Chat now with support
Chat with Support

Identity Manager 9.2.1 - Administration Guide for Connecting to Azure Active Directory

Managing Azure Active Directory environments Synchronizing an Azure Active Directory environment
Setting up initial synchronization with an Azure Active Directory tenant Adjusting the synchronization configuration for Azure Active Directory environments Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)
Managing Azure Active Directory user accounts and identities Managing memberships in Azure Active Directory groups Managing Azure Active Directory administrator roles assignments Managing Azure Active Directory subscription and Azure Active Directory service plan assignments
Displaying enabled and disabled Azure Active Directory service plans forAzure Active Directory user accounts and Azure Active Directory groups Assigning Azure Active Directory subscriptions to Azure Active Directory user accounts Assigning disabled Azure Active Directory service plans to Azure Active Directory user accounts Inheriting Azure Active Directory subscriptions based on categories Inheritance of disabled Azure Active Directory service plans based on categories
Login credentials for Azure Active Directory user accounts Azure Active Directory role management
Azure Active Directory role management tenants Enabling new Azure Active Directory role management features Azure Active Directory role main data Displaying Azure Active Directory scoped role assignments Displaying scoped role eligibilities for Azure Active Directory roles Overview of Azure Active Directory scoped role assignments Main data of Azure Active Directory scoped role assignments Managing Azure Active Directory scoped role assignments Adding Azure Active Directory scoped role assignments Editing Azure Active Directory scoped role assignments Deleting Azure Active Directory scoped role assignments Assigning Azure Active Directory scoped role assignments Assigning Azure Active Directory system roles to scopes through role assignments Assigning Azure Active Directory business roles to scopes though role assignments Assigning Azure Active Directory organizations to scopes through role assignments Overview of Azure Active Directory scoped role eligibilities Main data of Azure Active Directory scoped role assignments Managing Azure Active Directory scoped role eligibilities Adding Azure Active Directory scoped role eligibilities Editing Azure Active Directory scoped role eligibilities Deleting Azure Active Directory scoped role eligibilities Assigning Azure Active Directory scoped role eligibilities Assigning Azure Active Directory system roles to scopes through role eligibilities Assigning Azure Active Directory business roles to scopes though role eligibilities Assigning Azure Active Directory organizations to scopes through role eligibilities
Mapping Azure Active Directory objects in One Identity Manager
Azure Active Directory core directories Azure Active Directory user accounts Azure Active Directory user identities Azure Active Directory groups Azure Active Directory administrator roles Azure Active Directory administrative units Azure Active Directory subscriptions and Azure Active Directory service principals Disabled Azure Active Directory service plans Azure Active Directory app registrations and Azure Active Directory service principals Reports about Azure Active Directory objects
Handling of Azure Active Directory objects in the Web Portal Recommendations for federations Basic configuration data for managing an Azure Active Directory environment Troubleshooting Configuration parameters for managing an Azure Active Directory environment Default project template for Azure Active Directory Editing Azure Active Directory system objects Azure Active Directory connector settings

General main data of Azure Active Directory tenants

Enter the following general main data.

Table 26: Azure Active Directory tenant main data

Property

Description

Display name

The Azure Active Directory tenant’s display name.

Tenant type

The Azure Active Directory tenant type. Permitted values are:

  • AAD: Azure Active Directory tenant

  • AAD B2C: Azure Active Directory B2C tenants

This property is loaded by synchronization and cannot be edited.

Account definition (initial)

Initial account definition for creating Azure Active Directory user accounts. This account definition is used if automatic assignment of identities to user accounts is used for this Azure Active Directory tenant and user accounts should be created which are already managed (Linked configured state). The account definition's default manage level is applied.

User accounts are only linked to the identity (Linked) if no account definition is given. This is the case on initial synchronization, for example.

Target system managers

Application role, in which target system managers are specified for the Azure Active Directory tenant. Target system managers only edit the objects from Azure Active Directory tenants to which they are assigned. Each Azure Active Directory tenant can have a different target system manager assigned to it.

Select the One Identity Manager application role whose members are responsible for administration of this Azure Active Directory tenant. Use the button to add a new application role.

Location

The Azure Active Directory tenant's location.

Street

Street or road.

City

City.

Zip code

Zip code.

Country

Country.

Synchronized by

Type of synchronization through which the data is synchronized between the Azure Active Directory tenant and One Identity Manager. You can no longer change the synchronization type once objects for this Azure Active Directory tenant are present in One Identity Manager.

If you create an Azure Active Directory tenant with the Synchronization Editor, One Identity Manager is used.

Table 27: Permitted values
Value Synchronization by Provisioned by

One Identity Manager

Azure Active Directory connector

Azure Active Directory connector

No synchronization

none

none

NOTE: If you select No synchronization, you can define custom processes to exchange data between One Identity Manager and the target system.

Recipients (marketing notifications)

List of recipients of marketing notifications.

Recipient (technical notifications)

List of recipients of technical notifications.

Recipients (security notifications)

List of recipients of security notifications.

Phone numbers (security notifications)

Phone numbers for security notifications.

Related topics

Information about local Active Directory

The Linked tab shows information about the local Active Directory, which is linked to the Azure Active Directory tenant.

Table 28: Local Active Directory user account data
Property Description

Synchronization with local Active Directory enabled

Specifies whether synchronization with a local Active Directory is enabled.

Last synchronization

Time of the last Azure Active Directory tenant synchronization with the local Active Directory.

Defining categories for the inheritance of entitlements

In One Identity Manager, user accounts can selectively inherit groups, administrator roles, subscriptions, and disabled service plans. To do this, the groups (administrator roles, subscriptions, and disabled service plans) and the user accounts are divided into categories. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains different tables. Use the user account table to specify categories for target system dependent user accounts. In the other tables, enter your categories for the groups, administrator roles, subscriptions, and disabled service plans. Each table contains the category positions position 1 to position 63.

To define a category

  1. In the Manager, select the Azure Active Directory tenant in the Azure Active Directory > Tenants category.

  2. Select the Change main data task.

  3. Switch to the Mapping rule category tab.

  4. Extend the relevant roots of a table.

  5. To enable the category, double-click .

  6. Enter a category name of your choice for user accounts and groups (administrator roles, subscriptions, disabled service plans) in the login language that you use.

  7. Save the changes.
Related topics

Editing the synchronization project for an Azure Active Directory tenant

Synchronization projects in which an Azure Active Directory tenant is already used as a base object can also be opened in the Manager. You can, for example, check the configuration or view the synchronization log in this mode. The Synchronization Editor is not started with its full functionality. You cannot run certain functions, such as, running synchronization or simulation, starting the target system browser and others.

NOTE: The Manager is locked for editing throughout. To edit objects in the Manager, close the Synchronization Editor.

To open an existing synchronization project in the Synchronization Editor

  1. In the Manager, select the Azure Active Directory > Tenants category.

  2. In the result list, select the Azure Active Directory tenant.

  3. Select the Change main data task.

  4. Select the Edit synchronization project task.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating