Jorge's Quest For Knowledge!

All You Need To Know About Identity And Security On-Premises And In The Cloud. It's Just Like An Addiction, The More You Have, The More You Want To Have!

(2016-05-07) Azure AD Connect – Identifying Objects In AD And In Azure AD (Part 6)

Posted by Jorge on 2016-05-07


Part 5 can be found here

The next object we need to take into account is the group object for inbound synchronization

Clone and disable the synchronization rule called “In from AD – Group Join”.

While on the “Description” node:

  • Assign the name “In from AD – Group Join (Custom – <AD Forest FQDN>)” to the clone
  • Assign the description “Cloned Sync Rule From ”In from AD – Group Join”” to the clone
  • Assign the precedence of 80
  • With regards to configuring a tag, it apparently is not possible to do that right after cloning a synchronization rule. Finish the configuration of the rule, save it, export it to a PowerShell script, edit the script and add a tag and save the script, and rerun the script to update the cloned synchronization rule

Apply the exact configuration as explained above for the cloned rule called “In from AD – User Join (Custom – <AD Forest FQDN>)” (part 4 figure 2 or 3, 4).

Clone and disable the synchronization rule called “In from AD – Group Common”.

While on the “Description” node:

  • Assign the name “In from AD – Group Common (Custom – <AD Forest FQDN>)” to the clone
  • Assign the description “Cloned Sync Rule From ‘In from AD – Group Common’” to the clone
  • Assign the precedence of 84
  • With regards to configuring a tag, it apparently is not possible to do that right after cloning a synchronization rule. Finish the configuration of the rule, save it, export it to a PowerShell script, edit the script and add a tag and save the script, and rerun the script to update the cloned synchronization rule

Click on the “Transformations” node:

Configure the yellow marked part to make sure the attribute listed is populated in the MV

If you are using a Unicode String Attribute, configure the transformation rules as followed (only taking the yellow marked parts into account)

image

Figure 1: Transformation Rules For The Cloned Synchronization Rule “In from AD – Group Common (Custom – <AD Forest FQDN>)””. When Using A Unicode String Attribute

For BOTH the target attribute “sourceAnchor” and the target attribute “extensionAtttribute15”, the source is:

IIF(IsPresent([extensionAttribute15]),[extensionAttribute15],ConvertToBase64([objectGUID]))

The expression can be better seen as:

IIF(

    IsPresent([extensionAttribute15]),

    [extensionAttribute15],

    ConvertToBase64([objectGUID])

)

If you are using a Octet String Attribute, configure the transformation rules as followed (only taking the yellow marked parts into account)

image

Figure 2: Transformation Rules For The Cloned Synchronization Rule “In from AD – Group Common (Custom – <AD Forest FQDN>)”. When Using An Octet String Attribute

For the target attribute “sourceAnchor”, the source is:

IIF(IsPresent([mS-DS-ConsistencyGuid]),ConvertToBase64([mS-DS-ConsistencyGuid]),ConvertToBase64([objectGUID]))

The expression can be better seen as:

IIF(

    IsPresent([mS-DS-ConsistencyGuid]),

    ConvertToBase64([mS-DS-ConsistencyGuid]),

    ConvertToBase64([objectGUID])

)

For the target attribute “mS-DS-ConsistencyGuid”, the source is:

IIF(IsPresent([mS-DS-ConsistencyGuid]),[mS-DS-ConsistencyGuid],[objectGUID])

The expression can be better seen as:

IIF(

    IsPresent([mS-DS-ConsistencyGuid]),

    [mS-DS-ConsistencyGuid],

    [objectGUID]

)

The first yellow marked transformation (figure 17 and 18) will flow the value from either “extensionAttribute15” or “mS-DS-ConsistencyGuid” (whichever you are using) to the “sourceAnchor” if a value already exists. If not, the objectGUID in base64 format will be used as the value.

The second yellow marked transformation (figure 17 and 18) will flow the value from either “extensionAttribute15” or “mS-DS-ConsistencyGuid” (whichever you are using) to respectively the “extensionAttribute15” or “mS-DS-ConsistencyGuid” (whichever you are using) if a value already exists. If not, the objectGUID in base64 format will be used as the value.

This synchronization rule is now fully configured and therefore you can save it.

Now we need to create a brand new synchronization rule for the “group” object so that the immutable ID value is written back to AD (outbound synchronization) in a manageable attribute of the user object.

REMARK: to AAD Connect to be able to write back the value, the account used in the AD connector must have Allow:Read/Write permissions on the group objects for which it is writing back a value into the chosen manageable attribute that will provide the immutable ID value. To configure the correct permissions you can use the following command:

DSACLS "\\<FQDN RWDC>\<distinguishedName of OU>" /G "<account used in the AD connector>:RPWP;<chosen immutable ID attribute>;group" /I:S

Create/add a new synchronization rule.

While on the “Description” node:

  • Assign the name “Out to AD – Group Common (Custom – <AD Forest FQDN>)”
  • Assign the description “New Sync Rule”
  • Assign as connected system the AD forest
  • Assign as connected system object type: “group”
  • Assign as metaverse object type: “group”
  • Assign as link type: “Join”
  • Assign the precedence of 270
  • Assign the tag “<companyname>.OuttoADGroupCommonCustom.001”
  • Keep UNchecked “Enable Password Sync”
  • Keep UNchecked “Disabled”

For the rest of it, apply the exact configuration as explained above for the new rule called “Out to AD – User Common (Custom – <AD Forest FQDN>)” (part 4 figure 7 or 8, 9, 10 or 11).

This synchronization rule becomes active on a group object in the MV after the listed attribute (part 4 figure 7 or 8) has been populated with a value

REMARK: to AAD Connect to be able to write back the value, the account used in the AD connector must have Allow:Read/Write permissions on the group objects for which it is writing back a value into the chosen manageable attribute that will provide the immutable ID value. To configure the correct permissions you can use the following command:

DSACLS "\\<FQDN RWDC>\<distinguishedName of OU>" /G "<account used in the AD connector>:RPWP;<chosen immutable ID attribute>;group" /I:S

Now to make sure you have a backup configuration of your AAD Connect installation, execute the following command:

Get-ADSyncServerConfiguration <some folder>

Now that everything is ready, you need to enable synchronization. You can do that through:

Set-ADSyncScheduler -SyncCycleEnabled $TRUE

If you want to kick synchronization to start right away, execute the following command:

Start-ADSyncSyncCycle -PolicyType Initial

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

7 Responses to “(2016-05-07) Azure AD Connect – Identifying Objects In AD And In Azure AD (Part 6)”

  1. Aengus Moran said

    Thanks for this series. I recently implemented similar based on the first two links you referred to (with some minor modification).
    The config wasn’t as difficult to implement as first appears and I am happy I went to the trouble of doing it, especially as we now have a domain consolidation project picking up steam.
    Posts like this also reassure me that I made the right decision to setup the custom config and I encourage others that if you meet the criteria, take the time to consider doing this.

  2. Alan said

    Thanks for the great set of posts. I am trying to implement this in my environment but it is all very new to me at the moment. Is it a requirement to implement the changes for iNetOrgPerson and Groups in addition to normal Users? Can I get away with just changing the user rules even though I have selected a custom attribute as the Source Anchor during installation? If I don’t need to change the rules for groups then what are the advantages from doing so?

    Thanks again

    Alan

    • Jorge said

      You only need to implement/change the rules for the objects you want to manage/sync to azure ad. A reason for also doing the others is that you not need to worry about it later, or in other words forget about it

  3. Gordon said

    Hi Jorge, we have implemented this (correctly I think!)…but we are seeing an issue where Distribution Groups in AD are not syncing to AAD. In a metaverse search we are seeing them come in from AD but not go out to AAD. Any advise would be greatly appreciated.

    • Jorge said

      Hi,

      To understand what’s going on, you need to have a look at your data and the corresponding sync rules. That’s the only way to understand why it is not provisioned to AAD.

      On an object in the AD CS, for which provisioning is not working, you can also use the preview to see if it display why it is not provisioning

      Best Regards,
      jorge

    • Jorge said

      in addition and more specifically….

      * check the data in the CS for an example group
      * then check the inbound sync rules for AD and check the scoping filter to see if the rule applies
      * then check the transformation of that same rule to understand what would flow to the MV
      * check the data in the MV for the example group
      * then check the outbound sync rules for AAD and the scoping filter to see if the rules applies
      * then check the transformation of that same rule to understand what would flow to the AAD CS

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: