Synchronization Service performs data synchronization operations and include the Synchronization Service Console that provides a graphical user interface for managing connections to data systems and data synchronization operations.
Synchronization Service overview
Synchronization Service features and benefits
Deploying Synchronization Service
Bidirectional synchronization
Delta processing mode
Synchronization of group membership
Windows PowerShell scripting
Attribute synchronization rules
Rule-based generation of distinguished names
Scheduling capabilities
Extensibility
Azure BackSync configuration
Technical overview
Installing Synchronization Service
Configuring Synchronization Service
Configuring Azure BackSync
Deploying Synchronization Service for use with AWS Managed Microsoft AD
Configuring manual Azure BackSync
Configuring automatic Azure BackSync
Settings updated after Azure BackSync configuration operation
Finding the GUID (Tenant ID) of an Azure AD for Azure BackSync
Upgrade from Quick Connect and Synchronization Service
Communication ports used by Synchronization Service
Supported AWS Managed Microsoft AD deployment configuration
Synchronization Service features and limitations when used with AWS Managed Microsoft AD
Main steps of configuring Active Roles Synchronization Service for AWS Managed Microsoft AD
Getting started
Deployment requirements for AWS Managed Microsoft AD support
Creating the AWS Managed Microsoft AD instance
Creating the EC2 instance for Active Roles Synchronization Service
Joining the EC2 instance to AWS Managed Microsoft AD
Creating the RDS instance for the Active Roles Synchronization Service SQL Server
Verifying connectivity between the EC2 and RDS instances
Installing and configuring Synchronization Service for AWS Managed Microsoft AD
Synchronization Service Console
Connections to external data systems
Gear icon
Sync Workflows tab
Sync History tab
Connections tab
Mapping tab
Password Sync tab
Configuring diagnostic logging
How to synchronize identity data
Synchronization Service Management Shell
External data systems supported with built-in connectors
Synchronizing identity data
Working with Active Directory
Using connectors installed remotely
Creating an Active Directory connection
Modifying an Active Directory connection
Communication ports required to synchronize data between two Active Directory domains
Synchronizing user passwords between two Active Directory domains
Synchronizing SID history of users or groups
Working with an AD LDS (ADAM) instance
Creating an AD LDS (ADAM) instance connection
Modifying an existing AD LDS (ADAM) instance connection
Working with Skype for Business Server
Creating a new Skype for Business Server connection
Modifying an existing Skype for Business Server connection
Supported Skype for Business Server data
Attributes required to create a Skype for Business Server user
Getting or setting the Telephony option value in Skype for Business Server
Working with Oracle Database
Creating an Oracle Database connection
Modifying an existing Oracle Database connection
Working with Oracle Database user accounts
Specifying connection settings for Oracle Database
Configuring advanced settings for an Oracle Database or Oracle Database user account connection
Specifying attributes to identify objects for Oracle Database
Sample SQL queries for working with an Oracle Database
Creating an Oracle Database user accounts connection
Modifying an existing Oracle Database user account connection
Working with Exchange Server
Specifying connection settings for an Oracle Database user account connection
Configuring advanced settings for an Oracle Database or Oracle Database user account connection
Sample SQL queries for working with Oracle Database user accounts
Creating a new connection to Exchange Server
Modifying an existing connection to Exchange Server
Exchange Server data supported out of the box
Working with Active Roles
Working with One Identity Manager
ActiveSyncMailboxPolicy object attributes
AddressBookPolicy object attributes
AddressList object attributes
DistributionGroup object attributes
DynamicDistributionGroup object attributes
ExchangeServer object attributes
GlobalAddressList object attributes
Mailbox object attributes
MailContact object attributes
MailboxDatabase object attributes
MailUser object attributes
OfflineAddressBook object attributes
OrganizationConfig object attributes
OwaMailboxPolicy object attributes
PublicFolder object attributes
PublicFolderDatabase object attributes
RoleAssignmentPolicy object attributes
StorageGroup object attributes
UmDialPlan object attributes
UmMailboxPolicy object attributes
Scenario: Migrate mailboxes from one Exchange Server to another
Creating a One Identity Manager connection
Modifying a One Identity Manager connection
One Identity Manager Connector configuration file
Working with a delimited text file
Working with Microsoft SQL Server
Creating a Microsoft SQL Server connection
Modifying an existing Microsoft SQL Server connection
Working with Micro Focus NetIQ Directory
Specifying connection settings for a Microsoft SQL Server connection
Specifying how to select and modify data for a Microsoft SQL Server connection
Advanced
Specifying attributes to identify objects for a Microsoft SQL Server connection
Sample queries to modify SQL Server data
Creating a Micro Focus NetIQ Directory connection
Modifying an existing Micro Focus NetIQ Directory connection
Working with Salesforce
Creating a Salesforce connection
Modifying an existing Salesforce connection
Salesforce data supported for synchronization
Working with ServiceNow
Additional user object attributes for a Salesforce connection
Additional group object attributes for a Salesforce connection
Scenario: Provisioning users from an Active Directory domain to Salesforce
Creating a ServiceNow connection
Modifying an existing ServiceNow connection
ServiceNow data supported for synchronization
Working with Oracle Unified Directory
Creating an Oracle Unified Directory connection
Modifying an existing Oracle Unified Directory Server connection
Working with an LDAP directory service
Creating an LDAP directory service connection
Modifying an existing Generic LDAP directory service connection
Working with an OpenLDAP directory service
Specify connection settings for a Generic LDAP directory service connection
Specify directory partitions for a Generic LDAP directory service connection
Specify naming attributes for a Generic LDAP directory service connection
Specify attributes to identify objects for a Generic LDAP directory service connection
Specify password sync parameters for LDAP directory service
Creating an OpenLDAP directory service connection
Modifying an existing OpenLDAP directory service connection
Working with IBM DB2
Working with IBM AS/400
Creating an IBM AS/400 connection
Modifying an existing IBM AS/400 connection
Additional considerations for an IBM AS/400 connection
Working with IBM RACF
Creating an IBM RACF connection
Modifying an IBM RACF connection
Example of mapping for dataset information
Creating SQL database and table
Povisioning datasets
Updating datasets
Deprovisioning datasets
Working with TSO command
Working with MySQL database
Working with an OLE DB-compliant relational database
Creating an OLE DB-compliant relational database connection
Modifying an existing OLE DB-compliant data source connection
Working with SharePoint
Creating a SharePoint connection
SharePoint data supported for data synchronization
Working with Microsoft 365
AlternateURL object attributes
ClaimProvider object attributes
Farm object attributes
Group object attributes
Language object attributes
Policy object attributes
PolicyRole object attributes
Prefix object attributes
RoleAssignment object attributes
RoleDefinition object attributes
Site object attributes
User object attributes
Web object attributes
WebApplication object attributes
WebTemplate object attributes
Considerations for creating objects in SharePoint
Creating a Microsoft 365 connection
Working with Microsoft Azure Active Directory
Creating a Microsoft 365 connector with manual configuration
Creating a Microsoft 365 connector with automatic configuration
Modifying a Microsoft 365 connection
Modifying the manual configuration settings of a Microsoft 365 connector
Modifying the automatic configuration settings of a Microsoft 365 connector
Microsoft 365 data supported out of the box
ClientPolicy object attributes
ConferencingPolicy object attributes
Contact object attributes
DistributionGroup object attributes
Domain object attributes
DynamicDistributionGroup object attributes
ExternalAccessPolicy object attributes
HostedVoicemailPolicy object attributes
LicensePlanService object attributes
Mailbox object attributes
MailUser object attributes
PresencePolicy object attributes
SecurityGroup objects attributes
SPOSite object attributes
SPOSiteGroup object attributes
SPOWebTemplate object attributes
SPOTenant object attributes
User object attributes
VoicePolicy object attributes
Microsoft 365 group attributes
Objects and attributes specific to Microsoft 365 services
How the Microsoft 365 Connector works with data
Creating a Microsoft Azure Active Directory connection
Configuring data synchronization with the SCIM Connector
Creating a Microsoft Azure Active Directory connector with manual configuration
Creating a Microsoft Azure Active Directory connector with automatic configuration
Configuring an Azure application for a Microsoft Azure Active Directory connection using a script
Modifying a Microsoft Azure Active Directory connection
Modifying the manual configuration settings of a Microsoft Azure Active Directory connector
Modifying the automatic configuration settings of a Microsoft Azure Active Directory connector
Microsoft Azure Active Directory data supported for synchronization
Objects and operations supported by the SCIM Connector
Creating a SCIM connection with the SCIM Connector
Viewing or modifying the settings of a SCIM Connector
Configuring data synchronization with the Generic SCIM Connector
Installing Synchronization Service and built-in connectors remotely
Creating a connection using a remotely installed connector
Creating a connection
Renaming a connection
Deleting a connection
Modifying synchronization scope for a connection
Using connection handlers
Specifying password synchronization settings for a connection
Creating a sync workflow
Running a sync workflow
Mapping objects
Automated password synchronization
Running a sync workflow manually
Running a sync workflow on a recurring schedule
Disabling a sync workflow run schedule
Renaming a sync workflow
Deleting a sync workflow
Adding a creating step
Creating an update step
Creating a deprovisioning step
Modifying an existing sync workflow step
Deleting a sync workflow step
Changing the order of steps in a sync workflow
Generating object names by using rules
Modifying attribute values by using rules
Using value generation rules
Using sync workflow step handlers
Example: Synchronizing group memberships
Example: Synchronizing multivalued attributes
Using sync workflow alerts
How to automate password synchronization
Managing Capture Agent
Synchronization history
Installing Capture Agent manually
Using Group Policy to install Capture Agent
Uninstalling Capture Agent
Managing password sync rules
Creating a password sync rule
Deleting a password sync rule
Modifying settings for a password sync rule
Fine-tuning automated password synchronization
Configuring Capture Agent
Creating and linking a Group Policy object
Adding an administrative template to Group Policy object
Using Group Policy object to modify Capture Agent settings
Modifying Synchronization Service parameters
Specifying a custom certificate for encrypting password sync traffic
Obtaining and installing a certificate
Exporting the custom certificate to a file
Importing certificate into certificates store
Copying the certificate's thumbprint
Providing the certificate’s thumbprint to Capture Agent
Providing the certificate’s thumbprint to Synchronization Service
Using PowerShell scripts with password synchronization
Viewing sync workflow history
View mapping history
Searching synchronization history
Cleaning up synchronization history
Scenarios of use
Scenario: Create users from a .csv file to an Active Directory domain
Developing PowerShell scripts for attribute synchronization rules
Using PowerShell script to transform passwords
Creating a sync workflow
Adding a creating step
Running the configured creating step
Committing changes to Active Directory
Scenario: Using a .csv file to update user accounts in an Active Directory domain
Creating an updating step
Running the configured updating step
Committing changes to Active Directory
Scenario: Synchronizing data between One Identity Manager Custom Target Systems and an Active Directory domain
Creating a connection to One Identity Manager
Configuring One Identity Manager modules, Custom Target System and Container Information
Creating a workflow for provisioning
Creating a provisioning step
Specifying synchronization rules
Running the workflow
Committing changes to One Identity Manager
Verify on One Identity Manager
Scenario: Deprovisioning between One Identity Manager Custom Target Systems and an Active Directory domain
Scenario: Provisioning of groups between One Identity Manager Custom Target Systems and an Active Directory domain
Scenario: Enabling Delta Sync mode between One Identity Manager Custom Target Systems and an Active Directory domain
Example of using the Generic SCIM Connector for data synchronization
Synchronization Service
Capture Agent
Synchronization Service Capture Agent allows you to synchronize user passwords between Active Directory domains managed by Synchronization Service and other connected data systems. The following diagram shows how password synchronization works with Synchronization Service Capture Agent:
Figure 2: Password synchronization
Capture Agent tracks changes to user passwords in the source Active Directory domain and provides that information to Synchronization Service, which then synchronizes the changes to the target connected data systems by using the password synchronization rules you specified.
To synchronize passwords, install Capture Agent on each domain controller in the Active Directory domain you want to use as a source for the password synchronization operations.
Connectors and connected data systems
Synchronization Service lets you synchronize identity information between a wide variety of external data systems. To synchronize identities, you must connect Synchronization Service to your data systems through special connectors. A connector enables Synchronization Service to access a specific data system and read and synchronize identity data in that system.
For the list of supported data systems, see Extensibility.
Sync workflows
A sync workflow is a set of synchronization steps (or synchronization operations) that define how to synchronize objects between two connected data systems. A sync workflow can comprise one or more synchronization steps. You can use the Synchronization Service Console, a component of Synchronization Service, to configure as many sync workflows as needed.
You can configure a synchronization step to perform one of the following operations:
-
Creation: Creates objects in the target connected data systems based on the changes made to specific objects in the source connected system. When creating a new object, Synchronization Service assigns initial values to the object attributes based on the attribute population rules you have configured.
-
Update: Changes the attributes of objects in the target connected data systems based on the changes made to specific objects in the source connected system. To define the objects that will participate in the update operation you can use object mapping rules. For more information, see Mapping objects.
-
Deprovision: Modifies or removes objects in the target connected data systems after their counterparts have been disconnected from the source connected system. Synchronization Service can be configured to remove objects permanently or change them to a specific state.