However, recently I have been on an even crazier rollercoaster with my daughter.  This has often led to making decisions between spending time on work or time with my daughter.  Over the next year or two my daughter will be entering a very important developmental window where we will be working towards preparing her for school.  During this time a very focused effort on her can have an incredible positive impact on her life long term.

That being the case, I have decided to step away from Microsoft and devote myself full-time to my daughter during this very precious, and limited, developmental window of her life.  I step away from the role of Software Design Engineer to take on a variety of roles that are best summed up as Stay-At-Home Dad.

It has truly been a pleasure working with all everyone over the past twelve years.  I know it sounds like cheerleading to talk about how we have changed the world with our software, but I honestly believe that we can make that claim.  The CLR changed how software was written with the introduction of managed code and made it easier to write complex software.  The WCF provided a mechanism to abstract the communication layer of distributed applications in a similar manner to how the data and UI layers are separated (again making it easier to write distributed applications).  ILM "2" will change the way that identity management is done within the enterprise and has the potential to change the way identity aware applications are written.

My last day was today (Friday, November 7).  For those of you following the development of ILM "2", especially the integration with Windows Workflow Foundation, fear not.  I leave you in good hands.  Assuming that I still have access to post here I will be providing a pointer to my replacement's blog as soon as it is available.  Until then there is always Bobby and Nima's Blog.  (Had to get one last shot in you two! :) )  Thank you again for all the support and great questions that kept me posting.  Good luck with all of you endeavors and I hope to hear great things of how ILM "2", and its integration with WF, is being used to solve amazing problems!

In what I call the DisplayNameGeneratorActivity, I have created an activity that allows administrators to configure ILM2 workflow definitions to define a resource's DisplayName attribute format using the lookup grammar available within ILM2 email templates.  The activity will resolve that grammar according to a request and then update the target resource's DisplayName attribute with the result of that resolution.  This allows for enterprises to define policy around a resource's DisplayName.  For example, using this approach an enterprise can enforce that all Person resources managed in ILM2 will have their DisplayName attribute set to "LastName, FirstName (AccountName)".

Just as with the DisplayNameValidatorActivity walk through, after implementing the actual activity code, I continue to walk you through writing the code required to expose this activity through the ILM2 portal's workflow designer.  I then walk you through the actual deployment of this new activity to an ILM2 web service.  Finally, I use the ILM2 web portal to create a workflow definition including my new activity, connect it to an ManagementPolicyRule, and trigger the execution of the workflow - showing how this activity overwrites an end user's requested DisplayName with the one defined by this policy.

The concepts used in this activity will allow developers to understand how to create custom activities to be used within an ILM2 deployment for calculating dynamic attribute values for specific resources and then updating those resources within the Action phase when resources are either created or updated.  As always, enjoy...

Video Length : ~20 minutes

In what I call the DisplayNameValidatorActivity, I have created an activity that allows administrators to configure ILM2 workflow definitions to check the DisplayName attribute for the presence of a list of illegal words.  Both the set of illegal words and the delimiters used to define a word are configurable to allow the behavior of the activity to grow without requiring recompiling and deployment.

After implementing the actual activity code, I continue to walk you through writing the code required to expose this activity through the ILM2 portal's workflow designer.  I then walk you through the actual deployment of this new activity to an ILM2 web service.  Finally, I use the ILM2 web portal to create a workflow definition including my new activity, connect it to an ManagementPolicyRule, and trigger the execution of the workflow - showing both a case where the activity denies the request and a case where the activity allows the request.

The concepts used in this activity will allow developers to understand how to create custom activities to be used within an ILM2 deployment for doing complex inspection of a request's content to determine whether or not that request should be allowed.  As always, enjoy...

Video Length : ~40 minutes

Enjoy.

Video Length : ~6 minutes

I look forward to hearing comments from all of you as to if this is a favorable method of passing information through my blog.

Video Length : ~20 minutes

I’m Lori Craw, group product manager covering identity and security at Microsoft. Today I am pleased to announce the exciting news that the Identity Lifecycle Manager “2” Release Candidate (RC) is now available.

ILM “2” builds on our Identity Lifecycle Manager 2007 investments, and includes solutions that will help IT more efficiently and effectively automate identity policies for users and their associated credentials and entitlements. An important set of features in this release focus on self-service for end users, enabling them to manage some of their own information like their passwords and groups, using self-service tools built into Office. The IT pro tools, combined with end-user self-service in Office and developer experiences using .NET and Visual Studio add up to a very powerful combination.

We’ve received great feedback on these features from our beta and TAP customers so far. We also have seen some great momentum with core partners, including Quest, Omada, and Unisys.

So what’s new in the RC, you ask? Some of the top new additions to the RC include:

- Support for scale out of the ILM "2" middle tier database and portal on separate servers, and support for multiple portal servers
- Added support for managing groups across multiple Active Directory forests
- Improvements in the request and notification emails, including customizable notification emails and request details baked into the out-of-box request emails
- Support for third-party certificate authorities (CAs)
- Performance and stability improvements
- Localization support for German and Japanese

I’d like to invite you to learn more about ILM “2” and to try out the RC for yourself by visiting www.microsoft.com/ilm2.

Regards,
Lori Craw
Group Product Manager
Microsoft Identity and Security

Without further ado you can find the white paper in the side bar of Ensynch's Identity & Access Management Practice Area.  Or for those who want direct links:

Identity and Access Management Operations Guide - ILM 2 Workflow Activity Walkthrough

Walkthrough Project Files

News and Updates from the UK MCS Talks Team : Session 5 Details: Registration Now Available

While I completely agree with his assessment, it got me thinking about what advice I have for those of you out there that have a strong knowledge of the Microsoft Identity Lifecycle Manager 2007 product to assist your transition to the Microsoft Identity Lifecycle Manager "2" product.  To that point I will take yet another pause from peeling back the onion of the Microsoft Identity Lifecycle Manager "2" request processing model and focus today's blog posting on that advice.

Let me start by assuring those out there who have spent (or are about to spend) the time to understand the Microsoft Identity Lifecycle Manager 2007 product that you have not wasted your time.  The components that made up that product are still an integral part of the Microsoft Identity Lifecycle Manager "2" product.  The Synchronization Engine and Certificate Lifecycle Manager will continue to be the focal points of a number of solutions for enterprises and those solutions will look very similar to solutions built on top of Microsoft Identity Lifecycle Manager 2007.  With the release of Microsoft Identity Lifecycle Manager "2" there will be new functionality in the form of the web services platform I have been writing about up until now.  These new web services will provide additional extensibility and is where I would recommend solutions experts focusing their time.

When thinking about educating yourself about the new Microsoft Identity Lifecycle Manager "2" web services platform as a transition from Microsoft Identity Lifecycle Manager 2007 to Microsoft Identity Lifecycle Manager "2", I like to break it into three pieces:  conceptual processing model, Windows Workflow Foundation integration, and Windows Communication Foundation integration.  I would also recommend exploring these areas in that order.  The Windows Workflow Foundation and Windows Communication Foundation integration will help with implementing custom solutions using those extensibility points; however, it does not make sense to start writing custom code until you understand the concepts behind how that code will affect the processing model of the Microsoft Identity Lifecycle Manager "2" product.  Once you do understand the request processing model at a conceptual level it is most likely that your first scenario that requires custom code will involve the Windows Workflow Foundation extensibility rather than the Windows Communication Foundation extensibility.

How do you educate yourself about the Microsoft Identity Lifecycle Manager "2" request processing model?  Personally, I recommend a certain MSDN blog that is focused on this specific topic.  :)  Honestly, this is the exact purpose I am trying to fill with this blog at the moment.  Beyond my blog I would also recommend Bobby and Nima's ILM Blog (these two generally focus on actually walk you through specific scenarios rather than conceptual discussions), and the other online references in my ILM References section in the side bar of my blog.  Bobby and Nima's ILM Blog is currently the best resource for describing the Codeless Provisioning feature of Microsoft Identity Lifecycle Manager "2".  (Essentially, how to configure the Synchronization Engine without writing a single line of code.)  Hopefully more resources will become available as time goes on.

After you have gained an understanding of the Microsoft Identity Lifecycle Manager "2" request processing model I would point you towards learning how to customize the OOB web portal.  The portal that ships with Microsoft Identity Lifecycle Manager "2" supports managing custom resource types and allows for customizing the user experience for managing those types.  This customization does have its limits but will go a long way to providing custom solutions for managing resources not included within the shipping product. 

As an example, it is a good bet that enterprises will want to add a "Computer" resource type in their deployments of Microsoft Identity Lifecycle Manager "2".  This is actually an example that the product group has used in demonstrations of Microsoft Identity Lifecycle Manager "2" at various conferences.  The shipping web portal will allow you to create this resource type, attached existing attributes, and create any new attributes needed to accurately describe the data tracked for a "Computer".  The portal will then provide a default user experience for managing these types immediately.  Enterprises can go a step further and create an appropriate instance of a configuration resource to "teach" the portal how to provide a better user experience when managing these types.

How do you education yourself about customizing the Microsoft Identity Lifecycle Manager "2" web portal?  Well that is an even trickier question than the request processing model.  I am most likely not going to get into that topic on my blog (I prefer the custom code side of things).  I cannot speak for Bobby and Nima's ILM Blog but that is the resource I would recommend at the moment.  The Microsoft Identity Lifecycle Manager "2" SDK should include documentation and, hopefully, a sample or two.  If anyone reading this has their own blog, I would be happy to reference any posts you have on this topic.

Once you have an understanding of the Microsoft Identity Lifecycle Manager "2" request processing model and portal customization you will find yourself at the point where additional extensibility requires custom code (of some type).  Welcome to my world!  :)  At this point I would recommend diving deeper into the Windows Workflow Foundation technology.  Given the customization support for custom resource types in the Microsoft Identity Lifecycle Manager "2" web portal enterprises are more likely going to need custom business logic before they need custom web service clients.  I believe that the majority of custom solutions will require some sort of custom business logic.

There are two methods of Windows Workflow Foundation centered extensibility within the [IML2] product:  custom workflows and custom activities.  In both cases, the word "custom" simply means that it is not supported OOB by the Microsoft Identity Lifecycle Manager "2" product.  In the case of custom workflows this means that the Microsoft Identity Lifecycle Manager "2" web portal's process designer cannot create the appropriate XOML.  This will require using a Windows Workflow Foundation designer application, such as Visual Studio, to create a XOML out of band and then use the Microsoft Identity Lifecycle Manager "2" web portal process designer to import that workflow.  In the case of custom activities this means that the Microsoft Identity Lifecycle Manager "2" product did not ship with an activity that performs the required logic.  This will require using a code editor, such as Visual Studio, to author and compile the custom code that will express the custom business logic.  Using Windows Workflow Foundation specific language, this could be a composite activity (i.e. an activity made up of child activities) or a completely new activity.

How do you educate yourself about Windows Workflow Foundation?  This is a bit easier than the topics discussed thus far since the technology has been available for some time and there are a number of books available.  Personally, I recommend "Essential Windows Workflow Foundation" by Dharma Shukla and Bob Schmidt (ISBN #978-0321399830).  This provides a great overview of the technology and dives fairly deep, leaving appropriate topics to other resources.  It covers more than you will need to know for extending Microsoft Identity Lifecycle Manager "2"; however, that knowledge would not be wasted as it will provide context and allow you to ask questions and understand answers about why I chose to design our extensibility a certain way.  While learning about Windows Workflow Foundation I would recommend focusing on the following topics (appropriate chapter titles from "Essential Windows Workflow Foundation" provided):

1. The Windows Workflow Foundation conceptual model - [Deconstructing WF]
2. The Windows Workflow Foundation activity model - [Activity Execution] and [Advanced Activity Execution]
3. How to author Windows Workflow Foundation activities - [Activity Execution], [Advanced Activity Execution], and [Advanced Authoring]
4. XOML only workflows - [WF Programs] and [Applications]

As an additional resource for learning Windows Workflow Foundation, I am planning on spending some time here discussing the above topics in general.  I am also planning on providing detailed discussions and examples of the Windows Workflow Foundation extensibility inside of Microsoft Identity Lifecycle Manager "2".  With some general knowledge of the Windows Workflow Foundation technology and how it specifically relates to Microsoft Identity Lifecycle Manager "2" you should be able to build the vast number of possible scenarios on top of Microsoft Identity Lifecycle Manager "2".

Finally, the next level of extensibility to look at would be our integration with the Windows Communication Foundation technology.  This is the technology we used to implement our WS-STAR compliant web services.  Since we implemented our web services to be WS-STAR compliant it is not necessary to use Windows Communication Foundation and, if you are familiar with developing web service clients, you could just educate yourself about our protocols.  However, I would recommend looking into the Windows Communication Foundation technology as a way to quickly author web service clients with minimal code.  (Of course I could be biased since I helped to ship that piece of technology in my prior product team.)  The use of Windows Communication Foundation within an Microsoft Identity Lifecycle Manager "2" solution will normally involve writing a custom client to interact with our web service.  I have seen some solutions that required using Windows Communication Foundation to write a custom web service client as part of a Windows Workflow Foundation custom activity that would interact with an external web service to make business logic decisions in managing resources within Microsoft Identity Lifecycle Manager "2".

How do you educate yourself about Windows Communication Foundation?  This is a question similar to how you educate yourself about Windows Workflow Foundation.  These technologies shipped at the same time and there are a number of books available.  The interesting part here is that the books about Windows Communication Foundation often cover the entire technology and focus on writing web services instead of clients.  Writing clients tends to be a small chapter after explaining how to write services.  I do not have any specific book recommendations, but I would recommend trying to find a book that spends some time talking specifically about creating Windows Communication Foundation clients.

As a side note of some significance, there were some important differences between versions 3.0 and 3.5 of Windows Communication Foundation, and we have built Microsoft Identity Lifecycle Manager "2" on top of version 3.5.  In particular, we make use of the WS-SecureConversations standard and make use of those context headers to make our services durable.

I hope this was of some use to you Microsoft Identity Lifecycle Manager 2007 solutions experts looking to transition to Microsoft Identity Lifecycle Manager "2".  I am still hoping to provide more details here about the Microsoft Identity Lifecycle Manager "2" request processing model and Windows Workflow Foundation integration.  Ideally this post will give you some idea of how you can further educate yourself in parallel while you are waiting for me to cover the specific topic of your interest.  (Just as a reminder, if you do have a specific topic of interest please feel free to use my Contact form or by using Comments of any of my posts.)

After the sync with an external connected system completes, such as an HR system, is there an easy process to create/maintain groups based on a specific attribute?  For example, if one of the attributes of the user is CostCenter, how can we automatically create/populate/maintain a group for each value of CostCenter found in the system?

The benefit, of course, is that if a user has the value of their CostCenter change they automatically have their group membership updated and that update is reflected in AD on the next export/sync of the appropriate Management Agents.  Great for role based security!

The great news is that this functionality is extremely easy in the eventual released version of Microsoft Identity Lifecycle Manager "2".  The not so good news is that this dynamic creation of groups is not supported out of box in the current Beta release of Microsoft Identity Lifecycle Manager "2"; however, it is still possible with a little extra coding effort.

Since this is going to be a discussion of a possible solution on top of Microsoft Identity Lifecycle Manager "2", let me satisfy the legal folks here by starting with the following:

Disclaimer:  This posting and any code contained within are provided "AS IS" with no warranties, and confer no rights. Use of included code samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm.

To start this discussion let me first put aside the complex part of the solution, dynamic creation of groups based on attribute values, and start talking about dynamic group membership.  As I mentioned in an earlier post (A Discussion of Computed, Explicit, and Temporal Sets in Microsoft Identity Lifecycle Manager "2") Microsoft Identity Lifecycle Manager "2" supports a variety of set membership concepts.  Although there are differences between Group and Set objects within Microsoft Identity Lifecycle Manager "2", for discussions about membership they can be viewed as synonymous.  This means that Microsoft Identity Lifecycle Manager "2" also supports the same type of memberships for groups as it does for sets.  For this particular post the type of group membership of interest in computed (also referred to as dynamic).

A dynamic group derives its membership from its Filter attribute which is essentially an XPath expression.  As an example, lets say I wanted to create a dynamic group for all users who are in the domain "Domain1".  Looking at the schema for the Person object type in Microsoft Identity Lifecycle Manager "2" there is a string attribute Domain that contains this information.  I could then create a group whose XPath filter was "/Person[Domain='Domain1']".  This group would then populate its membership with every resource in the Microsoft Identity Lifecycle Manager "2" system of type Person that has its Domain attribute set to the value "Domain1".  Further, any new resources of type Person created with Domain set to "Domain1" will be automatically added to this group as part of its creation.  Still further, any existing resource of type Person that is updated to set its Domain attribute to "Domain1" will be automatically added to this group as part of that update.  Finally, any resource of type Person that currently has its Domain attribute set to "Domain1" that is updated to change its Domain attribute to something else will be (as you have probably guessed) automatically removed from this group as part of that update.

Lets look at a bit more complex of a scenario.  Lets say that I wanted to create a dynamic group for all users who report directly to me (have me as there direct manager).  Looking at the schema for the Person object type in Microsoft Identity Lifecycle Manager "2" there is a reference attribute Manager that contains this information.  I could then create a group whose XPath filter was "/Person[Manager='{SomeGuid}']" where "{SomeGuid}" is my Person resource's ObjectID attribute.  Now this, unfortunately, would require that I know my Person resource's ObjectID and GUID's really are not that human friendly (have you ever tried to type one manually?).  It would be nice if I could instead use something else I know to be unique on my Person resource as a way of identifying the Manager value.  With a little bit of understanding of the Person resource we can identify that the AccountName and Domain attribute pair must also be unique.  Luckily those two attributes are strings (much easier to type).  Taking that into consideration, we can now write the following XPath:  "/Person[Manager=/Person[AccountName='markgabarra' and Domain='Domain1']/ObjectID]".  This group would then populate its membership with every resource in the Microsoft Identity Lifecycle Manager "2" system of type Person that has its Manager attribute set to the value of every ObjectID value for every resource in the Microsoft Identity Lifecycle Manager "2" system of type Person that has its AccountName attribute set to the value "markgabarra" and its Domain attribute set to the value of "Domain1".  Assuming that I have correctly identified my AccountName (markgabarra) and my Domain (Domain1), this results in the embedded XPath returning only my Person resource's ObjectID, thus the total XPath results in returning every resource in the Microsoft Identity Lifecycle Manager "2" system of type Person that has its Manager attribute set to my ObjectID.

Now lets look at the scenario mentioned in the question regarding CostCenter.  From the discussion above creating a group for all Person resources in the CostCenter named "Department 100" would involve creating a dynamic group with the filter "/Person[CostCenter='Department 100']".  This answers the question about maintaining (and populating) a group based on a specific attribute since Microsoft Identity Lifecycle Manager "2" will automatically manage the group membership for the lifetime of that group.  This leaves the question of dynamically creating such groups.  To answer this I will have to take a step back and talk conceptually.  Due to schedule and resource constraints the current Beta of Microsoft Identity Lifecycle Manager "2" had to ship without the features needed to support this scenario.  However, those features will be available in the final released version of the product.

As a side note on XPath filters within Microsoft Identity Lifecycle Manager "2" for you administrators and IT Professionals out there, if you are interested in creating a filter of all resources created by a specific person you could use the direct manager example above with some minor changes.  To tell the filter to target "all resources" and not just resources of a specific type you would use the "*" wildcard.  To identify the creator of a resource you would look at the Creator attribute.  In the case of finding all resources that I created (assuming the same AccountName and Domain values for my Person resource above) you would use the following XPath filter:  "/*[Creator=/Person[AccountName='markgabarra' and Domain='Domain1']/ObjectID]".

In an earlier post (AuthN, AuthZ, and Action, oh my: Microsoft Identity Lifecycle Manager "2" Request Processing) I started to detail the different phases of request processing within Microsoft Identity Lifecycle Manager "2".  This post discussed the internal details of these phases but left for a later post the discussion of how scenarios can use these phases to solve specific problems.  For this discussion I will focus on one possible use of the Action phase of request processing to solve the problem of dynamic group creation based on specific attribute values.

Briefly summarizing the relevant content in my previous posts, it is important to know the following:

• All data operations within Microsoft Identity Lifecycle Manager "2" are actually requests to perform the specified operation and the details of each request is available through an Microsoft Identity Lifecycle Manager "2" Request resource
• All requests in Microsoft Identity Lifecycle Manager "2" go through the same phases of Request Processing: Rights Check, Authentication, Authorization, Commit, and Action
• Any phase prior to the Commit phase can deny a request from occurring
• The Authentication, Authorization, and Action phases can execute zero or more Windows Workflow Foundation workflow instances
• The configuration of these Request Processing phases is done through the management of Microsoft Identity Lifecycle Manager "2" ManagementPolicyRule, WorkflowDefinition, and Set resources

The creation of a dynamic group based on the possible values of an attribute can be done in a couple of ways.  Lets look at two possibilities:

1. The attribute in question has a restricted set of possible values enforced through Microsoft Identity Lifecycle Manager "2" schema (e.g. an integer with explicit MinValue and MaxValue, a string with explicit StringRegEx defining an enumerated string, etc)
2. The attribute in question does has an unrestricted set of possible values (it is worth noting that this solution would also work for the above scenario as well and is a more general solution to this problem)

In the first case, I would create a ManagementPolicyRule that would trigger for updates to the specified AttributeTypeDescription resource that contains the attribute's Microsoft Identity Lifecycle Manager "2" schema information (from the question above "/AttributeTypeDescription[SystemName='CostCenter']") and touched the appropriate attribute that restricted the set (from the question above "StringRegEx" since "CostCenter" is a string attribute).  To this ManagementPolicyRule I would attach a single ActionWorkflowDefinition.  This action workflow would perform the following algorithm (notes about what is available and what requires custom code are based on the current Beta of Microsoft Identity Lifecycle Manager "2" and not the final release version):

1. Retrieve the current request (available with the Microsoft Identity Lifecycle Manager "2" CurrentRequestActivity)
2. Inspect the current request's parameters to determine the change to the StringRegEx attribute (requires custom code)
3. Determine the new possible set of filters for dynamic groups for each possible value (requires custom code)
4. For each possible filter value do the following (requires custom code, can use Windows Workflow Foundation WhileActivity or ReplicatorActivity)
1. Query Microsoft Identity Lifecycle Manager "2" for any groups whose filter is the possible value (requires custom code and reentering through the Web Service layer)
2. If above query results in zero results do the following (requires custom code, can use Windows Workflow Foundation IfElseActivity)
1. Create new Microsoft Identity Lifecycle Manager "2" Group resource with appropriate filter (available with the Microsoft Identity Lifecycle Manager "2" CreateResourceActivity)

In the second case, I would create a ManagementPolicyRule that would trigger for all creates and updates of an appropriate set of resources (from the question above "All Persons") where the request touched the specific attribute (from the question above "CostCenter").  To this ManagementPolicyRule I would attach a single ActionWorkflowDefinition.  This action workflow would perform the following algorithm (notes about what is available and what requires custom code are based on the current Beta of Microsoft Identity Lifecycle Manager "2" and not the final release version):

1. Retrieve the current request (available with the Microsoft Identity Lifecycle Manager "2" CurrentRequestActivity)
2. Inspect the current request's parameters to determine the value this request set the key attribute (requires custom code)
3. Determine the new possible filters for the dynamic group for this value (requires custom code)
4. Query Microsoft Identity Lifecycle Manager "2" for any groups whose filter is the possible value (requires custom code and reentering through the Web Service layer)
5. If above query results in zero results do the following (requires custom code, can use Windows Workflow Foundation IfElseActivity)
1. Create new Microsoft Identity Lifecycle Manager "2" Group resource with appropriate filter (available with the Microsoft Identity Lifecycle Manager "2" CreateResourceActivity)

These two approaches will result in the dynamic creation of these groups when new (possible) values are detected for the key attribute.  They do not address the deletion of such groups when those values are no longer available.  This is a bit more complex of a problem, but is possible.  Staying at a very high conceptual level, I would recommend extending the schema of the Microsoft Identity Lifecycle Manager "2" Group resource to add an attribute that can be used to mark these dynamically created groups.  I would then create an Microsoft Identity Lifecycle Manager "2" temporal Set that contains an XPath filter selecting all of these dynamically created groups that were modified in the last 24 hours (I will leave the details of creating a temporal set to another post).  Next, I would create a ManagementPolicyRule that triggered on resources that transitioned into that Set and attach a single ActionWorkflowDefinition.  The action workflow would Use the Microsoft Identity Lifecycle Manager "2" ReadResourceActivity to retrieve the target resource and count the number of values in the ComputedMember attribute.  If that number is zero (meaning the group has zero membership), it would use the Microsoft Identity Lifecycle Manager "2" DeleteResourceActivity to delete the target resource.  This would result in the dynamically created groups deleting themselves shortly after their membership become empty.

The workflow definitions for these two approaches may seem complex and require a number of steps utilizing custom code and (in the case of querying Microsoft Identity Lifecycle Manager "2") reentering the Microsoft Identity Lifecycle Manager "2" Web Service layer from within workflow.  This may be disheartening to some of the potential customers of Microsoft Identity Lifecycle Manager "2"; however, let me provide some good news.  Shortly after the current Beta of Microsoft Identity Lifecycle Manager "2" released I was able to get to the missing features to better support these scenarios with less custom code.  Microsoft Identity Lifecycle Manager "2" will ship with an EnumerateResourcesActivity that will allow workflow developers to set an XPath filter and perform operations on each resource returned (or just use it to get a count of resources that match a specified filter).  Additionally, Microsoft Identity Lifecycle Manager "2" will ship with a ResourceTemplateActivity that can be used to dynamically create a resource based off of a template should a test filter return a count of zero.  In other words, the ResourceTemplateActivity can be used to perform steps 4, 5, and 5.1 in the algorithm of option two, and steps 4.1, 4.2, and 4.2.1 of option one.  The EnumerateResourcesActivity can be used to perform step 4 of option one.  In both options this reduces the amount of custom code to inspecting the contents of the request to calculate the desired filter(s).

This begs the question, how do I write this custom code?  That is a longer topic for multiple follow up posts around the topics of writing custom workflow and/or custom activities.  I will have to leave it for another time, although I am working my way in that direction and I appreciate your patience.  In the mean time, feel free to use my Contact Form or the Comments on my blog to ask questions or suggest topics.