Active Roles 8.0 LTS - Synchronization Service Administration Guide

Prerequisites

To assign all required permissions to the application, you must install the Azure AD PowerShell module. For more information on how to install the module, see Install Azure Active Directory PowerShell for Graph in the Microsoft Azure documentation, or download the module manually.

To configure Microsoft Azure AD Connector as an Azure application

1. In the Azure Portal, register a new application in the domain of your Microsoft Azure AD environment where you want to perform data synchronization. For more information, see Register an application with the Microsoft identity platform in the Microsoft Azure documentation.

2. Assign the required permissions to the application via a Windows PowerShell script, so that the Microsoft Azure AD Connector of the Active Roles Synchronization Service can read and write data in Microsoft Azure AD. To do so, adapt and run the following Windows PowerShell script.

   Example PowerShell Script to assign permissions to Microsoft Azure AD Connector

   # Replace <ClientId> with the Client ID of the Active Roles Azure AD Connector application (example format: 455ad643-332g-32h7-q004-8ba89ce65ae26)
   
   $Id = “<ClientId>”
   
   # Prompt for Microsoft Azure AD Global Admin credentials.
   
   # Save the supplied credentials to the $creds variable.
   
   $creds=get-credential
   
   # Connect to Azure AD using the credentials stored in $creds.
   
   Connect-AzureAD -credential $creds
   
   # Get the Principal ID of the Active Roles Azure AD Connector Application and save it to the $servicePrincipal variable
   
   $servicePrincipal = Get-AzureADServicePrincipal -All $true | Where-Object {$_.AppId -eq $Id}
   
   # Get the required role ID from the Active Roles Azure AD Connector Application and save it to the $roleId variable
   
   $roleId = (Get-AzureADDirectoryRole | Where-Object {$_.displayName -eq 'Company Administrator'}).ObjectId
   
   # Assign the required permissions to the Active Roles Azure AD Connector application
   
   Add-AzureADDirectoryRoleMember -ObjectId $roleId -RefObjectId $servicePrincipal.ObjectId

3. In the Azure Portal, open the application you created and take note of the following information:

   • Client ID

   • Valid key of the application

   These information will be required when configuring the Microsoft Azure AD Connector as described in Creating a connection with the Microsoft Azure AD Connector.