This section gives descriptions about the Azure App registration, connections, mappings, and workflow steps that are created automatically as a result of the Azure backsync configuration operation.
App registration
The Azure App is created automatically with the default name as ActiveRoles AutocreatedAzureBackSyncApp_V2.
NOTE: After the Azure App is registered in Azure, you must not delete or modify the application. The backsync operation will not work as expected in case you modify or delete the registered Azure App.
Sync Workflows
On the Synchronization Service Administration Console, click Sync Workflows to view the sync workflow named AutoCreated_AzureADBackSyncWorkflow_<tenant name> that is created as a result of the Azure BackSync configuration. The workflow displays the following synchronization update steps from Azure AD to Active Roles for users, groups, and contacts.
- Step 1: AutoCreated_UpdateFromAzureToARSForBackSyncWorkFlowUser_<tenant> for users.
- Step 2: AutoCreated_UpdateFromAzureToARSForBackSyncWorkFlowGroup_<tenant> for groups.
- Step 3: AutoCreated_UpdateFromO365ToARSForBackSyncWorkFlowContact_<tenant> for contacts.
NOTE:
- Multiple tenants are supported in back-sync. The workflows can be identified using the name of the tenant.
- The Forward Sync Rules to synchronize the following are automatically configured and displayed in the synchronization update steps for user and group:
- Azure ObjectID property of a user or group is mapped to the Active Roles user or group edsvaAzureObjectID property.
- The edsvaAzureOffice365Enabled attribute in Active Roles user or group is set to True.
- The edsvaAzureAssociatedTenantId attribute in Active Roles user or group is set to Azure Tenant ID.
-
The Forward Sync Rule to synchronize the following are automatically configured and displayed in the synchronization update steps for contacts:
-
Azure ExternalDirectoryObjectID property of a contact is mapped to the Active Roles contact edsaAzureContactObjectId property.
-
The edsvaAzureOffice365Enabled attribute in Active Roles user or group is set to True.
- The edsvaAzureAssociatedTenantId attribute in Active Roles user or group is set to Azure Tenant ID.
-
Connections
On the Synchronization Service Administration Console, click Connections to view the connections from Active Roles, Azure AD, and Office 365 to external data systems. The following connections are configured and displayed by default:
- AutoCreated_ARSConnectorForBackSyncWorkFlow_<tenant>
- AutoCreated_AzureADConnectorForBackSyncWorkFlow_<tenant>
- AutoCreated_O365ConnectorForBackSyncWorkFlow_<tenant>
NOTE: Multiple tenants are supported in back-sync. The connection name can be identified using the name of the tenant.
Mapping
On the Synchronization Service Administration Console, click Mapping to view the Mapping rules which identify the users, groups, or contacts in Azure AD and on-premises AD uniquely and map the specified properties from Azure AD to Active Roles appropriately.
On the Mapping tab, click a connection name to view or modify the mapping settings for the corresponding connection. The user, group, and contact mapping pair information is displayed by default as a result of the Azure BackSync configuration. For example, the property userprincipalname can be used to map users between on-premises AD and Azure AD in a federated environment.
NOTE:
-
For more information to manage mapping pairs for the connections see the Mapping Tab section.
-
The mapping rules are created by default. Based on the environment, make sure that the default mapping rules identify the user or group uniquely. Else, make sure to correct the Mapping rule as required. In-correct mapping rules may create duplicate objects and the back-sync operation may not work as expected.
-
Initial configuration and execution of back-sync operation for Azure AD users ID and group ID is a one-time activity. If required, you can re-configure the Azure backsync settings which will override the previously configured backsync settings.