Delegate permssion on AADConnect

Question

Hi Support,

I want to create an operator account to do below task on AADC server:

• Read the errors in miisclient (Synchronization Service)
• Manual run the AAD Sync processes

What permission I need to delegate to this account?

Thanks

Best Regards
Chong

Answer 1

@Chong

As @Martin Rublik mentioned ADSyncOperators group would help to achieve both of your ask mentioned in the query.

You can add the desired account to ADSyncOperators groups and launch miisclient.exe to view the stats/errors which are occurred during sync cycle.

However you can run the sync cycle initial/delta via PowerShell or you can right click connector run the operation (full/delta - Import/Sync and export ) below is how Sync service UI looks when user is part of ADSyncOperators Group.

These four(4) Security Groups are installed by default when executing the installation of Azure AD Connect, these will be installed locally on the Azure AD Connect Server. You will find them in Local Users and Groups.

ADSyncAdmins, ADSyncBrowse, ADSyncOperators, ADSyncPasswordSet

Reference: https://learn.microsoft.com/en-us/archive/blogs/iamsupport/support-info-azure-ad-connect-sync-security-groups

Let me know if you have any further questions.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Local ADSyncOperators group would be the best fit.

Martin