Chat now with support
Chat with Support

Active Roles 7.6.2 - Administration Guide

Introduction About Active Roles Getting Started Rule-based Administrative Views Role-based Administration
Access Templates as administrative roles Access Template management tasks Examples of use Deployment considerations Windows claims-based Access Rules
Rule-based AutoProvisioning and Deprovisioning
About Policy Objects Policy Object management tasks Policy configuration tasks
Property Generation and Validation User Logon Name Generation Group Membership AutoProvisioning E-mail Alias Generation Exchange Mailbox AutoProvisioning AutoProvisioning for SaaS products OneDrive Provisioning Home Folder AutoProvisioning Script Execution Office 365 and Azure Tenant Selection User Account Deprovisioning Office 365 Licenses Retention Group Membership Removal Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Relocation User Account Permanent Deletion Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Notification Distribution Report Distribution
Deployment considerations Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Container Deletion Prevention policy Picture management rules Policy extensions
Workflows
Understanding workflow Workflow activities overview Configuring a workflow
Creating a workflow definition Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configuring an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Example: Approval workflow E-mail based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic Groups Active Roles Reporting Management History
Understanding Management History Management History configuration Viewing change history
Workflow activity report sections Policy report items Active Roles internal policy report items
Examining user activity
Entitlement Profile Recycle Bin AD LDS Data Management One Identity Starling Management Managing One Identity Starling Connect Configuring linked mailboxes with Exchange Resource Forest Management Configuring remote mailboxes for on-premises users Azure AD, Office 365, and Exchange Online management
Configuring Active Roles to manage hybrid AD objects Managing Hybrid AD Users Unified provisioning policy for Azure O365 Tenant Selection, Office 365 License Selection, and Office 365 Roles Selection, and OneDrive provisioning Office 365 roles management for hybrid environment users Managing Office 365 Contacts Managing Hybrid AD Groups Managing Office 365 Groups Managing Azure Security Groups Managing cloud-only distribution groups Managing cloud-only Azure users Managing cloud-only Azure guest users Managing cloud-only Azure contacts Changes to Active Roles policies for cloud-only Azure objects Managing room mailboxes Managing cloud-only shared mailboxes
Managing Configuration of Active Roles
Connecting to the Administration Service Adding and removing managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server Replication Appendix A: Using regular expressions Appendix B: Administrative Template Appendix C: Communication ports Appendix D: Active Roles and supported Azure environments Appendix E: Active Roles integration with other One Identity and Quest products Appendix F: Active Roles integration with Duo Appendix G: Active Roles integration with Okta

Delegating the task of viewing run history of automation workflow

You can authorize users or groups to view run history of all automation workflows held in a certain container by applying the Automation Workflow - View Access Template to that container. This enables the users or groups to view run history of the automation workflow without giving them the right to modify or run the workflow.

To delegate the task of viewing run history of all automation workflows held in a certain container

  1. In the console tree, right-click the desired container under Configuration | Policies | Workflow, and then click Delegate Control.
  2. In the Active Roles Security dialog box, click Add to start the Delegation of Control Wizard.
  3. On the Users or Groups page in the wizard, click Add, and then use the Select Objects dialog box to select the desired users or groups.
  4. On the Access Templates page in the wizard, under Access Templates | Configuration, select the Automation Workflow - View check box.
  5. Follow the instructions in the wizard and accept the default settings.
  6. Click OK in the Active Roles Security dialog box.

It is also possible to authorize users or groups to view run history of a single automation workflow by applying the Access Template to the workflow definition object.

To delegate the task of viewing run history of a single automation workflow

  1. On the View menu, select Advanced Details Pane.
  2. In the console tree, under Configuration | Policies | Workflow, select the container that holds the desired workflow definition object.
  3. In the upper part of the details pane, select the workflow definition object.
  4. In the lower part of the details pane, on the Active Roles Security tab, right-click a blank area and click Add to start the Delegation of Control Wizard.
  5. On the Users or Groups page in the wizard, click Add, and then use the Select Objects dialog box to select the desired users or groups.
  6. On the Access Templates page in the wizard, under Access Templates | Configuration, select the Automation Workflow - View check box.
  7. Follow the instructions in the wizard and accept the default settings.

 

Sample Azure Hybrid Migration

To create a remote mailbox for an existing user, you can convert the on-premises user to a hybrid Azure user with an Office 365 automation workflow and a hybrid migration script, based on the built-in Sample Azure Hybrid Migration script.

The Sample Azure Hybrid Migration script is available at the following location in the Active Roles Console:

Configuration > Script Modules > Builtin > Sample Azure Hybrid Migration

The remote mailbox workflow, on the other hand, is available at the following location in the Active Roles Console:

Configuration > Policies > Workflow > Builtin > Sample Azure Hybrid Migration

Prerequisites

To create remote mailboxes via hybrid migration with the Sample Azure Hybrid Migration script, your organization must meet the following requirements:

  • To enable remote mailboxes, the Exchange management tools of an on-premises Exchange 2013 (or later) installation must be available.

  • The Active Roles service account must be a part of the Recipient Management management role group to run Exchange hybrid commands.

To configure and run the Sample Azure Hybrid Migration script

  1. Depending on whether you want to enable or disable remote mailboxes, use one of the following functions:

    • EnableRemoteMailBox: Use this function to enable remote mailboxes for the users in the workflow scope. Select EnterExchangeCreds_params as the function to declare parameters in the script, then provide the Exchange user name and password to run the EnableRemoteMailBox function in workflow.

    • DisableRemoteMailBox: Use this function to disable remote mailboxes for the users in the workflow scope. Select EnterExchangeCreds_params as the function to declare parameters in the script, then provide the Exchange user name, password and Exchange recipient type details to run the DisableRemoteMailBox function in workflow.

  2. Make sure to specify the Fully Qualified Domain Name (FQDN) of the Exchange Server in the script, and that you modify the required code blocks. For more information on declaring script parameters, see Script activity.

  3. After the script is modified, enable or copy the default Sample Azure Hybrid Migration workflow and run it.

By default, a remote mailbox is created for users with a valid Exchange Online license and who have no on-premises Exchange mailbox. For more information on creating a remote mailbox for new users, see Creating a new hybrid Azure user with the Active Roles Web Interface.

NOTE: One Identity provides the Remote mailbox migration (RemoteMailbox.ps1) script as a sample script to illustrate the required steps of creating remote mailboxes.

Do not use the script in a production environment without the required modifications and enhancements. Using security credentials within a script in clear text is never secure. When testing the script, consider the appropriate authentication and use of credentials. After testing, do not leave any credentials in clear text in the script.

For more information, see Knowledge Base Article 310525.

Managing Remote Mailbox

After creating the Remote Mailbox, you can manage it through the console and the Web Interface. The supported operations are mentioned below:

  • Exchange General

    • View or change the alias

    • View or change the option to use MAPI rich text format

    • Hide the user or contact from Exchange address lists

    • View or change custom attributes

  • Exchange Advanced

    • View or change the simple display name

    • Downgrade high priority mail bound for X.400.

    • View or change the Internet Locator Service (ILS) settings

  • Email Address

    • View, add, edit or remove e-mail addresses

    • View or change the default reply address for each address type

    • View or change the external e-mail address

    • Set the option to update e-mail addresses based on e-mail address policy

  • Mail flow Settings

    • View or change message size restrictions and message delivery restrictions

For more information on Exchange Online Properties, see View or modify the Exchange Online properties on the Active Roles Administration Guide.

Office 365 automation workflow

To import Azure or O365 Windows PowerShell modules, and run their corresponding O365 services within existing Active Roles workflows, configure O365 automation workflows. These workflows support running scripts from the following Windows PowerShell modules:

  • Azure AD

  • Azure Az

  • Exchange Online Management

Creating a new O365 automation workflow has the following steps:

  1. In the Configuration > Script Modules node of the Active Roles Console (also known as the MMC Interface), create the new O365 script that you want to run with the new O365 automation workflow.

  2. In the New Workflow wizard, configure the new O365 automation workflow.

  3. With the O365 script execution configuration activity of the Workflow Designer, specify the Azure tenant to which the configured workflow will apply.

  4. Import the new O365 script into the workflow created in the first step.

NOTE: By default, Active Roles does not select any Azure tenants automatically after you configured a new workflow with the New Workflow wizard. After the workflow is created, configure one in the Workflow Editor, otherwise the workflow will fail with the following error message:

Select a configured Azure tenant from the Select a Tenant to configure O365 Services drop-down list. Alternatively, under Parameter values, provide a valid Tenant ID, Tenant Name, Application (Client) ID and Application (Client) Certificate Thumbprint to override Azure tenant details from the workflow.

For more information on how to configure an O365 automation workflow, see Creating an Office 365 automation workflow. For a list of sample O365 workflow scripts, see Sample Office 365 workflow scripts.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating