Chatta subito con l'assistenza
Chat con il supporto

Active Roles 8.2 - Administration Guide

Introduction Getting started with Active Roles Configuring rule-based administrative views Configuring role-based administration Configuring rule-based autoprovisioning and deprovisioning
Configuring Provisioning Policy Objects
User Logon Name Generation E-mail Alias Generation Exchange Mailbox AutoProvisioning Group Membership AutoProvisioning Home Folder AutoProvisioning Property Generation and Validation Script Execution O365 and Azure Tenant Selection AutoProvisioning in SaaS products
Configuring Deprovisioning Policy Objects
User Account Deprovisioning Group Membership Removal User Account Relocation Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Permanent Deletion Office 365 Licenses Retention Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Script Execution Notification Distribution Report Distribution
Configuring entry types Configuring a Container Deletion Prevention policy Configuring picture management rules Managing Policy Objects Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Configuring policy extensions
Using rule-based and role-based tools for granular administration Workflows
About workflow processes Workflow processing overview Workflow activities overview Configuring a workflow
Creating a workflow definition for a workflow Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configuring an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Approval workflow Email-based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic groups Active Roles Reporting Management History Entitlement profile Recycle Bin AD LDS data management One Identity Starling Join and configuration through Active Roles Managing One Identity Starling Connect Configuring linked mailboxes with Exchange Resource Forest Management Configuring remote mailboxes for on-premises users Migrating Active Roles configuration with the Configuration Transfer Wizard Managing Skype for Business Server with Active Roles
About Skype for Business Server User Management Active Directory topologies supported by Skype for Business Server User Management User Management policy for Skype for Business Server User Management Master Account Management policy for Skype for Business Server User Management Access Templates for Skype for Business Server Configuring the Skype for Business Server User Management feature Managing Skype for Business Server users
Exchanging provisioning information with Active Roles SPML Provider Monitoring Active Roles with Management Pack for SCOM Configuring Active Roles for AWS Managed Microsoft AD Azure AD, Microsoft 365, and Exchange Online Management
Azure tenant types and environment types supported by Active Roles Using Active Roles to manage Azure AD objects Unified provisioning policy for Azure M365 Tenant Selection, Microsoft 365 License Selection, Microsoft 365 Roles Selection, and OneDrive provisioning Changes to Active Roles policies for cloud-only Azure objects
Managing the configuration of Active Roles
Connecting to the Administration Service Managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the Console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server replication Using regular expressions Administrative Template Configuring federated authentication Communication ports and URLs used by Active Roles Integrating Active Roles with other products and services Active Roles Language Pack Active Roles Diagnostic Tools Active Roles Add-on Manager

About the Azure BackSync workflow

In any hybrid environment, on-premises Active Directory objects are synchronized to Azure AD using third-party software, for example via Azure AD Connect. When Active Roles is deployed in such a hybrid environment, to ensure data synchronization between the two systems, the existing user, group and contact information (such as IDs) must be synchronized back from Azure AD to the on-premises AD deployment. To synchronize existing AD users, contacts and groups from Azure AD to Active Roles, use the Azure back synchronization operation, known as Azure BackSync.

You can configure and run the Azure BackSync workflow using Active Roles Console.

To run the back synchronization for existing Azure hybrid-users in Azure AD, you must first copy and enable the BackSync Replacement built-in workflow. This workflow uses two other built-in resources:

  • The O365 script execution configuration activity.

  • The BackSync Replacement script.

By default, the BackSync Replacement workflow is disabled, as One Identity recommends using it as a template for custom workflows.

Configuring the Azure BackSync workflow

Prerequisites

Before configuring an Azure BackSync workflow, make sure that the installed Active Roles environment meets the following requirements:

  1. The Microsoft.Graph PowerShell module is installed on the system that is running Active Roles.

    NOTE: If the PowerShell module is not installed, Active Roles cannot run the BackSync workflow.

  2. The Azure - Default Rules to Generate Properties Policy Object is linked to the Organizational Unit (OU) for which you want to run the workflow. For more information on linking the Policy Object, see Configuring the Azure - Default Rules to Generate Properties policy.

To configure the Azure BackSync workflow using the Active Roles Console (also known as MMC interface)

  1. In the Console tree, navigate to Configuration > Policies > Workflow > Builtin.

  2. Right-click the BackSync Replacement workflow and select Copy.

  3. In the Copy Object dialog, enter a name and optionally, modify the description of the custom workflow and click Next, then click Finish.

  4. From the list, select and right-click the newly copied workflow, then select Enable Workflow.

  5. In the workflow configuration pane, double-click O365 script execution configuration and do one of the following:

    • Select a tenant from the Select a Tenant to configure O365 Services drop-down, then click OK.

      NOTE: You can only select a tenant that was previously configured using Active Roles Configuration Center. For more information on adding tenants using Azure AD Configuration, see Configuring a new Azure tenant and consenting Active Roles as an Azure application.

    • To enter the parameters for the tenant manually, in the Parameter values list, select the parameter and click Edit. After you finished configuring the parameter values, click OK.

  6. To run the workflow on a schedule, click Workflow options and start conditions, then click Configure.

  7. In the Workflow Options and Start Conditions window, select the Run the workflow on a schedule check box and use the date picker to schedule the workflow as needed.

  8. In the Run the workflow on drop-down, select the Active Roles environment where you want to run the workflow.

  9. (Optional) Choose if you want the workflow to run only on a specified schedule or if users can run it manually:

    • To allow the option to manually run the workflow, leave the Allow the workflow to be run on demand check box selected and select one of the rules that apply when you run the workflow manually, then click OK.

    • To disable the option to manually run the workflow, clear the Allow the workflow to be run on demand check box, and click OK.

  10. To run the workflow or save your changes without running the workflow, click Run Workflow or Save Changes, respectively.

Activity extensions

In Active Roles, administrators can configure workflow activities of the predefined types that are installed with Active Roles. By default, the list of activities in the Workflow Designer contains only the predefined activity types, such as Approval Activity or Notification Activity. It is possible to extend the list by adding new types of activity.

Each activity type determines a certain workflow action (for example, originating an approval task or notification) together with a collection of activity parameters to configure the workflow action (for example, parameters that specify the approvers or notification recipients). Active Roles builds upon this concept, providing the ability to implement and deploy custom types of workflow activity. It enables custom activity types to be created as necessary, and listed in the Workflow Designer along with the pre-defined activity types, allowing administrators to configure workflow activities that perform custom actions determined by those new types of workflow activity.

Active Roles allows the creation of custom activities based on the Script Activity built-in activity type. However, creating and configuring a script activity from scratch can be time-consuming. Custom activity types provide a way to mitigate this overhead. Once a custom activity type is deployed that points to a particular script, administrators can easily configure and apply workflow activities of that type, having those activities perform the actions determined by the script. The activity script also defines the activity parameters specific to the activity type.

Custom activity types provide an extensible mechanism for deploying custom workflow activities. This capability is implemented by using the Policy Type object class. Policy Type objects can be created by using the Active Roles Console, with each object representing a certain type of custom workflow activity.

Design elements for activity extension

The extensibility of workflow activity types is designed around two interactions: activity type deployment and activity type usage.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione