Chat now with support
Chat mit Support

Active Roles 8.1.1 - Administration Guide

Introduction Getting started Rule-based administrative views Role-based administration
Access Templates as administrative roles Access Template management tasks Examples of use Deployment considerations Windows claims-based access rules
Rule-based autoprovisioning and deprovisioning
Provisioning Policy Objects Deprovisioning Policy Objects How Policy Objects work Policy Object management tasks Policy configuration tasks
Property Generation and Validation User Logon Name Generation Group Membership AutoProvisioning Exchange Mailbox AutoProvisioning AutoProvisioning in SaaS products OneDrive Provisioning Home Folder AutoProvisioning Script Execution Microsoft 365 and Azure Tenant Selection E-mail Alias Generation User Account Deprovisioning Office 365 Licenses Retention Group Membership Removal Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Relocation User Account Permanent Deletion Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Notification Distribution Report Distribution
Deployment considerations Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Container Deletion Prevention policy Picture management rules Policy extensions
Using rule-based and role-based tools for granular administration Workflows
Key workflow features and definitions About workflow processes Workflow processing overview Workflow activities overview Configuring a workflow
Creating a workflow definition for a workflow Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configure an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Approval workflow Email-based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic groups Active Roles Reporting Management History Entitlement profile Recycle Bin AD LDS data management One Identity Starling Join and configuration through Active Roles Managing One Identity Starling Connect Configuring linked mailboxes with Exchange Resource Forest Management Configuring remote mailboxes for on-premises users Azure AD, Microsoft 365, and Exchange Online Management
Configuring Active Roles to manage Hybrid AD objects Managing Hybrid AD users
Creating a new Azure AD user with the Web Interface Viewing or updating the Azure AD user properties with the Web Interface Viewing or modifying the manager of a hybrid Azure user Disabling an Azure AD user Enabling an Azure AD user Deprovisioning of an Azure AD user Undo deprovisioning of an Azure AD user Adding an Azure AD user to a group Removing an Azure AD user from a group View the change history and user activity for an Azure AD user Deleting an Azure AD user with the Web Interface Creating a new hybrid Azure user with the Active Roles Web Interface Converting an on-premises user with an Exchange mailbox to a hybrid Azure user Licensing a hybrid Azure user for an Exchange Online mailbox Viewing or modifying the Exchange Online properties of a hybrid Azure user Creating a new Azure AD user with Management Shell Updating the Azure AD user properties with the Management Shell Viewing the Azure AD user properties with the Management Shell Delete an Azure AD user with the Management Shell Assigning Microsoft 365 licenses to new hybrid users Assigning Microsoft 365 licenses to existing hybrid users Modifying or removing Microsoft 365 licenses assigned to hybrid users Updating Microsoft 365 licenses display names
Unified provisioning policy for Azure M365 Tenant Selection, Microsoft 365 License Selection, Microsoft 365 Roles Selection, and OneDrive provisioning Microsoft 365 roles management for hybrid environment users Managing Microsoft 365 contacts Managing Hybrid AD groups Managing Microsoft 365 Groups Managing cloud-only distribution groups Managing cloud-only dynamic distribution groups Managing Azure security groups Managing cloud-only Azure users Managing cloud-only Azure guest users Managing cloud-only Azure contacts Changes to Active Roles policies for cloud-only Azure objects Managing room mailboxes Managing cloud-only shared mailboxes
Modern Authentication Managing the configuration of Active Roles
Connecting to the Administration Service Managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the Console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server replication Using regular expressions Administrative Template Communication ports Active Roles and supported Azure environments Integrating Active Roles with other products and services Active Roles Language Pack Active Roles Diagnostic Tools Active Roles Add-on Manager

Order of precedence

Once you have constructed a regular expression, it is evaluated much like an arithmetic expression. It is evaluated from left to right and follows an order of precedence.

The following table shows the order of precedence for the various regular expression operators, starting with the highest:

Table 120: Order of precedence

Character

Description

\

Escape

(), []

Parentheses and Brackets

*, +, ?, {n}, {n,}, {n,m}

Quantifiers

^, $, \anymetacharacter

Anchors and Sequences

|

Alteration

Administrative Template

The Active Roles Administrative Template allows you to control the behavior and appearance of the Active Roles Console by using Group Policy. For more information, see Active Roles snap-in settings.

This Administrative Template also provides a number of policy settings allowing you to limit the list of Active Roles’s Administration Service instances for auto-connect. For more information, see Administration Service auto-connect settings.

Active Roles snap-in settings

With the Active Roles Snap-in policy settings you can:

  • Hide some areas of the user interface with the Console.

  • Specify default settings for some user interface elements.

  • Specify settings to register extension snap-ins with the Active Roles Console.

The Administrative Template provides the following policy settings to control the behavior and appearance of the Active Roles Console:

Table 121: Policy settings to control the behavior and appearance of the Active Roles Console

Policy Setting

Explanation

Hide Exchange management

Removes all user interface elements (commands, wizards, and dialog boxes) intended to manage Exchange recipients. If you enable this policy, users cannot perform any Exchange tasks and manage any Exchange recipient settings with the Active Roles Console. If you disable this policy or do not configure it, users with appropriate permissions can use the Active Roles Console to perform Exchange tasks and manage Exchange recipient settings.

Set default view mode

Specifies view mode in which the Active Roles Console will start. If you enable this policy, you can select view mode from a list. When started, the Active Roles Console will switch to the view mode you have selected. By default, users are allowed to change view mode by using the Mode command on the View menu. If you want to enforce a view mode, select the User is not allowed to change view mode policy option. This option ensures that the Console user cannot change the view mode that you have selected.

Hide Configuration node

Removes the Configuration node from the Console tree when the Active Roles Console is in Advanced view mode. If you enable this policy, in Advanced view mode, all objects and containers related to the Active Roles configuration are not displayed. The Managed Units node and its contents are displayed as well as all advanced Active Directory objects and containers.

Disable Remember password option

Clears and disables the Remember password check box in the Connect to Administration Service dialog. If you enable this policy, the Connect as: The following user option in the Active Roles Console requires the user to enter their password every time when using that option, rather than encrypting and storing the password once it has been entered.

NOTE: Saving passwords may introduce a potential security risk.

Disable Connect as options

Disables the Connect as options in the Connect to Administration Service dialog, including the Remember password check box. If you enable this policy, the Console users are only allowed to connect to the Administration Service under their logon accounts. With this policy, the Current user option is selected under Connect as, and cannot be changed.

Set controlled objects to be marked by default

Specifies whether to use a special icon for visual indication of the objects to which Access Templates or Policy Objects are applied (linked). If you enable this policy, you can choose the category of object to be marked with a special icon by default. Users can modify this setting using the Mark Controlled Objects command on the View menu.

In addition, the Administrative Template provides for policies allowing you to register extension snap-ins with the Active Roles Console. These policies are located in the folder named Extension Snap-ins. Each policy in that folder is used to register one of the following:

Table 122: Policies allowing to register extension snap-ins with Active Roles Console

Policy Setting

Explanation

Namespace extensions

Allows you to register extension snap-ins to extend the namespace of the Active Roles Console.

Context menu extensions

Allows you to register extension snap-ins to extend a context menu in the Active Roles Console.

Toolbar extensions

Allows you to register extension snap-ins to extend the toolbar of the Active Roles Console.

Property sheet extensions

Allows you to register extension snap-ins to extend property sheets in the Active Roles Console.

Task pad extensions

Allows you to register extension snap-ins to extend a task pad in the Active Roles Console.

View extensions

Allows you to register extension snap-ins to add user interface elements to an existing view or to create new views in the Active Roles Console.

When configuring a policy from the Extension Snap-ins folder, you are prompted to specify the name and the value of the item to be added.

The name parameter determines the type of the node you want to extend. Each type is identified with a GUID. For example, if you want to extend user objects, the GUID is {D842D417-3A24-48e8-A97B-9A0C7B02FB17}. For information on other node types, refer to the Active Roles SDK Documentation.

The value parameter determines the extension snap-ins to be added. Each snap-in is identified with a GUID. You add multiple snap-ins by entering their GUIDs separated by semicolons. For example, value might look as follows:

{AD0269D8-27B9-4892-B027-9B01C8A011A1}"Description";{71B71FD3-0C9B-473a-B77B-12FD456FFFCB}"Description"

The entry "Description" is optional and may contain any text describing the extension snap-in, enclosed in double quotation marks.

Administration Service auto-connect settings

The Administrative Template provides the following settings that allow you to limit the list of Active Roles’s Administration Service instances for auto-connect:

When applied to a computer running an Active Roles client application, such as the Active Roles Console, Web Interface or ADSI Provider, these settings make it possible to restrict auto-connection of the client application to a predefined set of computers running the Administration Service, with inclusions or exclusions of certain computers from the pool of the Administration Service instances to auto-connect.

You can enable all these settings or only some of these settings. For example, if you only want to allow the client application to auto-connect to specific instances of the Administration Service (and only to those instances), then you could only enable and configure the Allowed Servers for Auto-connect setting. If you only want to prevent the client application from auto-connecting to particular instances of the Administration Service, you could only enable and configure the Disallowed Servers for Auto-connect setting. If you want the client application to auto-connect to a server identified by a computer alias, enable the Additional Servers for Auto-connect setting and add the computer alias to that setting.

The following rules apply when two or more settings are enabled. If the name of a given computer is listed in both the Allowed Servers for Auto-connect and Disallowed Servers for Auto-connect settings, then the client application is allowed to auto-connect to the Administration Service on that computer. If the name or alias of a particular computer is listed in the Additional Servers for Auto-connect setting, then the client application auto-connects to the Administration Service on that computer regardless of the Allowed Servers for Auto-connect and Disallowed Servers for Auto-connect settings.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen