[midPoint] Application-role priority enforcement (per service)— prune removing org assignments unexpectedly

[Yakiv Revyakin]

Hello Bau,
My assumption is that the policy doesn’t affect indirect assignments induced by an org. Till you have certain org assigned it will induce.
To implement the behavior, you need more complicated approach adding additional layer of abstraction in user archetype.

From: midPoint <midpoint-bounces at lists.evolveum.com> On Behalf Of Bao Tran via midPoint
Sent: Wednesday, June 17, 2026 11:33 AM
To: midpoint at lists.evolveum.com
Cc: Bao Tran <bao.tran at csit.fi>
Subject: [midPoint] Application-role priority enforcement (per service)— prune removing org assignments unexpectedly


Hi all,
We're running into an issue with  priority enforcement for application-roles for single service in MidPoint and would appreciate any insight.

Our goal: A service has multi application-role , a user John can have multiple org assignments with different relations → only the highest application-role (E5) wins, application-role F3 is suppressed.

What we tried (and failed):

  *   Orgs have 2 inducements:

     *   → E5 (condition: relation=manager)
     *   → F3 (no condition, everyone gets this as base)

  *   Service O365 has 2 application-roles:
      - E5
      - F3
  *   F3 role has an exclusion policy rule → prune when E5 is present:

<role>

  <name>F3</name>

  <assignment>

    <policyRule>

      <name>m365-f3-excluded-by-e5</name>

      <policyConstraints>

        <exclusion>

          <targetRef oid="E5" type="c:RoleType"/>

        </exclusion>

      </policyConstraints>

      <policyActions>

        <prune/>

      </policyActions>

    </policyRule>

  </assignment>



Steps to reproduce the failure:
      Create new user John

  1.  Assign John → org101 as manager → gets E5
  2.  Assign John → org102 as default → org101 assignment gets removed ❌
  3.  Re-assign John → org101 as manager → org102 assignment gets removed ❌

Symptom:
The F3 and E5 prune fires and removes the upstream direct org assignment instead of just suppressing the application-role .

Question:
How do we configure MidPoint so O365 service (or in application-role) that E5 > F3 priority is enforced at the O365 service level, without affecting org assignments?

--
Bao Tran
Software developer

Attention! This email came from outside the ISSP company. If you do not trust this sender, do not click on the link or open the attachments, as this could be a phishing message.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260617/8e9e740e/attachment-0001.htm>