Active Roles 8.1.3 - Synchronization Service Administration Guide

Prerequisites

The hybrid environment must meet the following requirements to configure Azure BackSync manually:

• Azure Active Directory (Azure AD) module version 2.0.0.131 or later must be installed and configured.

• You must authenticate the Azure tenant of the Azure AD for which you configure back-synchronization. Also, you must consent Active Roles as an Azure application.

  For more information, see Configuring Active Roles to manage Azure AD using the GUI in the Active Roles Administration Guide.

• For the container where Active Roles performs back-synchronization, you must enforce the built-in Azure AD policy that automatically sets the attribute edsvaazureOffice365enabled to true.

• Your Active Roles user must have write permissions for the following attributes:

  • edsvaAzureOffice365Enabled

  • edsaAzureContactObjectId

  • edsvaAzureObjectID

  • edsvaAzureAssociatedTenantId

• Your Active Roles user must also have local administrator privileges on the machine where Active Roles Synchronization Service is running.

To configure a manual Azure BackSync workflow

1. Create a connection to Azure AD using the Azure AD Connector. The configuration requires the following data:

   • The Azure domain name.

   • The Client ID in Azure AD.

   • The Client Key to establish the connection to Azure AD.

2. Create an Azure application (or use any relevant existing Azure application) under the Azure tenant of your Azure AD. The application must have application permissions to read and write directory data in Azure AD.

   TIP: You can assign the required permissions to the application by running a Windows PowerShell script. For more information, see Creating a Microsoft Azure Active Directory connection.

3. Open the application properties and copy the following:

   • Client ID

   • The valid Client Key of the application.

4. Use the Client ID and Client Key when creating a new Azure AD connection or modifying an existing one. For more information, see Creating a Microsoft Azure Active Directory connection.

   NOTE: Two applications are required for Azure BackSync operations:

   • The Web Application that you created in this step, or is already available for the Synchronization Service Azure AD Connector.

   • An Azure application that you created while configuring Azure AD in the Active Roles Administration Service.

     For details, see Configuring Active Roles to manage Azure AD using the GUI in the Active Roles Administration Guide).

   Both applications are required for Azure BackSync operations.

5. Create a connection to Active Roles using the Active Roles Connector. The configuration requires the local domain details and the version of Active Roles you use. Define the scope to select the container from which Active Roles will select the objects for synchronization.

6. In the Active Roles Synchronization Service, create a new sync workflow with Sync Workflows > Add sync workflow. Use the Azure AD and Active Roles connections configured previously, and add a synchronization step to synchronize the Azure AD users or groups with the on-premises users or groups in Active Roles.

7. In the on-premises Active Roles users or groups, set the edsvaAzureAssociatedTenantIdattribute attribute to the value of the Azure tenant ID.

   NOTE: If you did not configure edsvaAzureAssociatedTenantIdattribute, an error will be logged for each object in the Event Viewer.

8. Configure the Forward Sync Rule to synchronize the following:

   • The Azure Object ID property of the Azure AD user or group to the edsvaAzureObjectID property of the corresponding on-premises Active Roles user or group.

   • Set the edsvaAzureOffice365Enabled attribute in the on-premises Active Roles user or group to true.

   • Set the edsvaAzureAssociatedTenantId attribute to the value of the Azure tenant ID.

9. Create a Mapping Rule. A mapping rule has two functions:

   • It uniquely identifies the synchronized users or groups both in Azure AD in the on-premises AD.

   • It maps the specified properties from Azure AD to Active Roles appropriately.

   For example, the property userprincipalname can be used to map users between the on-premises AD and Azure AD in a federated environment.

   CAUTION: Based on the environment, make sure to create the correct mapping rule to identify the user or group uniquely. Incorrect mapping rules may create duplicate objects, resulting in Azure BackSync not working as expected.

   NOTE: Consider the following when configuring manual Azure back synchronization:

   • You must perform the initial configuration and back synchronization of Azure AD user IDs only once.

   • Azure AD groups cannot be created in Federated or Synchronized environments. Instead, Azure AD groups are created in Active Roles and are synchronized to Azure AD using native Microsoft tools, such as Azure AD Connect. To manage the Azure AD group through Active Roles, you must perform periodic back synchronization to the on-premises AD.