Chat now with support

Live-Hilfe anfordern
Registrierung abschließen

Anmelden

Preisinformationen anfragen

Vertrieb kontaktieren

Identity Manager 9.3 - Administration Guide for Connecting to Microsoft Entra ID

Inhaltsnavigation

Managing Microsoft Entra ID environments

Architecture overview One Identity Manager users for managing Microsoft Entra ID Configuration parameters for managing Microsoft Entra ID environments

Synchronizing a Microsoft Entra ID environment

Setting up initial synchronization with a Microsoft Entra ID tenant

Registering an enterprise application for One Identity Manager in the Microsoft Entra ID tenant Users and permissions for synchronizing with Microsoft Entra ID Setting up the Microsoft Entra ID synchronization server

System requirements for the Microsoft Entra ID synchronization server Installing One Identity Manager Service with a Microsoft Entra ID connector

Creating a synchronization project for initial synchronization of a Microsoft Entra ID tenant

Information required for Microsoft Entra ID synchronization projects Creating an initial synchronization project for a Microsoft Entra ID tenant

Configuring the synchronization log

Adjusting the synchronization configuration for Microsoft Entra ID environments

Configuring synchronization with Microsoft Entra ID tenants Configuring synchronization of different Microsoft Entra ID tenants Customizing synchronization projects to invite guest users Supporting custom Microsoft Entra ID extensions Changing system connection settings of Microsoft Entra ID tenants

Editing connection parameters in the variable set Editing target system connection properties

Updating schemas Speeding up synchronization Configuring the provisioning of memberships Configuring single object synchronization Accelerating provisioning and single object synchronization

Running synchronization

Starting synchronization Deactivating synchronization Displaying synchronization results Synchronizing single objects

Tasks following synchronization

Post-processing outstanding objects Adding custom tables to the target system synchronization Managing Microsoft Entra ID user accounts through account definitions

Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)

Managing Microsoft Entra ID user accounts and identities

Account definitions for Microsoft Entra ID user accounts

Creating account definitions Editing account definitions Main data for an account definition Editing manage levels Creating manage levels Assigning manage levels to account definitions Main data for manage levels Creating mapping rules for IT operating data Entering IT operating data Modify IT operating data Assigning account definitions to identities

Assigning account definitions to departments, cost centers, and locations Assigning account definitions to business roles Assigning account definitions to all identities Assigning account definitions directly to identities Assigning account definitions to system roles Adding account definitions in the IT Shop

Assigning account definitions to Microsoft Entra ID tenants Deleting account definitions

Assigning identities automatically to Microsoft Entra ID user accounts

Editing search criteria for automatic identity assignment Finding identities and directly assigning them to user accounts Changing manage levels for Microsoft Entra ID user accounts

Supported user account types

Default user accounts Administrative user accounts

Providing administrative user accounts for one identity Providing administrative user accounts for several people

Privileged user accounts

Updating identities when Microsoft Entra ID user account are modified Specifying deferred deletion for Microsoft Entra ID user accounts

Managing memberships in Microsoft Entra ID groups

Assigning Microsoft Entra ID groups to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of Microsoft Entra ID groups to Microsoft Entra ID user accounts Assigning Microsoft Entra ID groups to departments, cost centers and locations Assigning Microsoft Entra ID groups to business roles Adding Microsoft Entra ID groups to system roles Adding Microsoft Entra ID groups to the IT Shop Adding Microsoft Entra ID groups automatically to the IT Shop Assigning Microsoft Entra ID user accounts directly to Microsoft Entra ID groups Assigning Microsoft Entra ID groups directly to Microsoft Entra ID user accounts

Effectiveness of group memberships Microsoft Entra ID group inheritance based on categories Overview of all assignments

Managing Microsoft Entra ID administrator roles assignments

Assigning Microsoft Entra ID administrator roles to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of Microsoft Entra ID administration roles to Microsoft Entra ID user accounts Assigning Microsoft Entra ID administrator roles to departments, cost centers, and locations Assigning Microsoft Entra ID administrator roles to business roles Adding Microsoft Entra ID administrator roles to system roles Adding Microsoft Entra ID administrator roles in the IT Shop Adding Microsoft Entra ID administrator roles to the IT Shop Assigning Microsoft Entra ID user accounts directly to Microsoft Entra ID administrator roles Assigning Microsoft Entra ID administrator roles directly to Microsoft Entra ID user accounts

Microsoft Entra ID administrator role inheritance based on categories

Managing Microsoft Entra ID subscription and Microsoft Entra ID service plan assignments

Displaying enabled and disabled Microsoft Entra ID service plans forMicrosoft Entra ID user accounts and Microsoft Entra ID groups Assigning Microsoft Entra ID subscriptions to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of Microsoft Entra ID subscriptions to Microsoft Entra ID user accounts Assigning Microsoft Entra ID subscriptions to departments, cost centers, and locations Assigning Microsoft Entra ID subscriptions to business roles Adding Microsoft Entra ID subscriptions to system roles Adding Microsoft Entra ID subscriptions to the IT Shop Adding Microsoft Entra ID subscriptions automatically to the IT Shop Assigning Microsoft Entra ID user account directly to Microsoft Entra ID subscriptions Assigning Microsoft Entra ID subscriptions directly to Microsoft Entra ID user accounts

Assigning disabled Microsoft Entra ID service plans to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of disabled Microsoft Entra ID service plans to Microsoft Entra ID user accounts Assigning disabled Microsoft Entra ID service plans directly to departments, cost centers, and locations Assigning disabled Microsoft Entra ID service plans to business roles Adding disabled Microsoft Entra ID service plans to system roles Adding disabled Microsoft Entra ID service plans to the IT Shop Adding disabled Microsoft Entra ID service plans automatically to the IT Shop Assigning Microsoft Entra ID user accounts directly to disabled Microsoft Entra ID service plans Assigning disabled Microsoft Entra ID service plans directly to Microsoft Entra ID user accounts

Inheriting Microsoft Entra ID subscriptions based on categories Inheritance of disabled Microsoft Entra ID service plans based on categories

Login credentials for Microsoft Entra ID user accounts

Password policies for Microsoft Entra ID user accounts

Predefined password policies Using password policies Creating password policies Editing password policies General main data of password policies Policy settings Character classes for passwords Custom scripts for password requirements

Checking passwords with a script Generating passwords with a script

Password exclusion list Checking passwords Testing password generation

Initial password for new Microsoft Entra ID user accounts Email notifications about login data

Microsoft Entra ID role management

Microsoft Entra ID role management tenants Enabling new Microsoft Entra ID role management features Microsoft Entra ID role main data Main data of Microsoft Entra ID role settings Displaying Microsoft Entra ID role settings main data Assigning temporary access passes to Microsoft Entra ID user accounts Displaying Microsoft Entra ID scoped role assignments Displaying scoped role eligibilities for Microsoft Entra ID roles Overview of Microsoft Entra ID scoped role assignments Main data of Microsoft Entra ID scoped role assignments Managing Microsoft Entra ID scoped role assignments Adding Microsoft Entra ID scoped role assignments Editing Microsoft Entra ID scoped role assignments Deleting Microsoft Entra ID scoped role assignments Assigning Microsoft Entra ID scoped role assignments Assigning Microsoft Entra ID scoped role assignments to Microsoft Entra ID user accounts Assigning Microsoft Entra ID scoped role assignments to Microsoft Entra ID groups Assigning Microsoft Entra ID scoped role assignments to Microsoft Entra ID service principals Assigning Microsoft Entra ID system roles to scopes through role assignments Assigning Microsoft Entra ID business roles to scopes though role assignments Assigning Microsoft Entra ID organizations to scopes through role assignments Overview of Microsoft Entra ID scoped role eligibilities Main data of Microsoft Entra ID scoped role eligibilities Managing Microsoft Entra ID scoped role eligibilities Adding Microsoft Entra ID scoped role eligibilities Editing Microsoft Entra ID scoped role eligibilities Deleting Microsoft Entra ID scoped role eligibilities Assigning Microsoft Entra ID scoped role eligibilities Assigning Microsoft Entra ID scoped role eligibilities to Microsoft Entra ID user accounts Assigning Microsoft Entra ID scoped role eligibilities to Microsoft Entra ID groups Assigning Microsoft Entra ID scoped role eligibilities to Microsoft Entra ID service principals Assigning Microsoft Entra ID system roles to scopes through role eligibilities Assigning Microsoft Entra ID business roles to scopes though role eligibilities Assigning Microsoft Entra ID organizations to scopes through role eligibilities

Mapping Microsoft Entra ID objects in One Identity Manager

Microsoft Entra ID core directories

Microsoft Entra ID tenant General main data of Microsoft Entra ID tenants Information about local Active Directory Defining categories for the inheritance of entitlements Editing the synchronization project for a Microsoft Entra ID tenant Microsoft Entra ID domains Microsoft Entra ID policies for activity-based timeouts Microsoft Entra ID policies for home realm discovery Microsoft Entra ID policies for issuing tokens Microsoft Entra ID policies for token lifetime

Microsoft Entra ID user accounts

Creating and editing Microsoft Entra ID user accounts General main data of Microsoft Entra ID user accounts Contact data for Microsoft Entra ID user accounts Information about the user profile for Microsoft Entra ID user accounts Organizational data for Microsoft Entra ID user accounts Information about the local Active Directory user account Audit data for Microsoft Entra ID user accounts Assigning extended properties to Microsoft Entra ID user accounts Disabling Microsoft Entra ID user accounts Deleting and restoring Microsoft Entra ID user accounts Displaying the Microsoft Entra ID user account overview Displaying Active Directory user accounts for Microsoft Entra ID user accounts

Microsoft Entra ID user identities

Deploying user identities for Microsoft Entra ID user accounts Displaying user identities for Microsoft Entra ID user accounts Displaying Microsoft Entra ID user identities' main data Displaying the Microsoft Entra ID user identity overview

Microsoft Entra ID groups

Editing main data of Microsoft Entra ID groups General main data for Microsoft Entra ID groups Information about local Active Directory groups Adding Microsoft Entra ID groups to Microsoft Entra ID groups Assigning Microsoft Entra ID administrator roles to Microsoft Entra ID groups Assigning owners to Microsoft Entra ID groups Assigning extended properties to Microsoft Entra ID groups Deleting Microsoft Entra ID groups Displaying the Microsoft Entra ID group overview Displaying Active Directory groups for Microsoft Entra ID groups

Microsoft Entra ID administrator roles

Editing main data of Microsoft Entra ID administrator roles Assigning Microsoft Entra ID groups to Microsoft Entra ID administrator roles Assigning extended properties to Microsoft Entra ID administrator roles Displaying the Microsoft Entra ID administration role overview

Microsoft Entra ID administrative units

Editing main data of administrative units Assigning user accounts to administrative units Assigning groups to administrative units

Microsoft Entra ID subscriptions and Microsoft Entra ID service principals

Editing Microsoft Entra ID subscription main data Assigning additional properties to Microsoft Entra ID subscriptions Displaying the Microsoft Entra ID subscriptions and service plan overview

Disabled Microsoft Entra ID service plans

Editing main data of disabled Microsoft Entra ID service plans Assigning extended properties to disabled Microsoft Entra ID service plans Displaying the disabled Microsoft Entra ID service plan overview

Microsoft Entra ID app registrations and Microsoft Entra ID service principals

Displaying information about Microsoft Entra ID app registrations Assigning owners to Microsoft Entra ID app registrations Displaying Microsoft Entra ID app registration main data Displaying information about Microsoft Entra ID service principals Assigning owners to Microsoft Entra ID service principals Editing authorizations for Microsoft Entra ID service principals Displaying Microsoft Entra ID service principals for enterprise applications Displaying Microsoft Entra ID service principal main data

Reports about Microsoft Entra ID objects Managing Microsoft Entra ID security attributes

Assigning Microsoft Entra ID security attributes to user accounts Assigning Microsoft Entra ID security attributes to service principals

Handling of Microsoft Entra ID objects in the Web Portal Recommendations for federations Basic data for managing a Microsoft Entra ID environment

Target system managers for Microsoft Entra ID Job server for Microsoft Entra ID-specific process handling

General main data of Job servers Specifying server functions

Troubleshooting

Possible errors when synchronizing an Microsoft Entra ID tenant

Configuration parameters for managing a Microsoft Entra ID environment Default project template for Microsoft Entra ID

Project template for Microsoft Entra ID tenants Project template for Microsoft Entra ID B2C tenants

Editing Microsoft Entra ID system objects Microsoft Entra ID connector settings

Displaying Microsoft Entra ID app registration main data

The information about the Microsoft Entra ID app registration is loaded into One Identity Manager during synchronization. You cannot edit Microsoft Entra ID app registration main data.

To display a Microsoft Entra ID app registration's main data

In the Manager, select the Microsoft Entra ID > App registrations category.
Select the Microsoft Entra ID app registration in the result list.
Select Change main data.

Table 45: Main data of a Microsoft Entra ID app registration
Property	Description
Display name	Display name of the application.
Client	Microsoft Entra ID tenant of the app registration.
Token issuance policies	Name of the policy for issuing tokens.
Token lifetime policy	Name of the policy for token lifetimes.
Owner (Application Role)	Application roles whose members can configure the app registration.
Registration date	Date and time when the application was registered.
Logo URL	Link to the application's logo.
Marketing URL	Link to the application's marketing page.
Privacy statement URL	Link to the application's privacy statement.
Service URL	Link to the application's support page.
Terms of service URL	Link to the application's terms of service.
Publisher domain	Name of the application's verified publisher domain.
Group membership claim	Group membership claim expected by the application. Group types that are included in the access, ID, and SAML tokens.
Supported user accounts	Specifies which Microsoft user accounts for the current application are supported. Permitted values are: Accounts in this organizational directory only Accounts in any organizational directory Accounts in any organizational directory and personal Microsoft accounts Only personal Microsoft accounts
Tags	User-defined string to use for categorizing and identifying the application.
Fallback public client	Specifies whether the fallback application type is a public client, such as an application installed and running on a mobile device. The default value is false meaning the fallback application type is a confidential client such as a web application. If the option is disabled, it means that the fallback application type is a confidential client, such as a web application (default).

Related topics

Displaying information about Microsoft Entra ID service principals

When an application is registered in a Microsoft Entra ID tenant in Microsoft Azure Management Portal, it creates an associated Microsoft Entra ID service principal.

The information about the Microsoft Entra ID service principal is loaded into One Identity Manager during synchronization. You cannot create new Microsoft Entra ID service principals in One Identity Manager.

If a Microsoft Entra ID application is used in a Microsoft Entra ID tenant that is registered in another Microsoft Entra ID tenant, only the Microsoft Entra ID service principal and not the Microsoft Entra ID app registration is loaded into One Identity Manager.

To display information about a Microsoft Entra ID service principal

In the Manager, select the Microsoft Entra ID > Service principals category.
In the result list, select the Microsoft Entra ID service principal.
Select one of the following tasks:
- Microsoft Entra ID service principal overview: This shows you an overview of the Microsoft Entra ID service principal and its dependencies.
- Change main data: This displays the Microsoft Entra ID service principal's main data.
- Assign owners: This displays the Microsoft Entra ID service principals owners. You can assign owners to a service principal or remove them.
- Assign authorizations: This displays user accounts, groups, and service principals with their assigned app roles. You can create more authorizations or removed them.

Related topics

Assigning owners to Microsoft Entra ID service principals

Use this task to assign owners to a Microsoft Entra ID service principal or to remove them from a service principal.

To assign owners to a Microsoft Entra ID service principal

In the Manager, select the Microsoft Entra ID > Service principals category.
In the result list, select the Microsoft Entra ID service principal.
Select the Assign owner task.
In the Table drop-down, select one of the following entries.
- Microsoft Entra ID user accounts (AADUser)
- Microsoft Entra ID service principals (AADServicePrincipal)
In the Add assignments pane, assign owners.
TIP: In the Remove assignments pane, you can remove assigned owners.

To remove an assignment
- Select the owner and double-click .
Save the changes.

Editing authorizations for Microsoft Entra ID service principals

There are so-called app roles defined for app registrations. Microsoft Entra ID users, Microsoft Entra ID groups, or Microsoft Entra ID service principals can use app roles to provide permissions or functions for the application.

App roles and their assignments are loaded into One Identity Manager by synchronization. However, you cannot create new app roles in One Identity Manager. In One Identity Manager, you can add or remove authorizations for the service principals and their app registrations respectively.

To assign authorizations to a Microsoft Entra ID service principal

In the Manager, select the Microsoft Entra ID > Service principals category.
In the result list, select the Microsoft Entra ID service principal.
Select the Assign authorizations task.
In the Assignments pane, click Add and enter the following data.
- Authorized for: Specify the user account, group, or service principal for the authorization.
  1. Click next to the field.
  2. Under Table, select one of the following tables:
    - To authorize a user account, select AADUser.
    - To authorize a group, select AADGroup.
    - To authorize a service principal, select AADServicePrincipal.
  3. Under Authorized for, select the user account, group, or service principal.
  4. Click OK.
- App role: Select the app role for the authorization.
  
  NOTE: If there is no app role defined for a service principal, leave this item empty to authorize the user account, group, or service principal.
Save the changes.

To remove authorizations from a Microsoft Entra ID service principal

In the Manager, select the Microsoft Entra ID > Service principals category.
In the result list, select the Microsoft Entra ID service principal.
Select the Assign authorizations task.
In the Assignments pane, select the authorization you want to remove.
Click Remove.
Save the changes.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen

© 2025 One Identity LLC. ALL RIGHTS RESERVED. Nutzungsbedingungen Datenschutz Cookie Preference Center