identifies the principal about which the token asserts information, such as the user of an application. The subject is always present in the SAML token that Microsoft Entra ID issues. Depending on the [NameID format](/entra/identity-platform/saml-claims-customization#nameid-format), this value *may* be used to identify the subject in a general-purpose authorization system (see [risks when using email address for authorization](https://msrc.microsoft.com/blog/2023/06/potential-risk-of-privilege-escalation-in-azure-ad-applications/)).<br> `SubjectConfirmation` is not a claim. It describes how the subject of the token is verified. `Bearer` indicates that the subject is confirmed by their possession of the token. | `<Subject>`<br>`<NameID>S40rgb3XjhFTv6EQTETkEzcgVmToHKRkZUIsJlmLdVc</NameID>`<br>`<SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />`<br>`</Subject>`|