Skip to content

Commit 124fa04

Browse files
TrishaMcTrishaMc
authored
Merge pull request #52790 from mahesh-unnikrishnan/master
New article on scoped sync.
2 parents 612b494 + d0b5721 commit 124fa04

File tree

2 files changed

+163
-0
lines changed

2 files changed

+163
-0
lines changed

‎articles/active-directory-domain-services/TOC.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
### [Create a group managed service account on a managed domain](active-directory-ds-create-gmsa.md)
4545
### [Administer group policy on a managed domain](active-directory-ds-admin-guide-administer-group-policy.md)
4646
### [Configure password polices on a managed domain](active-directory-ds-password-policy.md)
47+
### [Configure scoped synchronization from Azure AD to a managed domain](active-directory-ds-scoped-synchronization.md)
4748
## [Select a virtual network](active-directory-ds-networking.md)
4849
## Deploy applications
4950
### [Configure support for profile synchronization for SharePoint Server](active-directory-ds-enable-sharepoint-profile-sync.md)

‎articles/active-directory-domain-services/active-directory-ds-scoped-synchronization.md

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
---
2+
title: 'Azure Active Directory Domain Services: Scoped synchronization | Microsoft Docs'
3+
description: Configure scoped synchronization from Azure AD to your managed domains
4+
services: active-directory-ds
5+
documentationcenter: ''
6+
author: mahesh-unnikrishnan
7+
manager: mtillman
8+
editor: curtand
9+
10+
ms.assetid: 9389cf0f-0036-4b17-95da-80838edd2225
11+
ms.service: active-directory
12+
ms.component: domains
13+
ms.workload: identity
14+
ms.tgt_pltfrm: na
15+
ms.devlang: na
16+
ms.topic: article
17+
ms.date: 09/19/2018
18+
ms.author: maheshu
19+
20+
---
21+
# Configure scoped synchronization from Azure AD to your managed domain
22+
This article shows you how to configure only specific user accounts to be synchronized from your Azure AD directory to your Azure AD Domain Services managed domain.
23+
24+
25+
## Group-based scoped synchronization
26+
By default, all users and groups within your Azure AD directory are synchronized to your managed domain. If the managed domain is being used only by a few users, you may prefer to synchronize only those user accounts to the managed domain. Group-based scoped synchronization enables you to do so. When configured, only user accounts belonging to the groups you've specified are synchronized to the managed domain.
27+
28+
29+
## Get started: Install the required PowerShell modules
30+
31+
### Install and configure Azure AD PowerShell
32+
Follow the instructions in the article to [install the Azure AD PowerShell module and connect to Azure AD](https://docs.microsoft.com/powershell/azure/active-directory/install-adv2?toc=%2fazure%2factive-directory-domain-services%2ftoc.json).
33+
34+
### Install and configure Azure PowerShell
35+
Follow the instructions in the article to [install the Azure PowerShell module and connect to your Azure subscription](https://docs.microsoft.com/powershell/azure/install-azurerm-ps?toc=%2fazure%2factive-directory-domain-services%2ftoc.json).
36+
37+
38+
39+
## Enable group-based scoped synchronization
40+
Complete the following steps to configure group-based scoped synchronization to your managed domain:
41+
42+
1. Select the groups you want to sync and provide the display name of the groups you want synchronized to your managed domain.
43+
44+
2. Save the script in the following section to a file called ```Select-GroupsToSync.ps1```. Execute the script like below:
45+
46+
```powershell
47+
.\Select-GroupsToSync.ps1 -groupsToAdd @(“GroupName1”, “GroupName2”)
48+
```
49+
50+
3. Now, enable group-based scoped synchronization for the managed domain.
51+
52+
```powershell
53+
// Login to your Azure AD tenant
54+
Login-AzureRmAccount
55+
56+
// Retrieve the Azure AD Domain Services resource.
57+
$DomainServicesResource = Get-AzureRmResource -ResourceType "Microsoft.AAD/DomainServices"
58+
59+
// Enable group-based scoped synchronization.
60+
$enableScopedSync = @{"filteredSync" = "Enabled"}
61+
62+
Set-AzureRmResource -Id $DomainServicesResource.ResourceId -Properties $enableScopedSync
63+
```
64+
65+
## Disable group-based scoped synchronization
66+
Use the following PowerShell script to disable group-based scoped synchronization for your managed domain:
67+
68+
```powershell
69+
// Login to your Azure AD tenant
70+
Login-AzureRmAccount
71+
72+
// Retrieve the Azure AD Domain Services resource.
73+
$DomainServicesResource = Get-AzureRmResource -ResourceType "Microsoft.AAD/DomainServices"
74+
75+
// Disable group-based scoped synchronization.
76+
$disableScopedSync = @{"filteredSync" = "Disabled"}
77+
78+
Set-AzureRmResource -Id $DomainServicesResource.ResourceId -Properties $disableScopedSync
79+
```
80+
81+
## Script to select groups to synchronize to the managed domain (Select-GroupsToSync.ps1)
82+
Save the following script to a file (```Select-GroupsToSync.ps1```). This script configures Azure AD Domain Services to synchronize selected groups to the managed domain. All user accounts belonging to the specified groups will be synchronized to the managed domain.
83+
84+
```powershell
85+
param (
86+
[Parameter(Position = 0)]
87+
[String[]]$groupsToAdd
88+
)
89+
90+
Connect-AzureAD
91+
$sp = Get-AzureADServicePrincipal -Filter "AppId eq '2565bd9d-da50-47d4-8b85-4c97f669dc36'"
92+
$role = $sp.AppRoles | where-object -FilterScript {$_.DisplayName -eq "User"}
93+
94+
Write-Output "`n****************************************************************************"
95+
96+
Write-Output "Total group-assignments need to be added: $($groupsToAdd.Count)"
97+
$newGroupIds = New-Object 'System.Collections.Generic.HashSet[string]'
98+
foreach ($groupName in $groupsToAdd)
99+
{
100+
try
101+
{
102+
$group = Get-AzureADGroup -Filter "DisplayName eq '$groupName'"
103+
$newGroupIds.Add($group.ObjectId)
104+
105+
Write-Output "Group-Name: $groupName, Id: $($group.ObjectId)"
106+
}
107+
catch
108+
{
109+
Write-Error "Failed to find group: $groupName. Exception: $($_.Exception)."
110+
}
111+
}
112+
113+
Write-Output "****************************************************************************`n"
114+
Write-Output "`n****************************************************************************"
115+
116+
$currentAssignments = Get-AzureADServiceAppRoleAssignment -ObjectId $sp.ObjectId
117+
Write-Output "Total current group-assignments: $($currentAssignments.Count), SP-ObjectId: $($sp.ObjectId)"
118+
119+
$currAssignedObjectIds = New-Object 'System.Collections.Generic.HashSet[string]'
120+
foreach ($assignment in $currentAssignments)
121+
{
122+
Write-Output "Assignment-ObjectId: $($assignment.PrincipalId)"
123+
124+
if ($newGroupIds.Contains($assignment.PrincipalId) -eq $false)
125+
{
126+
Write-Output "This assignment is not needed anymore. Removing it! Assignment-ObjectId: $($assignment.PrincipalId)"
127+
Remove-AzureADServiceAppRoleAssignment -ObjectId $sp.ObjectId -AppRoleAssignmentId $assignment.ObjectId
128+
}
129+
else
130+
{
131+
$currAssignedObjectIds.Add($assignment.PrincipalId)
132+
}
133+
}
134+
135+
Write-Output "****************************************************************************`n"
136+
Write-Output "`n****************************************************************************"
137+
138+
foreach ($id in $newGroupIds)
139+
{
140+
try
141+
{
142+
if ($currAssignedObjectIds.Contains($id) -eq $false)
143+
{
144+
Write-Output "Adding new group-assignment. Role-Id: $($role.Id), Group-Object-Id: $id, ResourceId: $($sp.ObjectId)"
145+
New-AzureADGroupAppRoleAssignment -Id $role.Id -ObjectId $id -PrincipalId $id -ResourceId $sp.ObjectId
146+
}
147+
else
148+
{
149+
Write-Output "Group-ObjectId: $id is already assigned."
150+
}
151+
}
152+
catch
153+
{
154+
Write-Error "Exception occured assigning Object-ID: $id. Exception: $($_.Exception)."
155+
}
156+
}
157+
158+
Write-Output "****************************************************************************`n"
159+
```
160+
161+
## Next steps
162+
* [Understand synchronization in Azure AD Domain Services](active-directory-ds-synchronization.md)

0 commit comments

Comments
 (0)