Microsoft Purview's 'User ID' field not available for End User Lookup - Known Error

Microsoft Purview's 'User ID' field not available for End User Lookup Description Issue - Microsoft Purview's User ID field is not available for end-user lookup out-of-the-box (OOTB).

In ServiceNow, the following fields are mapped to the Sender attribute by default -

SharePointMetadata.From ExchangeMetadata.From However, this setup causes Endpoint events to have an empty Sender field, leading to failed end-user lookups.

According to Microsoft's API schema, the UserID field is consistently populated and can be used to identify violators across all Purview events.

However, in ServiceNow, UserID is mapped only to the Source User field, which is not available for end-user lookup OOTB.

As a result, endpoint events in ServiceNow do not display user lookup information.

Steps to Reproduce

Generate an Endpoint event in Microsoft Purview. Check the incident details in ServiceNow. Observe that the Sender attribute is missing. Check the UserID field, which is mapped to Source User instead of Sender. Notice that end-user lookup fails due to the absence of Sender data. Workaround As a fix for this, we are providing an update set that maps UserID to Sender for end-user lookup.

This ensures that the UserID field is available as a lookup attribute for all Purview events, including Endpoint events.

Note:- This update set is marked as 'replace_on_upgrade' true, ensuring that the update of the plugin to the next version is seamless and incorporates all these changes out-of-the box.