Office365 Cloud Group Membership Management with Windows PowerShell Connector for FIM 2010 R2
Summary
Utilizing the Windows PowerShell connector for FIM 2010 R2 it is possible to manage group membership of cloud-based (not synchronized) groups within Office365 that exceed 15,000 members. This guide will show the basics of utilizing the PowerShell connector to create a management agent that imports users and groups for metaverse synchronization and also exporting of a multivalued reference attribute of the members of the group back to the cloud based group.
Metaverse Requirements
The metaverse objects for users must contain the base-64 encoded string attribute of the Active Directory user objectGUID attribute. This is commonly referred to as sourceAnchor or ImmutableID. This attribute is used to join the Office365 user to the Active Directory user. The how-to of synchronizing this attribute to the metaverse is outside the scope of this document.
The metaverse objects for groups must contain the accountName/displayName of the Active Directory user sAMAccountName attribute. This attribute is used to join the Office365 group to the Active Directory group. The member attribute must also be imported into the metaverse so that the members can be synchronized to the Office365 group and exported to Windows Azure Active Directory (WAAD).
Configuration
To create the connector described in this section, configure the tabs in the Management Agent Designer as described in the Windows PowerShell Connector for FIM 2010 R2 Technical Reference.
Connectivity
Parameter | Value | |
Server | <blank> | |
Domain | <blank> | |
User | <UserAdmin>@<domain>.onmicrosoft.com | |
Password | <password> | |
Impersonate Connector Account | Unchecked | |
Load User Profile When Impersonating | Unchecked | |
Logon Type When Impersonating | None | |
Signed Scripts Only | Unchecked | |
Common Module Script Name (with extension) | FIM.O365.psm1 | |
Common Module Script | Paste FIM.O365.ps1m code | |
Validation Script | <blank> | |
Schema Script | Past FIM.O365.Schema.ps1 code | |
Additional Config Parameter Names | <blank> | |
Additional Encrypted Config Parameter Names | <blank> |
Capabilities
Note: The Distinguished Name Style is Ldap because currently there is a bug (as of April 8th, 2014) with the PowerShell connector where selecting None produces an error that does not allow the management agent to be created.
Parameter | Value | |
Distinguished Name Style | Ldap | |
Export Type | AttributeUpdate | |
Data Normalization | None | |
Object Confirmation | Normal | |
Use DN as Anchor | Checked | |
Concurrent Operations of Several Connectors | Checked | |
Partitions | Unchecked | |
Hierarchy | Unchecked | |
Enable Import | Checked | |
Enable Delta Import | Unchecked | |
Enable Export | Checked | |
Enable Full Export | Unchecked | |
No Reference Values In First Export Pass | Unchecked | |
Enable Object Rename | Unchecked | |
Delete-Add As Replace | Unchecked | |
Enable Password Operations | Unchecked | |
Enable Export Password in First Pass | Unchecked |
Global Parameters
Parameter | Value | |
Partition Script | <blank> | |
Hierarchy Script | <blank> | |
Begin Import Script | Paste FIM.O365.Import.Begin.ps1 code | |
Import Script | Paste FIM.O365.Import.ps1 code | |
End Import Script | Paste FIM.O365.Import.End.ps1 code | |
Begin Export Script | Paste FIM.O365.Export.Begin.ps1 code | |
Export Script | Paste FIM.O365.Export.ps1 code | |
End Export Script | <blank> | |
Begin Password Script | <blank> | |
Password Extension Script | <blank> | |
End Password Script | <blank> |
Configure Provisioning Hierarchy
Configure the hierarchy with no mapping as shown below.
Select Object Types
Select the user and group object types as show below.
Select Attributes
Select each of the attributes (DisplayName, ImmutableId, Member, ObjectID, UserPrincipalName) as show below.
Configure Join and Projection Rules
User objects are matched to the metaverse person object by the ImmutableID (cs) to sourceAnchor (mv) attribute as shown below.
Group objects are matches to the metaverse group object by DisplayName (cs) to accountName (mv) attribute as shown below.
Configure Attribute Flow
Configure the group export of the member attribute as shown below.
Run Profiles
Once the connector has been created, create three run profiles:
- Full Import (Stage Only)
- Full Synchronization
- Export
PowerShell Scripts
FIM.O365.psm1
|
FIM.O365.Schema.ps1
|
FIM.O365.Import.Begin.ps1
|
FIM.O365.Import.ps1
|
FIM.O365.Import.End.ps1
|
FIM.O365.Export.Begin.ps1
|
FIM.O365.Export.ps1
|
See Also
- Windows PowerShell Connector for FIM 2010 R2 Technical Reference
- Forefront Identity Manager 2010 TechNet Forum
- FIM Community Information Center