Azure AD (Entra ID) Role Mapping: Expression and Direct Mapping Details

Alternatively, if you’re restricted to using app roles you have already defined (for example, `My Corp Administrators`) you’ll need to setup a switch for these roles. For example: ```text Switch(SingleAppRoleAssignment([appRoleAssignments]), "member", "My Corp Administrator", "owner", "My Corp Editor", "editor")` ``` 3. Set the following fields: - **Target attribute**: `urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole` - **Match objects using this attribute**: No - **Apply this mapping**: Always 4. Save your configuration. ### Direct mapping Direct mapping is an alternative to expression mapping. This implementation works for all three mapping types at the same time. In order to assign users, you'll need to use the Microsoft Graph API. 1. In the **Edit Attribute** view, select the **Direct** mapping type. 2. Set the following fields: - **Source attribute**: choose one of the allowed extension attributes in Entra (for example, `extensionAttribute1`) - **Target attribute**: `urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole` - **Match objects using this attribute**: No - **Apply this mapping**: Always If you're setting more than one attribute, for example role and organization, you need to choose a different extension attribute for each one. 3. Save your configuration. ### Assign users If you used expression mapping in the previous step, navigate to **App registrations**, select **YOUR APP**, and **App Roles**. Create an app role for each Docker role. If possible, create it with a display name that is directly equivalent to the role in Docker, for example, `owner` instead of `Owner`. If set up this way, then you can use expression mapping to `SingleAppRoleAssignment([appRoleAssignments])`. Otherwise, a custom switch will have to be used. See [Expression mapping](#expression-mapping). To add a user: 1. Select **YOUR APP**, then **Users and groups**. 2. Select **Add user/groups**, select the user you want to add, then **Select** their desired role.

The text provides detailed instructions for configuring role mapping in Azure AD (Entra ID) using both Expression Mapping and Direct Mapping. It explains how to use a switch for predefined app roles in expression mapping and specifies the required settings. For direct mapping, it outlines how to select source and target attributes, emphasizing the need for unique extension attributes for each mapped attribute. The final part details the process of assigning users to specific roles, highlighting the importance of creating corresponding app roles in Azure AD when using expression mapping.