Skype for Business Server User Management includes an Active Roles scheduled task that complements the Master Account Management policy to enforce synchronization of master and shadow account properties, and to capture existing Skype for Business Server users whose master account happens to fall under the control of that policy. The scheduled task object is in the Configuration/Server Configuration/Scheduled Tasks/Builtin container. The name of the object is Skype for Business - Master Account Management. The task is scheduled to run on a daily basis. Normally, you do not need to modify that scheduled task.
The operation of the task affects only the user accounts that are in the scope of the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object). When run, the task performs the following actions on each of those user accounts:
- If the user account does not have a shadow account that is enabled for Skype for Business Server, then skip over that user account.
- If the user account has a shadow account that is enabled for Skype for Business Server but does not store a reference to that shadow account, then create the reference to the shadow account on that user account.
This action enables Skype for Business Server User Management to administer exiting Skype for Business Server users, possibly enabled for Skype for Business Server by using an earlier version of Skype for Business Server User Management or without the use of Skype for Business Server User Management.
Skype for Business Server User Management provides a number of Access Templates allowing you to delegate the tasks of managing Skype for Business Server users in Active Roles. You can find these Access Templates in the Configuration/Access Templates/Skype for Business Server container:
Table 24: Skype for Business Server User Management Access
Skype for Business Server - User Full Control |
Gives permission to perform the following tasks by using Active Roles:
- Add and enable new Skype for Business Server users
- View existing Skype for Business Server users
- View or change the SIP address
- View or change the telephony option and related settings
- View or change the user policy assignments in Skype for Business Server
- Temporarily disable or re-enable users for Skype for Business Server
- Move users to another server or pool in Skype for Business Server
- Remove users from Skype for Business Server
|
Skype for Business Server - User Telephony |
Gives permission to perform the following tasks by using Active Roles:
- View existing Skype for Business Server users
- View the SIP address
- View or change the telephony option and related settings
- View the user policy assignments in Skype for Business Server
|
Skype for Business Server - User Disable/Re-enable |
Gives permission to perform the following tasks by using Active Roles:
- View existing Skype for Business Server users
- View the SIP address
- View the telephony option and related settings
- View the user policy assignments in Skype for Business Server
- Temporarily disable or re-enable users for Skype for Business Server
|
Skype for Business Server - User Policies |
Gives permission to perform the following tasks by using Active Roles:
- View existing Skype for Business Server users
- View the SIP address
- View the telephony option and related settings
- View or change the user policy assignments in Skype for Business Server
|
When applying Access Templates for Skype for Business Server User Management, consider your Active Directory topology.
Table 25: Applying Access templates for Skype for Business Server User Management
Single forest |
Apply Access Templates to Active Directory domains and containers to which the Built-in Policy - Skype for Business - User Management Policy Object (or a copy of that Policy Object) is applied, to allow access to user accounts of Skype for Business Server users managed by Active Roles. |
Multiple forests - Resource forest |
Apply Access Templates to Active Directory domains and containers in external forests to which the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object) is applied, to allow access to master accounts of Skype for Business Server uses managed by Active Roles.
You do not need to apply these Access Templates in the Skype for Business Server forest. |
Multiple forests - Central forest |
Apply Access Templates to Active Directory domains and containers in external forests to which the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object) is applied, to allow access to master accounts of Skype for Business Server uses managed by Active Roles.
Apply Access Templates to Active Directory domains and containers in the Skype for Business Server forest to which the Built-in Policy - Skype for Business - User Management Policy Object (or a copy of that Policy Object) is applied, to allow access to logon-enabled user accounts of Skype for Business Server users managed by Active Roles in the Skype for Business Server forest. |
This section summarizes the prerequisite conditions that must be met before you deploy Skype for Business Server User Management.