<div dir="ltr">Hi Yakiv,<div><p>Thanks for the response,<br>Would you be able to point us to any documentation or examples on how to implement that abstraction layer in the user archetype? Even a hint or a starting point would be very helpful.</p></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Jun 17, 2026 at 9:18 PM Yakiv Revyakin <<a href="mailto:yrevyakin@issp.com">yrevyakin@issp.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg4380594760228641889">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_4380594760228641889WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">Hello Bau,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">My assumption is that the policy doesn’t affect indirect assignments induced by an org. Till you have certain org assigned it will induce.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">To implement the behavior, you need more complicated approach adding additional layer of abstraction in user archetype.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(225,225,225) currentcolor currentcolor;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>>
<b>On Behalf Of </b>Bao Tran via midPoint<br>
<b>Sent:</b> Wednesday, June 17, 2026 11:33 AM<br>
<b>To:</b> <a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a><br>
<b>Cc:</b> Bao Tran <<a href="mailto:bao.tran@csit.fi" target="_blank">bao.tran@csit.fi</a>><br>
<b>Subject:</b> [midPoint] Application-role priority enforcement (per service)— prune removing org assignments unexpectedly<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="m_4380594760228641889gmail-font-claude-response-body">Hi all,<br>
We're running into an issue with priority enforcement for application-roles for single service in MidPoint and would appreciate any insight.<u></u><u></u></p>
<p class="m_4380594760228641889gmail-font-claude-response-body"><b>Our goal: </b>A service has multi application-role , a user John can have multiple org assignments with different relations → only the highest application-role (E5) wins, application-role F3 is suppressed.<u></u><u></u></p>
<p class="m_4380594760228641889gmail-font-claude-response-body"><strong><span style="font-family:Aptos,sans-serif">What we tried (and failed):</span></strong><u></u><u></u></p>
<ul type="disc">
<li class="m_4380594760228641889gmail-font-claude-response-body">Orgs have 2 inducements:
<u></u><u></u></li></ul>
<ul type="disc">
<ul type="circle">
<li class="m_4380594760228641889gmail-font-claude-response-body">→ E5 (condition:
<code><span style="font-size:10pt">relation=manager</span></code>)<u></u><u></u></li><li class="m_4380594760228641889gmail-font-claude-response-body">→ F3 (no condition, everyone gets this as base)<u></u><u></u></li></ul>
</ul>
<ul type="disc">
<li class="m_4380594760228641889gmail-font-claude-response-body">Service O365 has 2 application-roles:
<br>
- E5<br>
- F3<u></u><u></u></li><li class="m_4380594760228641889gmail-font-claude-response-body">F3 role has an exclusion policy rule → prune when E5 is present:<u></u><u></u></li></ul>
<div>
<div>
<pre><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">role</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">name</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)">F3</span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">name</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">assignment</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">policyRule</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">name</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)">m365-f3-excluded-by-e5</span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">name</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">policyConstraints</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">exclusion</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">targetRef </span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(189,15,30)">oid</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">="</span></span><span class="m_4380594760228641889gmail-token"><span style="color:green">E5</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">"</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)"> </span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(189,15,30)">type</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">="</span></span><span class="m_4380594760228641889gmail-token"><span style="color:green">c:RoleType</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">"/></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">exclusion</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">policyConstraints</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">policyActions</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"><</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">prune</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">/></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">policyActions</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">policyRule</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><code><span style="color:rgb(20,24,31)"> </span></code><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)"></</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(184,10,24)">assignment</span></span><span class="m_4380594760228641889gmail-token"><span style="color:rgb(43,48,59)">></span></span><code><span style="color:rgb(20,24,31)"><u></u><u></u></span></code></pre>
<pre><span style="color:rgb(20,24,31)"><u></u> <u></u></span></pre>
</div>
</div>
<p class="m_4380594760228641889gmail-font-claude-response-body"><strong><span style="font-family:Aptos,sans-serif">Steps to reproduce the failure:</span></strong><b><br>
<strong><span style="font-family:Aptos,sans-serif"> </span></strong></b>Create new user John <u></u><u></u></p>
<ol start="1" type="1">
<li class="m_4380594760228641889gmail-font-claude-response-body">Assign John → org101 as
<code><span style="font-size:10pt">manager</span></code> → gets E5 <u></u><u></u></li><li class="m_4380594760228641889gmail-font-claude-response-body">Assign John → org102 as
<code><span style="font-size:10pt">default</span></code> → <strong><span style="font-family:Aptos,sans-serif">org101 assignment gets removed</span></strong>
<span style="font-family:"Segoe UI Emoji",sans-serif">❌</span><u></u><u></u></li><li class="m_4380594760228641889gmail-font-claude-response-body">Re-assign John → org101 as
<code><span style="font-size:10pt">manager</span></code> → <strong><span style="font-family:Aptos,sans-serif">org102 assignment gets removed</span></strong>
<span style="font-family:"Segoe UI Emoji",sans-serif">❌</span><u></u><u></u></li></ol>
<p class="m_4380594760228641889gmail-font-claude-response-body"><strong><span style="font-family:Aptos,sans-serif">Symptom:</span></strong><br>
The F3 and E5 prune fires and removes the upstream direct org assignment instead of just suppressing the application-role .<u></u><u></u></p>
<p class="m_4380594760228641889gmail-font-claude-response-body"><strong><span style="font-family:Aptos,sans-serif">Question:</span></strong><br>
How do we configure MidPoint so O365 service (or in application-role) that E5 > F3 priority is enforced at the O365 service level, without affecting org assignments?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><span class="m_4380594760228641889gmailsignatureprefix">-- </span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Bao Tran <u></u><u></u></p>
<div>
<p class="MsoNormal">Software developer<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p><span style="color:red">Attention! This email came from outside the ISSP company. If you do not trust this sender, do not click on the link or open the attachments, as this could be a phishing message.</span><u></u><u></u></p>
<p> <u></u><u></u></p>
</div>
</div>
</div></blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Bao Tran<div>Software developer</div></div></div>