A place to ask questions, connect with others, and stay in the know
The challenge is actually on the Azure AD side of things. There aren't many great tools for manipulating payloads within Azure AD, so for certain fields (Roles being one of them), there's a very limited path forward. The only setup Azure AD has that is compatible with the Roles array of objects is to use the appRoleAssignments, as described here: https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/customize-application-attributes and https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/functions-for-customizing-application-data. Following this guide, you'll need to create an AppRole that matches the Genesys Cloud Role by name, then assign it to a user, and use one of the AppRoleAssignment functions as the source for the roles..value target in Genesys Cloud
Azure also has a known bug in their payload for the (AppRoleAssignmentsComplex) where they are only setting a single role out of the group assigned to the user. Azure AD is aware of this, and is supposed to be working on this from their end (as they control the payloads being sent to our API), but there has been no update in some time on the status of this bug.
Also, if you're just looking to assign roles by Group Membership, you can set this up in Genesys Cloud by assigning a Role to the Group: https://help.mypurecloud.com/articles/assign-roles-to-a-group/
You can then use the security groups in Azure AD to assign users to a Group in Genesys Cloud, which will then cause the user to inherit the Role from their membership in the Group. If/when you remove the user from the Security Group in Azure AD, the user will then be removed from the Group in Genesys Cloud by way of the Automated Provisioning process; once the use is removed from the Group in Genesys Cloud, they will no longer inherit the role (note that most Genesys Cloud apps will require a user to log out and log back in to pick up the changes in permissions).
That's really more of a function of Azure's user provisioning system. The only groups I've ever seen included for provisioning were security groups, but their documentation is a little sparse on the topic. What I have seen other customers do is establish security groups in Azure AD that have inclusion rules that are driven by membership in other collections within Azure (email groups is the most common I've encountered).
Please keep in mind that the Azure Ad group needs to match the name of the Genesys Cloud group you're looking to include users in for the sync to perform properly. Normally, group updates are done within Genesys Cloud by ID, not name; because Azure AD is not referencing the group by ID, the only other element remaining to match on is the name.
Every year, Genesys® delivers more than 70 billion remarkable customer experiences for organizations in over 100 countries. Through the power of the cloud and AI, our technology connects every customer moment across marketing, sales and service on any channel, while also improving employee experiences. Genesys pioneered Experience as a ServiceSM so organizations of any size can provide true personalization at scale, interact with empathy, and foster customer trust and loyalty. This is enabled by Genesys Cloud™, an all-in-one solution and the world's leading public cloud contact center platform, designed for rapid innovation, scalability and flexibility. Visit www.genesys.com.