In any hybrid environment, on-premises Active Directory objects are synchronized to Azure AD using third-party software, for example via Azure AD Connect. When Active Roles is deployed in such a hybrid environment, to ensure data synchronization between the two systems, the existing user, group and contact information (such as IDs) must be synchronized back from Azure AD to the on-premises AD deployment. To synchronize existing AD users, contacts and groups from Azure AD to Active Roles, use the Azure back synchronization operation, known as Azure BackSync.
You can configure and run the Azure BackSync workflow using Active Roles Console.
To run the back synchronization for existing Azure hybrid-users in Azure AD, you must first copy and enable the BackSync Replacement built-in workflow. This workflow uses two other built-in resources:
By default, the BackSync Replacement workflow is disabled, as One Identity recommends using it as a template for custom workflows.
Prerequisites
Before configuring an Azure BackSync workflow, make sure that the installed Active Roles environment meets the following requirements:
-
The Microsoft.Graph PowerShell module is installed on the system that is running Active Roles.
NOTE: If the PowerShell module is not installed, Active Roles cannot run the BackSync workflow.
-
The Azure - Default Rules to Generate Properties Policy Object is linked to the Organizational Unit (OU) for which you want to run the workflow. For more information on linking the Policy Object, see Configuring the Azure - Default Rules to Generate Properties policy.
To configure the Azure BackSync workflow using the Active Roles Console (also known as MMC interface)
-
In the Console tree, navigate to Configuration > Policies > Workflow > Builtin.
-
Right-click the BackSync Replacement workflow and select Copy.
-
In the Copy Object dialog, enter a name and optionally, modify the description of the custom workflow and click Next, then click Finish.
-
From the list, select and right-click the newly copied workflow, then select Enable Workflow.
-
In the workflow configuration pane, double-click O365 script execution configuration and do one of the following:
-
Select a tenant from the Select a Tenant to configure O365 Services drop-down, then click OK.
NOTE: You can only select a tenant that was previously configured using Active Roles Configuration Center. For more information on adding tenants using Azure AD Configuration, see Configuring a new Azure tenant and consenting Active Roles as an Azure application.
-
To enter the parameters for the tenant manually, in the Parameter values list, select the parameter and click Edit. After you finished configuring the parameter values, click OK.
-
To run the workflow on a schedule, click Workflow options and start conditions, then click Configure.
-
In the Workflow Options and Start Conditions window, select the Run the workflow on a schedule check box and use the date picker to schedule the workflow as needed.
-
In the Run the workflow on drop-down, select the Active Roles environment where you want to run the workflow.
-
(Optional) Choose if you want the workflow to run only on a specified schedule or if users can run it manually:
-
To allow the option to manually run the workflow, leave the Allow the workflow to be run on demand check box selected and select one of the rules that apply when you run the workflow manually, then click OK.
-
To disable the option to manually run the workflow, clear the Allow the workflow to be run on demand check box, and click OK.
-
To run the workflow or save your changes without running the workflow, click Run Workflow or Save Changes, respectively.
In Active Roles, administrators can configure workflow activities of the predefined types that are installed with Active Roles. By default, the list of activities in the Workflow Designer contains only the predefined activity types, such as Approval Activity or Notification Activity. It is possible to extend the list by adding new types of activity.
Each activity type determines a certain workflow action (for example, originating an approval task or notification) together with a collection of activity parameters to configure the workflow action (for example, parameters that specify the approvers or notification recipients). Active Roles builds upon this concept, providing the ability to implement and deploy custom types of workflow activity. It enables custom activity types to be created as necessary, and listed in the Workflow Designer along with the pre-defined activity types, allowing administrators to configure workflow activities that perform custom actions determined by those new types of workflow activity.
Active Roles allows the creation of custom activities based on the Script Activity built-in activity type. However, creating and configuring a script activity from scratch can be time-consuming. Custom activity types provide a way to mitigate this overhead. Once a custom activity type is deployed that points to a particular script, administrators can easily configure and apply workflow activities of that type, having those activities perform the actions determined by the script. The activity script also defines the activity parameters specific to the activity type.
Custom activity types provide an extensible mechanism for deploying custom workflow activities. This capability is implemented by using the Policy Type object class. Policy Type objects can be created by using the Active Roles Console, with each object representing a certain type of custom workflow activity.
The extensibility of workflow activity types is designed around two interactions: activity type deployment and activity type usage.
