Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Identity Manager 9.3 - Administration Guide for Connecting to Microsoft Entra ID

Table of Contents

Managing Microsoft Entra ID environments

Architecture overview One Identity Manager users for managing Microsoft Entra ID Configuration parameters for managing Microsoft Entra ID environments

Synchronizing a Microsoft Entra ID environment

Setting up initial synchronization with a Microsoft Entra ID tenant

Registering an enterprise application for One Identity Manager in the Microsoft Entra ID tenant Users and permissions for synchronizing with Microsoft Entra ID Setting up the Microsoft Entra ID synchronization server

System requirements for the Microsoft Entra ID synchronization server Installing One Identity Manager Service with a Microsoft Entra ID connector

Creating a synchronization project for initial synchronization of a Microsoft Entra ID tenant

Information required for Microsoft Entra ID synchronization projects Creating an initial synchronization project for a Microsoft Entra ID tenant

Configuring the synchronization log

Adjusting the synchronization configuration for Microsoft Entra ID environments

Configuring synchronization with Microsoft Entra ID tenants Configuring synchronization of different Microsoft Entra ID tenants Customizing synchronization projects to invite guest users Supporting custom Microsoft Entra ID extensions Changing system connection settings of Microsoft Entra ID tenants

Editing connection parameters in the variable set Editing target system connection properties

Updating schemas Speeding up synchronization Configuring the provisioning of memberships Configuring single object synchronization Accelerating provisioning and single object synchronization

Running synchronization

Starting synchronization Deactivating synchronization Displaying synchronization results Synchronizing single objects

Tasks following synchronization

Post-processing outstanding objects Adding custom tables to the target system synchronization Managing Microsoft Entra ID user accounts through account definitions

Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)

Managing Microsoft Entra ID user accounts and identities

Account definitions for Microsoft Entra ID user accounts

Creating account definitions Editing account definitions Main data for an account definition Editing manage levels Creating manage levels Assigning manage levels to account definitions Main data for manage levels Creating mapping rules for IT operating data Entering IT operating data Modify IT operating data Assigning account definitions to identities

Assigning account definitions to departments, cost centers, and locations Assigning account definitions to business roles Assigning account definitions to all identities Assigning account definitions directly to identities Assigning account definitions to system roles Adding account definitions in the IT Shop

Assigning account definitions to Microsoft Entra ID tenants Deleting account definitions

Assigning identities automatically to Microsoft Entra ID user accounts

Editing search criteria for automatic identity assignment Finding identities and directly assigning them to user accounts Changing manage levels for Microsoft Entra ID user accounts

Supported user account types

Default user accounts Administrative user accounts

Providing administrative user accounts for one identity Providing administrative user accounts for several people

Privileged user accounts

Updating identities when Microsoft Entra ID user account are modified Specifying deferred deletion for Microsoft Entra ID user accounts

Managing memberships in Microsoft Entra ID groups

Assigning Microsoft Entra ID groups to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of Microsoft Entra ID groups to Microsoft Entra ID user accounts Assigning Microsoft Entra ID groups to departments, cost centers and locations Assigning Microsoft Entra ID groups to business roles Adding Microsoft Entra ID groups to system roles Adding Microsoft Entra ID groups to the IT Shop Adding Microsoft Entra ID groups automatically to the IT Shop Assigning Microsoft Entra ID user accounts directly to Microsoft Entra ID groups Assigning Microsoft Entra ID groups directly to Microsoft Entra ID user accounts

Effectiveness of group memberships Microsoft Entra ID group inheritance based on categories Overview of all assignments

Managing Microsoft Entra ID administrator roles assignments

Assigning Microsoft Entra ID administrator roles to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of Microsoft Entra ID administration roles to Microsoft Entra ID user accounts Assigning Microsoft Entra ID administrator roles to departments, cost centers, and locations Assigning Microsoft Entra ID administrator roles to business roles Adding Microsoft Entra ID administrator roles to system roles Adding Microsoft Entra ID administrator roles in the IT Shop Adding Microsoft Entra ID administrator roles to the IT Shop Assigning Microsoft Entra ID user accounts directly to Microsoft Entra ID administrator roles Assigning Microsoft Entra ID administrator roles directly to Microsoft Entra ID user accounts

Microsoft Entra ID administrator role inheritance based on categories

Managing Microsoft Entra ID subscription and Microsoft Entra ID service plan assignments

Displaying enabled and disabled Microsoft Entra ID service plans forMicrosoft Entra ID user accounts and Microsoft Entra ID groups Assigning Microsoft Entra ID subscriptions to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of Microsoft Entra ID subscriptions to Microsoft Entra ID user accounts Assigning Microsoft Entra ID subscriptions to departments, cost centers, and locations Assigning Microsoft Entra ID subscriptions to business roles Adding Microsoft Entra ID subscriptions to system roles Adding Microsoft Entra ID subscriptions to the IT Shop Adding Microsoft Entra ID subscriptions automatically to the IT Shop Assigning Microsoft Entra ID user account directly to Microsoft Entra ID subscriptions Assigning Microsoft Entra ID subscriptions directly to Microsoft Entra ID user accounts

Assigning disabled Microsoft Entra ID service plans to Microsoft Entra ID user accounts

Prerequisites for indirect assignment of disabled Microsoft Entra ID service plans to Microsoft Entra ID user accounts Assigning disabled Microsoft Entra ID service plans directly to departments, cost centers, and locations Assigning disabled Microsoft Entra ID service plans to business roles Adding disabled Microsoft Entra ID service plans to system roles Adding disabled Microsoft Entra ID service plans to the IT Shop Adding disabled Microsoft Entra ID service plans automatically to the IT Shop Assigning Microsoft Entra ID user accounts directly to disabled Microsoft Entra ID service plans Assigning disabled Microsoft Entra ID service plans directly to Microsoft Entra ID user accounts

Inheriting Microsoft Entra ID subscriptions based on categories Inheritance of disabled Microsoft Entra ID service plans based on categories

Login credentials for Microsoft Entra ID user accounts

Password policies for Microsoft Entra ID user accounts

Predefined password policies Using password policies Creating password policies Editing password policies General main data of password policies Policy settings Character classes for passwords Custom scripts for password requirements

Checking passwords with a script Generating passwords with a script

Password exclusion list Checking passwords Testing password generation

Initial password for new Microsoft Entra ID user accounts Email notifications about login data

Microsoft Entra ID role management

Microsoft Entra ID role management tenants Enabling new Microsoft Entra ID role management features Microsoft Entra ID role main data Main data of Microsoft Entra ID role settings Displaying Microsoft Entra ID role settings main data Assigning temporary access passes to Microsoft Entra ID user accounts Displaying Microsoft Entra ID scoped role assignments Displaying scoped role eligibilities for Microsoft Entra ID roles Overview of Microsoft Entra ID scoped role assignments Main data of Microsoft Entra ID scoped role assignments Managing Microsoft Entra ID scoped role assignments Adding Microsoft Entra ID scoped role assignments Editing Microsoft Entra ID scoped role assignments Deleting Microsoft Entra ID scoped role assignments Assigning Microsoft Entra ID scoped role assignments Assigning Microsoft Entra ID scoped role assignments to Microsoft Entra ID user accounts Assigning Microsoft Entra ID scoped role assignments to Microsoft Entra ID groups Assigning Microsoft Entra ID scoped role assignments to Microsoft Entra ID service principals Assigning Microsoft Entra ID system roles to scopes through role assignments Assigning Microsoft Entra ID business roles to scopes though role assignments Assigning Microsoft Entra ID organizations to scopes through role assignments Overview of Microsoft Entra ID scoped role eligibilities Main data of Microsoft Entra ID scoped role eligibilities Managing Microsoft Entra ID scoped role eligibilities Adding Microsoft Entra ID scoped role eligibilities Editing Microsoft Entra ID scoped role eligibilities Deleting Microsoft Entra ID scoped role eligibilities Assigning Microsoft Entra ID scoped role eligibilities Assigning Microsoft Entra ID scoped role eligibilities to Microsoft Entra ID user accounts Assigning Microsoft Entra ID scoped role eligibilities to Microsoft Entra ID groups Assigning Microsoft Entra ID scoped role eligibilities to Microsoft Entra ID service principals Assigning Microsoft Entra ID system roles to scopes through role eligibilities Assigning Microsoft Entra ID business roles to scopes though role eligibilities Assigning Microsoft Entra ID organizations to scopes through role eligibilities

Mapping Microsoft Entra ID objects in One Identity Manager

Microsoft Entra ID core directories

Microsoft Entra ID tenant General main data of Microsoft Entra ID tenants Information about local Active Directory Defining categories for the inheritance of entitlements Editing the synchronization project for a Microsoft Entra ID tenant Microsoft Entra ID domains Microsoft Entra ID policies for activity-based timeouts Microsoft Entra ID policies for home realm discovery Microsoft Entra ID policies for issuing tokens Microsoft Entra ID policies for token lifetime

Microsoft Entra ID user accounts

Creating and editing Microsoft Entra ID user accounts General main data of Microsoft Entra ID user accounts Contact data for Microsoft Entra ID user accounts Information about the user profile for Microsoft Entra ID user accounts Organizational data for Microsoft Entra ID user accounts Information about the local Active Directory user account Audit data for Microsoft Entra ID user accounts Assigning extended properties to Microsoft Entra ID user accounts Disabling Microsoft Entra ID user accounts Deleting and restoring Microsoft Entra ID user accounts Displaying the Microsoft Entra ID user account overview Displaying Active Directory user accounts for Microsoft Entra ID user accounts

Microsoft Entra ID user identities

Deploying user identities for Microsoft Entra ID user accounts Displaying user identities for Microsoft Entra ID user accounts Displaying Microsoft Entra ID user identities' main data Displaying the Microsoft Entra ID user identity overview

Microsoft Entra ID groups

Editing main data of Microsoft Entra ID groups General main data for Microsoft Entra ID groups Information about local Active Directory groups Adding Microsoft Entra ID groups to Microsoft Entra ID groups Assigning Microsoft Entra ID administrator roles to Microsoft Entra ID groups Assigning owners to Microsoft Entra ID groups Assigning extended properties to Microsoft Entra ID groups Deleting Microsoft Entra ID groups Displaying the Microsoft Entra ID group overview Displaying Active Directory groups for Microsoft Entra ID groups

Microsoft Entra ID administrator roles

Editing main data of Microsoft Entra ID administrator roles Assigning Microsoft Entra ID groups to Microsoft Entra ID administrator roles Assigning extended properties to Microsoft Entra ID administrator roles Displaying the Microsoft Entra ID administration role overview

Microsoft Entra ID administrative units

Editing main data of administrative units Assigning user accounts to administrative units Assigning groups to administrative units

Microsoft Entra ID subscriptions and Microsoft Entra ID service principals

Editing Microsoft Entra ID subscription main data Assigning additional properties to Microsoft Entra ID subscriptions Displaying the Microsoft Entra ID subscriptions and service plan overview

Disabled Microsoft Entra ID service plans

Editing main data of disabled Microsoft Entra ID service plans Assigning extended properties to disabled Microsoft Entra ID service plans Displaying the disabled Microsoft Entra ID service plan overview

Microsoft Entra ID app registrations and Microsoft Entra ID service principals

Displaying information about Microsoft Entra ID app registrations Assigning owners to Microsoft Entra ID app registrations Displaying Microsoft Entra ID app registration main data Displaying information about Microsoft Entra ID service principals Assigning owners to Microsoft Entra ID service principals Editing authorizations for Microsoft Entra ID service principals Displaying Microsoft Entra ID service principals for enterprise applications Displaying Microsoft Entra ID service principal main data

Reports about Microsoft Entra ID objects Managing Microsoft Entra ID security attributes

Assigning Microsoft Entra ID security attributes to user accounts Assigning Microsoft Entra ID security attributes to service principals

Handling of Microsoft Entra ID objects in the Web Portal Recommendations for federations Basic data for managing a Microsoft Entra ID environment

Target system managers for Microsoft Entra ID Job server for Microsoft Entra ID-specific process handling

General main data of Job servers Specifying server functions

Troubleshooting

Possible errors when synchronizing an Microsoft Entra ID tenant

Configuration parameters for managing a Microsoft Entra ID environment Default project template for Microsoft Entra ID

Project template for Microsoft Entra ID tenants Project template for Microsoft Entra ID B2C tenants

Editing Microsoft Entra ID system objects Microsoft Entra ID connector settings

Assigning account definitions directly to identities

Account definitions can be assigned directly or indirectly to identities. Indirect assignment is carried out by allocating identities and account definitions in company structures, like departments, cost centers, locations, or business roles.

To react quickly to special requests, you can assign account definitions directly to identities.

To assign an account definition directly to identities

In the Manager, select the Microsoft Entra ID > Basic configuration data > Account definitions > Account definitions category.
Select an account definition in the result list.
Select the Assign to identities task.
In the Add assignments pane, add identities.
TIP: In the Remove assignments pane, you can remove assigned identities.

To remove an assignment
- Select the identity and double-click .
Save the changes.

Related topics

Assigning account definitions to system roles

NOTE: This function is only available if the System Roles Module is installed.

Use this task to add an account definition to system roles.

NOTE: Account definitions with the Only use in IT Shop option set can only be assigned to system roles that also have this option set.

To add account definitions to a system role

In the Manager, select the Microsoft Entra ID > Basic configuration data > Account definitions > Account definitions category.
Select an account definition in the result list.
Select the Assign system roles task.
In the Add assignments pane, assign system roles.
TIP: In the Remove assignments pane, you can remove the system role assignment.

To remove an assignment
- Select the system role and double-click .
Save the changes.

Related topics

Adding account definitions in the IT Shop

An account definition can be requested by shop customers when it is assigned to an IT Shop shelf. To ensure it can be requested, further prerequisites need to be guaranteed.

The account definition must be labeled with the IT Shop option.
The account definition must be assigned to a service item.

TIP: In the Web Portal, all products that can be requested are grouped together by service category. To make the account definition easier to find in the Web Portal, assign a service category to the service item.
If the account definition is only assigned to identities using IT Shop assignments, you must also set the Only for use in IT Shop option. Direct assignment to hierarchical roles may not be possible.

NOTE: IT Shop administrators can assign account definitions to IT Shop shelves if login is role-based. Target system administrators are not authorized to add account definitions in the IT Shop.

To add an account definition to the IT Shop (role-based login)

In the Manager, select the Entitlements > Account definitions category.
Select an account definition in the result list.
Select the Add to IT Shop task.
To assign the account definition to shelves, select the IT Shop shelves tab and, in the Add assignments section, select the shelves with a double-click.
To assign the account definition to IT Shop templates, select the IT Shop templates tab and, in the Add assignments section, select the template with a double-click.
Save the changes.

To add an account definition to the IT Shop (non role-based login)

In the Manager, select the Microsoft Entra ID > Basic configuration data > Account definitions > Account definitions category.
Select an account definition in the result list.
Select the Add to IT Shop task.
To assign the account definition to shelves, select the IT Shop shelves tab and, in the Add assignments section, select the shelves with a double-click.
To assign the account definition to IT Shop templates, select the IT Shop templates tab and, in the Add assignments section, select the template with a double-click.
Save the changes.

To remove an account definition from individual IT Shop shelves (role-based login)

In the Manager, select the Entitlements > Account definitions category.
Select an account definition in the result list.
Select the Add to IT Shop task.
To remove the account definition from the shelves, select the IT Shop shelves tab and, in the Remove assignments section, double-click the shelves.
To remove the account definition from the IT Shop templates, select the IT Shop templates tab and, in the Remove assignments section, double-click the templates.
Save the changes.

To remove an account definition from individual IT Shop shelves (non role-based login)

In the Manager, select the Microsoft Entra ID > Basic configuration data > Account definitions > Account definitions category.
Select an account definition in the result list.
Select the Add to IT Shop task.
To remove the account definition from the shelves, select the IT Shop shelves tab and, in the Remove assignments section, double-click the shelves.
To remove the account definition from the IT Shop templates, select the IT Shop templates tab and, in the Remove assignments section, double-click the templates.
Save the changes.

To remove an account definition from all IT Shop shelves (role-based login)

In the Manager, select the Entitlements > Account definitions category.
Select an account definition in the result list.
Select the Remove from all shelves (IT Shop) task.
Confirm the security prompt with Yes.
Click OK.

The account definition is removed from all shelves by the One Identity Manager Service. At the same time, any requests and assignment requests with this account definition are canceled.

To remove an account definition from all IT Shop shelves (non role-based login)

In the Manager, select the Microsoft Entra ID > Basic configuration data > Account definitions > Account definitions category.
Select an account definition in the result list.
Select the Remove from all shelves (IT Shop) task.
Confirm the security prompt with Yes.
Click OK.

The account definition is removed from all shelves by the One Identity Manager Service. At the same time, any requests and assignment requests with this account definition are canceled.

For more information about requesting company resources through the IT Shop, see the One Identity Manager IT Shop Administration Guide.

Related topics

Assigning account definitions to Microsoft Entra ID tenants

The following prerequisites must be fulfilled if you implement automatic assignment of user accounts and identities resulting in administered user accounts (Linked configured state):

The account definition is assigned to the target system.
The account definition has the default manage level.

User accounts are only linked to the identity (Linked state) if no account definition is given. This is the case on initial synchronization, for example.

To assign the account definition to a target system

In the Manager, select the Microsoft Entra ID tenant in the Microsoft Entra ID > Tenants category.
Select the Change main data task.
From the Account definition (initial) drop-down, select the account definition for user accounts.
Save the changes.

Detailed information about this topic

Assigning identities automatically to Microsoft Entra ID user accounts

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© 2025 One Identity LLC. ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center