MIM: Granfeldt PowerShell Management Agent (PSMA): Delete operation for multivalue attribute with Delta-Import

MEHSV 1 Reputation point
2023-02-02T14:06:58.58+00:00

Are there a possibility to send only removed or added entries of a multivalue attribute in a synced object from a PowerShell script to the Granfeldt PowerShell Management Agent?

For a deletion or adding of a hole object there are code samples. But for a deletion or adding of a single entry of a multivalue attribute in a synced object there are nothing.

Thanks for your support and all ideas.

Example:

Members before Delta Import in the ConnectorSpace of the Management Agent (3 members):

Type: Group

ID: "1"

Members (multivalue string): "user1", "user2", "user3"

Result of query deltas for the group ("user2" was removed from the group in the source):

Object ID: "1"

Members-Delta: "user2".@removed

Wished goal after Delta Import in the ConnectorSpace of the Management Agent (2 members, without "user2"):

Type: Group

ID: "1"

Members (multivalue string): "user1", "user3"

Microsoft Identity Manager
Microsoft Identity Manager
A family of Microsoft products that manage a user's digital identity using identity synchronization, certificate management, and user provisioning.
607 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Derek Hanson 165 Reputation points
    2023-02-03T17:20:25.66+00:00

    That should just be the function of the delta sync, as it only references changed objects and changes themselves. The value in the connector space should update after doing a sync, export and confirming import.

    If you do a full import, what does the value show as?

    0 comments No comments

  2. Sylvain Clb 936 Reputation points
    2023-02-14T09:17:32.3666667+00:00

    Hello MEHSV,
    The objects in the CS are images of the data read in the source referential. So, you simply have to pass your multivalued attribute as it is read in the source, i.e your script should fill the Members attributes with all users read in the source; the MA will do the magic. And when you will apply a Sync profile, you will see the removed user2, as Derek said.

    here is a simple example:

    $Members = @()
    
    $Members.Add("user1")
    $Members.Add("user3")
    
    $obj = @{}
    $obj.Id = "1"
    $obj."[ObjectClass]" = "Group"
    $obj."[DN]" = "1"
    $obj.Members = $Members
    $obj
    

    PS: I don't know what you are trying to achieve, but switching the Members to Reference Multivalued can be useful.

    BR,

    Sylvain

    0 comments No comments