Back-synchronized properties
The Master Account Management policy defines a list of properties to copy from the shadow account to the master account. By default, the list is empty. If you add a property to that list, the policy ensures that any changes to that property on the shadow account are replicated to the master account.
Master Account Management policy actions
The Master Account Management policy causes Active Roles to perform the following actions depending on the change request submitted to the Active Roles Administration Service.
Table 20: Policy Actions
|
Enable an existing Active Directory user for Skype for Business Server |
Active Roles retrieves the properties of the existing user (in the external forest), and then performs the following actions:
- Create a shadow account in the Skype for Business Server forest, and populate its properties with the properties of the user from the external forest
- Enable the shadow account for Skype for Business Server
- Set the msRTCSIP-OriginatorSID attribute of the shadow account to the value of the objectSID attribute of the user from the external forest
- Create a reference to the shadow account on the master account
If the user from the external forest already has a shadow account (for example, created by Exchange Resource Forest Management), then the policy re-uses the existing shadow account instead of creating a new one.
When creating the shadow account, Active Roles executes all policies that are applied to the container that holds the shadow account. |
|
Modify Skype for Business Server user properties of a master account |
If the change request includes any changes to substituted properties, Active Roles first makes the requested changes to the substituted properties of the shadow account. Next, Active Roles makes the requested changes to the properties of the master account, and then updates the synchronized properties of the shadow account with the new property values found on the master account. |
|
Deprovision a master account |
Active Roles deprovisions the master account, and then temporarily disables the shadow account for Skype for Business Server. |
|
Undeprovision a deprovisioned master account |
Active Roles undeprovisions the master account and then re-enables the shadow account for Skype for Business Server.
For undeprovisioning master accounts to have an effect on shadow accounts, the container that holds deprovisioned master accounts must be in the scope of the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object). |
|
Delete a master account |
Active Roles deletes the master account, and then removes the shadow account from Skype for Business Server. |
The Master Account Management policy requires that shadow accounts be in the scope of the User Management policy provided by Skype for Business Server User Management. This enables Active Roles to perform the Skype for Business Server related actions on the shadow account.
Scheduled synchronization
Skype for Business Server User Management includes an Active Roles scheduled task that complements the Master Account Management policy to enforce synchronization of master and shadow account properties, and to capture existing Skype for Business Server users whose master account happens to fall under the control of that policy. The scheduled task object is in the Configuration/Server Configuration/Scheduled Tasks/Builtin container. The name of the object is Skype for Business - Master Account Management. The task is scheduled to run on a daily basis. Normally, you do not need to modify that scheduled task.
The operation of the task affects only the user accounts that are in the scope of the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object). When run, the task performs the following actions on each of those user accounts:
- If the user account does not have a shadow account that is enabled for Skype for Business Server, then skip over that user account.
- If the user account has a shadow account that is enabled for Skype for Business Server but does not store a reference to that shadow account, then create the reference to the shadow account on that user account.
This action enables Skype for Business Server User Management to administer exiting Skype for Business Server users, possibly enabled for Skype for Business Server by using an earlier version of Skype for Business Server User Management or without the use of Skype for Business Server User Management.
Access Templates for Skype for Business Server
Skype for Business Server User Management provides a number of Access Templates allowing you to delegate the tasks of managing Skype for Business Server users in Active Roles. You can find these Access Templates in the Configuration/Access Templates/Skype for Business Server container:
Table 21: Skype for Business Server User Management Access
|
Skype for Business Server - User Full Control |
Gives permission to perform the following tasks by using Active Roles:
- Add and enable new Skype for Business Server users
- View existing Skype for Business Server users
- View or change the SIP address
- View or change the telephony option and related settings
- View or change the user policy assignments in Skype for Business Server
- Temporarily disable or re-enable users for Skype for Business Server
- Move users to another server or pool in Skype for Business Server
- Remove users from Skype for Business Server
|
|
Skype for Business Server - User Telephony |
Gives permission to perform the following tasks by using Active Roles:
- View existing Skype for Business Server users
- View the SIP address
- View or change the telephony option and related settings
- View the user policy assignments in Skype for Business Server
|
|
Skype for Business Server - User Disable/Re-enable |
Gives permission to perform the following tasks by using Active Roles:
- View existing Skype for Business Server users
- View the SIP address
- View the telephony option and related settings
- View the user policy assignments in Skype for Business Server
- Temporarily disable or re-enable users for Skype for Business Server
|
|
Skype for Business Server - User Policies |
Gives permission to perform the following tasks by using Active Roles:
- View existing Skype for Business Server users
- View the SIP address
- View the telephony option and related settings
- View or change the user policy assignments in Skype for Business Server
|
When applying Access Templates for Skype for Business Server User Management, consider your Active Directory topology.
Table 22: Applying Access templates for Skype for Business Server User Management
|
Single forest |
Apply Access Templates to Active Directory domains and containers to which the Built-in Policy - Skype for Business - User Management Policy Object (or a copy of that Policy Object) is applied, to allow access to user accounts of Skype for Business Server users managed by Active Roles. |
|
Multiple forests - Resource forest |
Apply Access Templates to Active Directory domains and containers in external forests to which the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object) is applied, to allow access to master accounts of Skype for Business Server uses managed by Active Roles.
You do not need to apply these Access Templates in the Skype for Business Server forest. |
|
Multiple forests - Central forest |
Apply Access Templates to Active Directory domains and containers in external forests to which the Built-in Policy - Skype for Business - Master Account Management Policy Object (or a copy of that Policy Object) is applied, to allow access to master accounts of Skype for Business Server uses managed by Active Roles.
Apply Access Templates to Active Directory domains and containers in the Skype for Business Server forest to which the Built-in Policy - Skype for Business - User Management Policy Object (or a copy of that Policy Object) is applied, to allow access to logon-enabled user accounts of Skype for Business Server users managed by Active Roles in the Skype for Business Server forest. |
