• Microsoft Identity Manager 2016 Service Pack 1
• Exchange Online

WINDOWS INSTALLER LOG EXCEPTION

1. From a command-prompt or the Run Window type secpol.msc to open the Local Security Policy
   1. From the Domain, it would be GPO
2. Navigate to Local Policies > User Rights Assignment > Deny Access to this computer from the network
3. If the Service Account for the MIM Service Account resides there, then remove it
4. From an Administrative Command-Prompt, type gpupdate /force

• Microsoft KB Article: https://support.microsoft.com/en-us/help/4073679
• Version History: https://docs.microsoft.com/en-us/microsoft-identity-manager/reference/version-history
• Download: https://www.microsoft.com/en-us/download/details.aspx?id=57078

Prerequisites before patching:

1. MIM 2016 Service Pack 1
2. Visual C++ 2013 x64 Redistributable Packages (vcresist_x64.exe) is required
   1. Associated Error you will see if the package is not present: There is a problem with the Windows Installer package.  A DLL required for this install to complete could not be run.  Contact your support personnel or package vendor.
3. NET Framework 4.6 is also required for the installer

High-Level Important Enhancements to this build:

Summary of fixes and enhancements

Synchronization service

• *Support for Group Managed Service Accounts
• *Visual Studio Support (Visual Studio 2013,Visual Studio 2015,Visual Studio 2017)
• Updates to MIISACTIVATE.EXE, gMSA Support added
  • non-gMSA: Miisactivate.exe c:\configBU\miiserver_01.bin “contoso\mimSyncService” *
  • gMSA: Miisactivate.exe c:\configBU\miiserver_01.bin “contoso\mimSyncService”
• Updates to MIISKMU.exe, gMSA Support added
  • non-gMSA:MIISKMU.exe /e c:\configBU\miiserver_02.bin” /u:”contoso\mimSyncService”
  • gMSA:MIISKMU.exe /e c:\configBU\miiserver_02.bin” /u:”contoso\mimSyncService” *
• Updated partition information is saved as expected when the Refresh then OK buttons are clicked
• When indexing an Indexable String attribute is too long an Unexpected Error was returned, more descriptive error message is now returned
• Creating a Text File management agent when the MIM Synchronization Service is installed on Windows Server 2016, some text encoding options, including Unicode were unavailable
• MIM Service MA If an export error message contains an invalid character, this causes corruption in the run history entries. This build we removed from the error message before being saved to the connectorspace object and run history

MIM service

• *Support for Group Managed Service Accounts
• *Improved Language support to new defined standard
• *FIMAutomation Export-FIMConfig PowerShell cmdlet the “-PamConfig” argument is available to force the PAM configuration objects to be exported
• *FIMAutomation Export-FIMConfig PowerShell cmdlet the “-request” parameter has been added
• *Boolean attributes are always set to NULL upon binding creation, Previous Boolean before hotfix will not be updated
  • Important This can be a breaking change if performing a configuration migration or new object creation.
  • Configuration should be evaluated and updated for new feature as configuration migration is considered a new
  • Implemented initialization of new MIM Boolean attributes to false on creating new object implemented initialization of new MIM Boolean attributes to false on adding new Boolean attribute binding to the resource
• Customer Experience Improvement Program setting is maintained to false

• MIM Service installation failed with Database Upgrade error: Cannot insert the value NULL into column 'Name' if not default database name is used
• In hotfix cases the Office 365 setting would be cleared, The encrypted password for the MIM Service’s Exchange Online mailbox is not changed
• *There was no limit to the MIM Service log file created, Updated logging default setting and implemented circular logging capability

Privilege Access Management

• *Support for Group Managed Service Accounts
• *Improved Language support to new defined standard
• Objects that use unmanaged resources are not cleared on time. these objects will be properly cleaned up
• *New-PAMRole PowerShell cmdlet the “-disableAutoApproveIfOwner” deny self-approval for the role
  • Get-PamRequest PowerShell cmdlet the “-CreatedFrom” allows for the filtering od PAM specific request
• *PAM Module Additions
  • Get-PAMSet
  • Add-PAMSetMember
  • Remove-PAMSetMember
• The warning (Exception: System.ObjectDisposedException: Cannot access a disposed object) will no longer appear in the PAM event log
• Set-PAMUser cmdlet is able to change the PrivAccountName without the delete
• New-PamRole now validates that the “available to” date is greater than the “available from” date
• The “Available From” and “Available To” values are returned by the Get-PAMRole PowerShell cmdlet
• The Get-PamRequest cmdlet filter is now properly
• *Set-PamGroup cmdlet is now able to update the Active Directory shadow principal group object
• Remove-PamUser PowerShell cmdlet fails with an unclear error message, if the user is linked to a Role as a candidate. Now client-side validation was added to the cmdlet, and the exception returned was clarified
• Change Mode PAM accounts are not exposed for configuration
  • PAM Rest API account
  • PAM Component service account
  • PAM Monitoring service account

Microsoft Identity Portal

• *Support for Group Managed Service Accounts
• *Improved Language support to new defined standard
• Identity Picker control, the control seems to dynamically grow its width rather than wrapping the text
• Portal, popup dialogs aren’t displayed properly when viewing in Internet Explorer (IE) 10
• Cyrillic symbols in the title bar text is displayed correctly
• Popup windows no longer have the extra scroll bar displaying, when viewed in Internet Explorer
• Failed “Import Workflow Definition” properly throws an exception and recovers, allowing a Synchronization Rule activity to be added to the workflow definition
• added to default web.config
• Special characters in the distinguishedName no longer prevents Self-Service Password Reset from resetting the user’s password in the Active Directory
• Improvements in the sentences are properly localized in the display
• MIM Add-in for Outlook includes a copy of the missing Outlook interop binaries

Certificate Management

• Renewing a virtual smart card through the MIM CM Modern App, user receives Forbidden exception
• *Improved Language support to new defined standard
• PIN Utility “CLM has encountered an error while trying to change Smart Card PIN. Wrong number of Arguments or Invalid Property Assignment.”
• Update to the MIM Certificate Authority Modules from 4.4.1302.0 to a build later than 4.4.1459, the setup fails
• Modern App for Renew, Enroll, and Replace operations, the request history doesn’t contain all request status items as are recorded
• Online Update doesn’t complete and returns the exception “Record has been updated or deleted by another user.”
• The “Download Certificate” link in the Certificate Management Portal, the certificate download (.cer file) was too large
• MIM Certificate Management Bulk Client will work with both TLS 1.1 and TLS 1.2.

• Microsoft Identity Manager 2016 Service Pack 1
  • Active Directory Management Agent (ADMA)

PROBLEM SCENARIO DESCRIPTION

• Attempting to create an Active Directory Management Agent in the Synchronization Service Engine an LDAP Error is received that provides just the number 80230910.

ERROR MESSAGE

“Sequence expected but class:UNIVERSAL(0) primitive tag:5 was unexpected”

CAUSE

RESOLUTION

• Remove the Custom Auxiliary Class from any ObjectTypes it may be associated
• Disable the Custom Auxiliary Class by setting the isDefunct Property to True.
  • https://msdn.microsoft.com/en-us/library/ms675903%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
• Create the Active Directory Management Agent (ADMA)
• Enable the Custom Auxiliary Class by setting the isDefunct Property to False

ADDITIONAL INFORMATION

Identity Management Information

• Forum Posting: https://social.technet.microsoft.com/Forums/en-US/3f572a24-362a-4601-b109-9d4965144e13/miis-2003-sp1-adam-connector-error-80230910?forum=identitylifecyclemanager

Active Directory Related Information

• Disabling Existing Classes and Attributes: https://msdn.microsoft.com/en-us/library/ms675903%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
• Object-Class-Category Attribute: https://msdn.microsoft.com/en-us/library/ms679014(v=vs.85).aspx
• Structural, Abstract, and Auxiliary Classes: https://msdn.microsoft.com/en-us/library/ms677964(v=vs.85).aspx

• Microsoft Identity Manager 2016 Service Pack 1 (4.4.1302.0)
  • Service and Portal Installation
• Microsoft Windows Server 2016

PROBLEM SCENARIO DESCRIPTION

• In this scenario, we are attempting to execute an installation of the Service and Portal on a Windows Server 2016 machine and it is failing.

WINDOWS INSTALLER ERROR MESSAGE

KEYWORDS IN WINDOWS INSTALLER ERROR MESSAGE

Failing on Windows Installer Custom Action InstallCert

CustomAction InstallCerts returned actual error code 5

PROCESS MONITOR LOG

• Review the properties of one of the Access Denied lines and you will find on the Process Tab the account that is executing the action.  In this case, it is the NT AUTHORITY\SYSTEM account.
• While one of those lines is highlighted, from the Event Menu, select Jump To (or Press CTRL+J) and it will take you to the location in question.

CAUSE

• We reviewed the folder permissions for the MachineKeys folder under %programdata%\Microsoft\Crypto\RSA and found that it contained the NETWORK SERVICE account.

RESOLUTION

• Removed the NETWORK SERVICE account from the Security Tab of the %programdata%\Microsoft\Crypto\RSA\MachineKeys folder.

ADDITIONAL INFORMATION

Other installation Support Blogs

• Support-Tip: (INSTALLATION): Installation Companion - Accounts: https://blogs.technet.microsoft.com/iamsupport/2018/05/09/support-tip-installation-installation-companion-accounts-reference/
• Support-Info: (INSTALLATION): Troubleshooting MIM Service/Portal Install/Upgrade IsSharePointAdminServiceRunning Error: https://blogs.technet.microsoft.com/iamsupport/2018/04/26/support-info-installation-troubleshooting-mim-serviceportal-installupgrade-issharepointadminservicerunning-error/
• Support-Info: (INSTALLATION): Sync Engine fails to uninstall: Microsoft Identity Manager Synchronization Service was not successfully installed: https://blogs.technet.microsoft.com/iamsupport/2018/04/25/support-info-installation-sync-engine-fails-uninstall-microsoft-identity-manager-synchronization-service-was-not-successfully-installed/

ACCOUNT TYPE	ACCOUNT NAME SUGGESTION	ACCOUNT RESPONSIBILITIES EXPLANATION
Installation Account	miminstall	NOTE This is a recommended account, not a required account to make FIM/MIM work. The installation of the Identity Management software requires elevated privileges and special permissions on SQL Server.  Many times, a standard user and/or a service account does not have all of the necessary permissions to execute an installation of the Microsoft Identity Management product and/or update.  This is why we feel it is a good idea to have an installation account that can be utilized for the sole purpose of Product Installation, Service Pack Installation and/or Hotfix (Cumulative Update) Installation.  Once the installation is completed, the recommendation would be to disable the account until you have another update installation to execute. This account will need the following permissions for the purpose of the installation. NOTE It is important to note that these permissions are required for the account executing the installation for the purpose of installation.  Once the installation is complete, then these permissions can be removed if they are not needed for the account that is executing the installation.  This is important to note in case you choose not to have an actual installation account, but to use a service account and/or another user account. SQL SERVER: sysAdmin The account executing the installation must have sysAdmin permissions on the Microsoft SQL Server that is hosting the FIMSynchronizationService and FIMService Databases sysAdmin permissions are needed for several different creation and/or alter job that happen during the installation. Domain Admin Permissions The account executing the installation should have Domain Administrator permissions long enough for the installation of the product and/or update. By adding the account to the Domain Administrator, the account will most likely become a part of the Local Administrators group. SharePoint Permissions NOTE The SharePoint permissions are normally set during the installation process of SharePoint and is normally the account logged in executing the installation. SharePoint Farm Administrator SharePoint Site Collection Administrator Reasons to utilize an installation account It will always exist, even if the physical person executing the Identity Management Installation ends up leaving the company, then the installation account still resides. Installation account can have the elevated privileges where other accounts will not need to be granted this type access, even if it is for a short period of time. It is not recommended to: Use Service Accounts to execute the installation, because the account executing the installation is required to have elevated privileges and permissions. Use Service Accounts because the installation of the Service and Portal adds it to the Administrators Set in the Portal.
SharePoint Configuration Account	spDBAccount	Domain User This account is specified/asked for during the SharePoint Configuration Wizard In SharePoint, this account is the SharePoint Farm Account which is utilized to talk to the SharePoint Databases. NOTE Fore more information on this specific account, refer to the SharePoint Documentation here: https://docs.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/plan-for-administrative-and-service-accounts
SharePoint Application Pool Account	mimAppPool	Domain User This account is used during the SharePoint Installation and is the Application Pool Account for SharePoint and for the Identity Manager Product This account does require ServicePrincipalNames (SPN) for the purpose of kerberos authentication.  The SPN will have the prefix of HTTP/ NOTE A ServicePrincipalName is utilized for Kerberos Authentication.  For more information on the ServicePrincipalName (SPN), review the following documentation: https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-2017 SharePoint Application Pool - SPN Information If the address that the clients use to contact the FIM Portal is not the same as the server address, you have to establish an SPN for HTTP. That is, if you use a CNAME resource record in DNS, have a SharePoint farm, or use NLB, this address must be registered or Internet Explorer cannot use the Kerberos protocol when it contacts the portal. Run the following command: On a domain controller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator Type: setspn -S HTTP/<FIMPortalAlias> <Domain Name>\<SharePoint Service Account> ( e.g. setspn -s HTTP/myfimportalmachine DOMAINA\svcSharePointService ) <FIMPortalAlias>: This is the address that is used to navigate to the FIM Portal ( e.g.https://myfimportalserver/ ) <Domain Name>: NETBIOS name of the domain that the FIM Solution has been installed <SharePoint Service Account>: sAMAccountName of the SharePoint Service Account ( e.g. The account specified on the SharePoint - 80 Application Pool in IIS. NOTE If the account running the SharePoint Application Pool is Network Service, then the SharePoint Service Account should be the computer account that SharePoint Services and the FIM Portal are running. If, in your solution, you are using a Load Balancer, DNS, Fully Qualified Domain Names (FQDN), you will need to ensure that you have an SPN for each of them. SPN EXAMPLES HTTP/myfimservicemachine HTTP/myfimservicemachine.contoso.com HTTP/myfimserviceDNSAlias ADDITIONAL INFORMATION ON SPNS FIM 2010 R2 Kerberos Settings: https://docs.microsoft.com/en-us/previous-versions/mim/jj134299(v=ws.10) NOTE This page will be the same for MIM 2016     This account must be trusted for Kerberos delegation, which is done on the Active Directory account on the Delegation Tab.  In the below snapshot, we utilize the 2nd radio button.  In a more locked down, secure environment one might choose to use the 3rd radio button.  However, we do not recommend doing this, unless you are familiar with Kerberos Delegation settings.
Synchronization Service Account	mimsync	Domain User This is the account that you will see on the Forefront Identity Manager Synchronization Service item in Services MMC. This account is utilized to communicate between the Application Client (Synchronization Service Manager) and the backend SQL Server Database called FIMSynchronizationService This account should not be used for: Installation purposes A Management Agent Account Providing a bit more security to the FIM/MIM Service Account, add the FIM/MIM Service Account to the following Local Security Policies Deny Logon as Batch Job Deny Logon Locally Deny Access to this computer from the network
Service Account	mimservice	Domain User This is the account that is referenced on the Forefront Identity Manager Service item on the Services MMC The FIM/MIM Service is the account that helps connect the Synchronization Service to the FIMService Database for request processing This should be an email enabled service account, especially if you are going to utilize approvals which executes emails sent from the FIMService account This account should not be used for: Installation purposes A Management Agent Account This account does require ServicePrincipalNames (SPN) for the purpose of kerberos authentication.  The SPN will have the prefix of HTTP/ NOTE A ServicePrincipalName is utilized for Kerberos Authentication.  For more information on the ServicePrincipalName (SPN), review the following documentation: https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-2017 FIM/MIM Service - SPN Information If the address that the clients use to contact the FIM Portal is not the same as the server address, you have to establish an SPN for HTTP. That is, if you use a CNAME resource record in DNS, have a SharePoint farm, or use NLB, this address must be registered or Internet Explorer cannot use the Kerberos protocol when it contacts the portal. Run the following command: On a domain controller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator Type: setspn -S HTTP/<FIMPortalAlias> <Domain Name>\<SharePoint Service Account> ( e.g. setspn -s HTTP/myfimportalmachine DOMAINA\svcSharePointService ) <FIMPortalAlias>: This is the address that is used to navigate to the FIM Portal ( e.g.https://myfimportalserver/ ) <Domain Name>: NETBIOS name of the domain that the FIM Solution has been installed <SharePoint Service Account>: sAMAccountName of the SharePoint Service Account ( e.g. The account specified on the SharePoint - 80 Application Pool in IIS. NOTE If the account running the SharePoint Application Pool is Network Service, then the SharePoint Service Account should be the computer account that SharePoint Services and the FIM Portal are running. If, in your solution, you are using a Load Balancer, DNS, Fully Qualified Domain Names (FQDN), you will need to ensure that you have an SPN for each of them. SPN EXAMPLES FIMService/myfimservicemachine FIMService/myfimservicemachine.contoso.com FIMService/myfimserviceDNSAlias ADDITIONAL INFORMATION ON SPNS FIM 2010 R2 Kerberos Settings: https://docs.microsoft.com/en-us/previous-versions/mim/jj134299(v=ws.10) NOTE This page will be the same for MIM 2016 This account must be trusted for Kerberos delegation, which is done on the Active Directory account on the Delegation Tab.  In the below snapshot, we utilize the 2nd radio button.  In a more locked down, secure environment one might choose to use the 3rd radio button.  However, we do not recommend doing this, unless you are familiar with Kerberos Delegation settings.   Providing a bit more security to the FIM/MIM Service Account, add the FIM/MIM Service Account to the following Local Security Policies Deny Logon as Batch Job Deny Logon Locally Deny Access to this computer from the network NOTE If you are using Exchange Online, then do not have the FIMService in the "Deny Access to this computer from the network" In a Privileged Access Management (PAM) Scenario The MIM Service Account must have the ability to create shadow principals or groups (depending on the mode PAM is running in)
Self-Service Password Reset / Registration	mimsspr	Domain User Account This account should be exclusive to the Self-Service Password Reset / Registration service This account is represented in the IIS Manager under the Application Pool This account does require ServicePrincipalNames (SPN) for the purpose of kerberos authentication.  The SPN will have the prefix of HTTP/ NOTE A ServicePrincipalName is utilized for Kerberos Authentication.  For more information on the ServicePrincipalName (SPN), review the following documentation: https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-2017 FIM/MIM Service - SPN Information If the address that the clients use to contact the FIM Portal is not the same as the server address, you have to establish an SPN for HTTP. That is, if you use a CNAME resource record in DNS, have a SharePoint farm, or use NLB, this address must be registered or Internet Explorer cannot use the Kerberos protocol when it contacts the portal. Run the following command: On a domain controller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator Type: setspn -S HTTP/<FIMPortalAlias> <Domain Name>\<SharePoint Service Account> ( e.g. setspn -s HTTP/myfimportalmachine DOMAINA\svcSharePointService ) <FIMPortalAlias>: This is the address that is used to navigate to the FIM Portal ( e.g.https://myfimportalserver/ ) <Domain Name>: NETBIOS name of the domain that the FIM Solution has been installed <SharePoint Service Account>: sAMAccountName of the SharePoint Service Account ( e.g. The account specified on the SharePoint - 80 Application Pool in IIS. NOTE If the account running the SharePoint Application Pool is Network Service, then the SharePoint Service Account should be the computer account that SharePoint Services and the FIM Portal are running. If, in your solution, you are using a Load Balancer, DNS, Fully Qualified Domain Names (FQDN), you will need to ensure that you have an SPN for each of them. SPN EXAMPLES HTTP/myfimpasswordregistration HTTP/myfimpasswordregistration.contoso.com HTTP/myfimpasswordregistrationDNSAlias ADDITIONAL INFORMATION ON SPNS FIM 2010 R2 Kerberos Settings: https://docs.microsoft.com/en-us/previous-versions/mim/jj134299(v=ws.10) NOTE This page will be the same for MIM 2016 This account must be trusted for Kerberos delegation, which is done on the Active Directory account on the Delegation Tab.  In the below snapshot, we utilize the 2nd radio button.  In a more locked down, secure environment one might choose to use the 3rd radio button.  However, we do not recommend doing this, unless you are familiar with Kerberos Delegation settings.
FIM Service Management Agent Account	mimma	Domain User This account should be exclusive to the FIM Service Management Agent This account should not be a Local Administrator The Synchronization Service Account The FIM Service Account This account is utilized to communicate with the FIMService Database This account should match the account that you specified during the Service and Portal Installation, which adds it to the Windows Registry under the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FIMService. LOCAL SECURITY POLICY The FIM Management Agent Account cannot have the "Deny access to this computer from the network" INFORMATION / LINKS Microsoft Identity Manager 2016 - Before you Begin: https://docs.microsoft.com/en-us/microsoft-identity-manager/mim-how-provision-users-adds#step-4-create-the-fabrikam-fimma-management-agent Troubleshooting the FIM Service Management Agent: [Troubleshooting]: FIM Service Management Agent: Failed to retreive schema or Cannot connect to database when creating the FIM Service Management Agent: https://blogs.msdn.microsoft.com/ms-identity-support/2012/05/04/troubleshooting-fim-service-management-agent-failed-to-retreive-schema-or-cannot-connect-to-database-when-creating-the-fim-service-management-agent/

ADDITIONAL INFORMATION

• (Forum Posting): FIM Service Accounts - Clarification of Necessary Permissions: https://social.technet.microsoft.com/Forums/en-US/6549c8f8-a867-4c07-9319-842a913b00a5/fim-service-accounts-clarification-of-necessary-permissions
• Forefront Identity Manager Installation Guide: https://docs.microsoft.com/en-us/previous-versions/mim/ee534909(v=ws.10)#FIM_Before
• Service Accounts, SPNs, and Kerberos Delegation configurations for MIM Service and Portal Installation: https://blogs.msdn.microsoft.com/connector_space/2018/06/07/service-accounts-spns-and-kerberos-delegation-configurations-for-mim-service-and-portal-installation/

• • • Microsoft Azure AD Connect Sync (AADCONNECT)

PROBLEM SCENARIO DESCRIPTION

• • • The goal here is to update the proxyAddresses attribute on a User and/or Contact object with the value that is in the targetAddress attribute only if the proxyAddresses attribute does not contain a primary SMTP.  This should only happen for objects that are coming from a specific OU.

RESOLUTION

HOW TO STEPS

• In the Synchronization Rules Editor, click the Add New Rule button in the upper right to add a new Inbound Synchronization Rule
• DESCRIPTION TAB
  1. Provide the information needed for this Synchronization Rule.  (Example Picture from my lab)

• Click the Next button to move to the Scoping Filter tab
  • Click Add Group and then Add Clause
  • Set the Attribute Column to dn
  • Set the Operator Column to Contains
  • Set the Value to the beginning of the OU Distinguished Name (Example Picture is from my lab)
• Click the Next Button to move to the Join Rules tab
• No Join Rules needed at this point
• Click the Next Button to move to the Transformations tab
  1. Click Add Transformation
     1. Flow Type: Expression
     2. Target Attribute: proxyAddresses
     3. Source: IIF(IsNull(ItemOrNull([proxyAddresses],Contains([proxyAddresses],"SMTP:"))),Split(Join([proxyAddresses],";")&";"&[targetAddress],";"), [proxyAddresses])

• Click the Save Button

TESTING RESULTS

• Do a Generate Preview to confirm success in Sync.
• Then Commit the Preview.

ADDITIONAL INFORMATION

• Azure AD Connect sync: Functions Reference: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-functions-reference
  • SPLIT FUNCTION: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-functions-reference#split
  • JOIN FUNCTION: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-functions-reference#join
  • ISNULL FUNCTION: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-functions-reference#isnull
  • IIF FUNCTION: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-functions-reference#iif
• Azure AD Connect Sync: Understand and customize synchronization: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-whatis
• Azure AD Connect Sync: Make a change to the default configuration: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-change-the-configuration
• Support-Tip: (AADCONNECT): Sync Rules - Precedence: https://blogs.technet.microsoft.com/iamsupport/2017/03/21/support-tip-azure-ad-connect-sync-sync-rules-precedence/

• Microsoft Identity Manager 2016
  • Synchronization Service - FIM Service Management Agent
  • Service and Portal

PROBLEM SCENARIO DESCRIPTION

• Running an Export Run Profile on the FIM Service Management Agent produces the Run Status of stopped-server.  We want to understand the best way to clear out data in the FIM Service Management Agent connector space to assist with resolving this issue.

  NOTE	To learn more about the different Run Profile Status' that is returned by the WMI RunStatus Property when executing Run Profiles, review this MSDN information: https://msdn.microsoft.com/en-us/library/windows/desktop/ms699322(v=vs.100).aspx

FIM SERVICE MANAGEMENT AGENT ERRORS

• Failed-creation-via-web-services (in this specific scenario, we received 5000+)

  NOTE

  The failed-creation-via-web-services error is a fairly common error.  Here is some information around this error that may assist in resolving some of the different errors that you can receive with this error. FIM Troubleshooting: Failed-Creation-Via-Web-Services: InvalidRepresentationException: ValueViolatesUniqueness: https://social.technet.microsoft.com/wiki/contents/articles/17242.fim-troubleshooting-failed-creation-via-web-services-invalidrepresentationexception-valueviolatesuniqueness.aspx [Troubleshooting]: Failed-Creation-Via-Web-Services Troubleshooter: https://blogs.msdn.microsoft.com/ms-identity-support/2013/05/11/troubleshooting-failed-creation-via-webservices-troubleshooter/ FIM Troubleshooting: Failed-Creation-Via-Web-Services: The endpoint could not dispatch the request: https://social.technet.microsoft.com/wiki/contents/articles/17245.fim-troubleshooting-failed-creation-via-web-services-the-endpoint-could-not-dispatch-the-request.aspx

CAUSE (failed-creation-via-web-services):

• The Connector Space for the FIM Service Management Agent was deleted and data from the Service and Portal was not reimported into the FIM Service Management Agent Connector Space.  This allowed some data to still exist in the Service and Portal that the FIM Service Management Agent has staged as Pending Export Adds.

RESOLUTION (failed-creation-via-web-services):

1. Remove all the Users from the Service and Portal
   • The best way to achieve this for many objects is to utilize a PowerShell Script.  The "How to use PowerShell to Delete All Users from the FIM Portal" (https://social.technet.microsoft.com/wiki/contents/articles/2108.how-to-use-powershell-to-delete-all-users-from-the-fim-portal.aspx) is a sample illustration that works great.

1. Ensure that the Service and Portal are clear of all EREs
2. Execute a Full Import (Stage Only) on the FIM Service Management Agent
   • This will bring in all of the Synchronization Rules into the FIM Service Management Agent Connector Space.
3. Execute a Full Synchronization on the FIM Service Management Agent
4. Review Pending Exports to understand the data that you will be exporting.
   • You can do this through Search Connector Space > Pending Exports
5. Once Pending Exports is confirmed, proceed with running an Export on the FIM Service Management Agent
   • From the Actions menu, select Run and then Export
6. Once the Export is finished, execute a Delta Import (Stage Only) to confirm the Exported Changes

ADDITIONAL INFORMATION

Deletion of connector spaces

• Deleting a connector space should be a large task to consider.  Here is some information around the deletion of a connector space.
  • FIM Reference: Things to Look at before Deleting a Connector Space: https://social.technet.microsoft.com/wiki/contents/articles/4189.fim-reference-things-to-look-at-before-deleting-a-connector-space.aspx
  • FIM Service Management Agent: Deleting the Connector Space: https://social.technet.microsoft.com/wiki/contents/articles/4195.fim-service-management-agent-deleting-the-connector-space.aspx
  • FIM 2010: How to delete Management Agent and Connector Space: https://social.technet.microsoft.com/wiki/contents/articles/4191.fim-2010-how-to-delete-management-agent-and-connector-space.aspx

Management Agent Run Status

• Executing a Run Profile, you can see the status of the Run on the Operations Tab of the Synchronization Service Manager GUI.  The Run Status is returned to the GUI as the result that is returned from the WMI RunStatus Property.  Here is some good information around this topic:
  • RunStatus Property: https://msdn.microsoft.com/en-us/library/windows/desktop/ms699322(v=vs.100).aspx
  • Support-Info: (FIM Service MA): RunStatus: Stopped-Server Troubleshooter Resources: https://blogs.technet.microsoft.com/iamsupport/2017/11/15/support-info-fim-service-ma-runstatus-stopped-server-troubleshooter-resources/

Other Information

• Management Agent Run Error Codes: https://docs.microsoft.com/en-us/microsoft-identity-manager/reference/maerrorcodes

• Microsoft Identity Manager 2016 Service Pack 1
  • Group Management

PROBLEM SCENARIO DESCRIPTION

• This issue centered around Group Management.  We were not seeing Security and/or Distribution Groups be synchronized correctly through the Synchronization Engine.

CAUSE

From Portal to Active Directory

• We noticed that the Provisioning Synchronization Rules for Security Groups were not being applied.
• In review of the Outbound Synchronization Rule, the Scope was set to "GroupType" instead of "Type"

From Active Directory to Portal

• FIM Service Management Agent was missing Export Attribute Flow (EAF) for member

RESOLUTION - FROM PORTAL TO ACTIVE DIRECTORY

1. Update the Scope on the Group Outbound Synchronization Rule
   1. Set the Scope to reference the Metaverse Attribute "Type"
   2. Updated the DN on the Outbound Attribute Flow tab to ensure that it referenced an OU that exists in Active Directory and is in Scope for the Active Directory Management Agent.
2. Import and Sync the update to the Synchronization Rule into the Synchronization Service Engine (FIM Service Management Agent Connector Space and Metaverse)
3. Test the Synchronization Process through the use of the Preview Feature

RESOLUTION - FROM ACTIVE DIRECTORY TO PORTAL

1. Added Export Attribute Flow for the attribute Member on the Group to Group branch under Configure Attribute Flow

ADDITIONAL INFORMATION

• How do I provision groups to AD DS: https://docs.microsoft.com/en-us/previous-versions/mim/ff686261(v=ws.10)
• How do I Synchronize groups from AD DS to FIM: https://docs.microsoft.com/en-us/previous-versions/mim/ff686936(v%3dws.10)
• Support Team Blog: https://blogs.technet.microsoft.com/iamsupport/tag/group-management/

• Microsoft Identity Manager 2016 Service Pack 1
  • Password Change Notification Service (PCNS)

PROBLEM SCENARIO DESCRIPTION

• Passwords are not being replicated to the Target Domain

CAUSE

• Password Synchronization was not enabled in the Synchronization Service Manager GUI
  • Enable Password Synchronization  in Tools > Options was not enabled (checked)

• Source and Target Management Agents were not setup

Source - Configure Directory Partitions

• Target - Configure Extensions

RESOLUTION

• Enable the Enable Password Synchronization option in Tools > Options
• Enable the Source Management Agent on Configure Directory Partitions
• Enable the Target Management Agent on Configure Extensions

  ADDITIONAL INFORMATION

• PCNS Resource Wiki: https://social.technet.microsoft.com/wiki/contents/articles/2762.fim-password-synchronization-pcns-resource-wiki.aspx
• Microsoft Identity Manager 2016 Password Management: https://docs.microsoft.com/en-us/microsoft-identity-manager/infrastructure/mim2016-password-management
• Microsoft Identity Manager 2016 Password Synchronization: https://docs.microsoft.com/en-us/microsoft-identity-manager/infrastructure/mim2016-password-management#password-synchronization
• Deploy the MIM Password Change Notification Service on a domain controller: https://docs.microsoft.com/en-us/microsoft-identity-manager/deploying-mim-password-change-notification-service-on-domain-controller