Skip to content

Commit 1deaa95

Browse files
ktoliverktoliver
authored
Merge pull request #96947 from billmath/cprelease
staging content
2 parents 5e64fc1 + 117e9d1 commit 1deaa95

File tree

108 files changed

+3014
-3
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

108 files changed

+3014
-3
lines changed

‎articles/active-directory/cloud-provisioning/TOC.yml

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
- name: Cloud provisioning
2+
href: index.yml
3+
- name: Overview
4+
items:
5+
- name: What is identity provisioning?
6+
href: what-is-provisioning.md
7+
- name: What is Azure AD Connect cloud provisioning?
8+
href: what-is-cloud-provisioning.md
9+
maintainContext: true
10+
- name: Tutorials
11+
expanded: true
12+
items:
13+
- name: Integrate a single AD forest with a single Azure AD tenant
14+
href: tutorial-single-forest.md
15+
- name: Integrate an existing forest and a new forest with a single Azure AD tenant
16+
href: tutorial-existing-forest.md
17+
- name: Pilot cloud provisioning for an existing synced AD forest
18+
href: tutorial-pilot-aadc-aadccp.md
19+
20+
21+
22+
23+
24+
- name: Concepts
25+
items:
26+
- name: What is password hash sync?
27+
href: /azure/active-directory/hybrid/whatis-phs?context=azure/active-directory/cloud-provisioning/context/cloud-provisioning-context
28+
- name: Understanding the Azure AD schema, attributes, and expressions
29+
href: concept-attributes.md
30+
- name: Writing Expressions for Attribute Mappings in Azure Active Directory
31+
href: reference-expressions.md
32+
33+
34+
35+
- name: How-to guides
36+
items:
37+
- name: Installation and upgrade
38+
items:
39+
- name: Installation Prerequisites
40+
href: how-to-prerequisites.md
41+
- name: Install the Azure AD Connect cloud provisioning agent
42+
href: how-to-install.md
43+
- name: Cloud provisioning configuration
44+
href: how-to-configure.md
45+
- name: Plan and design
46+
items:
47+
- name: Topologies and scenarios for Azure AD Connect cloud provisioning
48+
href: plan-cloud-provisioning-topologies.md
49+
50+
51+
- name: Manage
52+
items:
53+
- name: Agent automatic upgrade
54+
href: how-to-automatic-upgrade.md
55+
- name: Develop
56+
items:
57+
- name: Transformations
58+
href: how-to-transformation.md
59+
- name: Azure AD synchronization API
60+
href: https://docs.microsoft.com/graph/api/resources/synchronization-overview
61+
62+
- name: Troubleshoot
63+
items:
64+
- name: Troubleshoot cloud provisioning
65+
href: how-to-troubleshoot.md
66+
- name: Duplicate attributes
67+
href: https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync
68+
69+
- name: Reference
70+
items:
71+
- name: Azure AD Connect cloud provisioning agent version history
72+
href: /azure/active-directory/manage-apps/provisioning-agent-release-version-history?context=azure/active-directory/cloud-provisioning/context/cp-context
73+
- name: Azure AD Connect cloud provisioning FAQ
74+
href: reference-cloud-provisioning-faq.md
75+
- name: Attributes that are synchronized
76+
href: /azure/active-directory/hybrid/reference-connect-sync-attributes-synchronized?context=azure/active-directory/cloud-provisioning/context/cp-context
77+
- name: Basic Active Directory and Azure AD environment
78+
href: tutorial-basic-ad-azure.md
79+

‎articles/active-directory/cloud-provisioning/bread/toc.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
- name: Azure
2+
tocHref: /azure/
3+
topicHref: /azure/index
4+
items:
5+
- name: Active Directory
6+
tocHref: /azure/active-directory/manage-apps/
7+
topicHref: /azure/active-directory/index
8+
items:
9+
- name: Cloud provisioning
10+
tocHref: /azure/active-directory/manage-apps/
11+
topicHref: /azure/active-directory/cloud-provisioning/index
12+
13+
- name: Azure
14+
tocHref: /azure/
15+
topicHref: /azure/index
16+
items:
17+
- name: Active Directory
18+
tocHref: /azure/active-directory/hybrid/
19+
topicHref: /azure/active-directory/index
20+
items:
21+
- name: Cloud provisioning
22+
tocHref: /azure/active-directory/hybrid/
23+
topicHref: /azure/active-directory/cloud-provisioning/index
24+

‎articles/active-directory/cloud-provisioning/concept-attributes.md

Lines changed: 250 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,250 @@
1+
---
2+
title: 'Understanding the Azure AD schema and custom expressions'
3+
description: This topic describes the Azure AD schema, the attributes that the provisioning agent flows and custom expressions.
4+
services: active-directory
5+
documentationcenter: ''
6+
author: billmath
7+
manager: daveba
8+
editor: ''
9+
ms.service: active-directory
10+
ms.devlang: na
11+
ms.topic: conceptual
12+
ms.tgt_pltfrm: na
13+
ms.workload: identity
14+
ms.date: 12/02/2019
15+
ms.subservice: hybrid
16+
ms.author: billmath
17+
18+
ms.collection: M365-identity-device-management
19+
---
20+
21+
22+
# Understanding the Azure AD schema
23+
An object in Azure AD, like any directory, is a programmatic high-level data construct that represents such things as users, groups, and contacts. When you create a new user or contact in Azure AD, you are creating a new instance of that object. These instances can be differentiated based on their properties.
24+
25+
Properties, in Azure AD are the elements responsible for storing information about an instance of an object in Azure AD.
26+
27+
The Azure AD schema defines the rules for which properties may be used in an entry, the kinds of values that those properties may have, and how users may interact with those values.
28+
29+
Azure AD has two types of properties. The properties are:
30+
- **Built in properties** – Properties that are pre-defined by the Azure AD schema. These properties provide different uses and may or may not be accessible.
31+
- **Directory extensions** – Properties that are provided so that you can customize Azure AD for your own use. For example, if you have extended your on-premises Active Directory with a certain attribute and want to flow that attribute, you can use one of the custom properties that are provided.
32+
33+
## Attributes and expressions
34+
When an object, such as a user is provisioned to Azure AD, a new instance of the user object is created. This creation includes the properties of that object, which are also known as attributes. Initially, the newly created object will have its attributes set to values that are determined by the synchronization rules. These attributes are then kept up to date via the cloud provisioning agent.
35+
36+
![](media/concept-attributes/attribute1.png)
37+
38+
For example, if a user is part of the Marketing department, their Azure AD department attribute will initially be created when they are provisioned and then the value would be set to Marketing. But then, six months later, they change to Sales. Their on-premises AD department attribute is changed to Sales. This change will then synchronize to Azure AD and be reflected on their Azure AD user object.
39+
40+
Attribute synchronization may be either direct, where the value in Azure AD is directly set to the value of the on-premises attribute. Or, there may be a programmatic expression that handles this synchronization. A programmatic expression would be needed in cases where some logic or a determination needed to be made in order to populate the value.
41+
42+
For example, if I had my mail attribute ("[email protected]") and I needed to strip out the "@contoso.com" portion and flow just the value "john.smith" I would use something like this:
43+
44+
`Replace([mail], "@contoso.com", , ,"", ,)`
45+
46+
**Sample input / output:** <br>
47+
48+
* **INPUT** (mail): "[email protected]"
49+
* **OUTPUT**: "john.smith"
50+
51+
For additional information, on writing custom expressions, and the syntax see [Writing Expressions for Attribute Mappings in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/manage-apps/functions-for-customizing-application-data).
52+
53+
The following list are common attributes and how they are synchronized to Azure AD.
54+
55+
56+
|On-premises Active Directory|Mapping Type|Azure AD|
57+
|-----|-----|-----|
58+
|cn|Direct|commonName
59+
|countryCode|Direct|countryCode|
60+
|displayName|Direct|displayName|
61+
|givenName|Expression|givenName|
62+
|objectGUID|Direct|sourceAnchorBinary|
63+
|userprincipalName|Direct|userPrincipalName|
64+
|ProxyAdress|Direct|ProxyAddress|
65+
66+
## Viewing the schema
67+
In order to view the schema and verify it, do the following steps:
68+
69+
1. Navigate to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer).
70+
2. Sign in with your global administrator account
71+
3. On the left, click **modify permissions** and ensure that **Directory.ReadWrite.All** is Consented.
72+
4. Run the following query: https://graph.microsoft.com/beta/serviceprincipals/. This query will return a list of service principals.
73+
5. Locate "appDisplayName": "Active Directory to Azure Active Directory Provisioning" and note the "id:" value.
74+
```
75+
"value": [
76+
{
77+
"id": "00d41b14-7958-45ad-9d75-d52fa29e02a1",
78+
"deletedDateTime": null,
79+
"accountEnabled": true,
80+
"appDisplayName": "Active Directory to Azure Active Directory Provisioning",
81+
"appId": "1a4721b3-e57f-4451-ae87-ef078703ec94",
82+
"applicationTemplateId": null,
83+
"appOwnerOrganizationId": "47df5bb7-e6bc-4256-afb0-dd8c8e3c1ce8",
84+
"appRoleAssignmentRequired": false,
85+
"displayName": "Active Directory to Azure Active Directory Provisioning",
86+
"errorUrl": null,
87+
"homepage": "https://account.activedirectory.windowsazure.com:444/applications/default.aspx?metadata=AD2AADProvisioning|ISV9.1|primary|z",
88+
"loginUrl": null,
89+
"logoutUrl": null,
90+
"notificationEmailAddresses": [],
91+
"preferredSingleSignOnMode": null,
92+
"preferredTokenSigningKeyEndDateTime": null,
93+
"preferredTokenSigningKeyThumbprint": null,
94+
"publisherName": "Active Directory Application Registry",
95+
"replyUrls": [],
96+
"samlMetadataUrl": null,
97+
"samlSingleSignOnSettings": null,
98+
"servicePrincipalNames": [
99+
"http://adapplicationregistry.onmicrosoft.com/adprovisioningtoaad/primary",
100+
"1a4721b3-e57f-4451-ae87-ef078703ec94"
101+
],
102+
"signInAudience": "AzureADMultipleOrgs",
103+
"tags": [
104+
"WindowsAzureActiveDirectoryIntegratedApp"
105+
],
106+
"addIns": [],
107+
"api": {
108+
"resourceSpecificApplicationPermissions": []
109+
},
110+
"appRoles": [
111+
{
112+
"allowedMemberTypes": [
113+
"User"
114+
],
115+
"description": "msiam_access",
116+
"displayName": "msiam_access",
117+
"id": "a0326856-1f51-4311-8ae7-a034d168eedf",
118+
"isEnabled": true,
119+
"origin": "Application",
120+
"value": null
121+
}
122+
],
123+
"info": {
124+
"termsOfServiceUrl": null,
125+
"supportUrl": null,
126+
"privacyStatementUrl": null,
127+
"marketingUrl": null,
128+
"logoUrl": null
129+
},
130+
"keyCredentials": [],
131+
"publishedPermissionScopes": [
132+
{
133+
"adminConsentDescription": "Allow the application to access Active Directory to Azure Active Directory Provisioning on behalf of the signed-in user.",
134+
"adminConsentDisplayName": "Access Active Directory to Azure Active Directory Provisioning",
135+
"id": "d40ed463-646c-4efe-bb3e-3fa7d0006688",
136+
"isEnabled": true,
137+
"type": "User",
138+
"userConsentDescription": "Allow the application to access Active Directory to Azure Active Directory Provisioning on your behalf.",
139+
"userConsentDisplayName": "Access Active Directory to Azure Active Directory Provisioning",
140+
"value": "user_impersonation"
141+
}
142+
],
143+
"passwordCredentials": []
144+
},
145+
```
146+
6. Replace the {Service Principal id} with your value and run the following query: `https://graph.microsoft.com/beta/serviceprincipals/{Service Principal id}/synchronization/jobs/`
147+
7. Locate the "id": "AD2AADProvisioning.fd1c9b9e8077402c8bc03a7186c8f976" section and note the "id:".
148+
```
149+
{
150+
"id": "AD2AADProvisioning.fd1c9b9e8077402c8bc03a7186c8f976",
151+
"templateId": "AD2AADProvisioning",
152+
"schedule": {
153+
"expiration": null,
154+
"interval": "PT2M",
155+
"state": "Active"
156+
},
157+
"status": {
158+
"countSuccessiveCompleteFailures": 0,
159+
"escrowsPruned": false,
160+
"code": "Active",
161+
"lastSuccessfulExecutionWithExports": null,
162+
"quarantine": null,
163+
"steadyStateFirstAchievedTime": "2019-11-08T15:48:05.7360238Z",
164+
"steadyStateLastAchievedTime": "2019-11-20T16:17:24.7957721Z",
165+
"troubleshootingUrl": "",
166+
"lastExecution": {
167+
"activityIdentifier": "2dea06a7-2960-420d-931e-f6c807ebda24",
168+
"countEntitled": 0,
169+
"countEntitledForProvisioning": 0,
170+
"countEscrowed": 15,
171+
"countEscrowedRaw": 15,
172+
"countExported": 0,
173+
"countExports": 0,
174+
"countImported": 0,
175+
"countImportedDeltas": 0,
176+
"countImportedReferenceDeltas": 0,
177+
"state": "Succeeded",
178+
"error": null,
179+
"timeBegan": "2019-11-20T16:15:21.116098Z",
180+
"timeEnded": "2019-11-20T16:17:24.7488681Z"
181+
},
182+
"lastSuccessfulExecution": {
183+
"activityIdentifier": null,
184+
"countEntitled": 0,
185+
"countEntitledForProvisioning": 0,
186+
"countEscrowed": 0,
187+
"countEscrowedRaw": 0,
188+
"countExported": 5,
189+
"countExports": 0,
190+
"countImported": 0,
191+
"countImportedDeltas": 0,
192+
"countImportedReferenceDeltas": 0,
193+
"state": "Succeeded",
194+
"error": null,
195+
"timeBegan": "0001-01-01T00:00:00Z",
196+
"timeEnded": "2019-11-20T14:09:46.8855027Z"
197+
},
198+
"progress": [],
199+
"synchronizedEntryCountByType": [
200+
{
201+
"key": "group to Group",
202+
"value": 33
203+
},
204+
{
205+
"key": "user to User",
206+
"value": 3
207+
}
208+
]
209+
},
210+
"synchronizationJobSettings": [
211+
{
212+
"name": "Domain",
213+
"value": "{\"DomainFQDN\":\"contoso.com\",\"DomainNetBios\":\"CONTOSO\",\"ForestFQDN\":\"contoso.com\",\"ForestNetBios\":\"CONTOSO\"}"
214+
},
215+
{
216+
"name": "DomainFQDN",
217+
"value": "contoso.com"
218+
},
219+
{
220+
"name": "DomainNetBios",
221+
"value": "CONTOSO"
222+
},
223+
{
224+
"name": "ForestFQDN",
225+
"value": "contoso.com"
226+
},
227+
{
228+
"name": "ForestNetBios",
229+
"value": "CONTOSO"
230+
},
231+
{
232+
"name": "QuarantineTooManyDeletesThreshold",
233+
"value": "500"
234+
}
235+
]
236+
}
237+
```
238+
8. Now run the following query: `https://graph.microsoft.com/beta/serviceprincipals/{Service Principal Id}/synchronization/jobs/{AD2AAD Provisioning id}/schema`
239+
240+
Example: https://graph.microsoft.com/beta/serviceprincipals/653c0018-51f4-4736-a3a3-94da5dcb6862/synchronization/jobs/AD2AADProvisioning.e9287a7367e444c88dc67a531c36d8ec/schema
241+
242+
Replace the {Service Principal Id} and {AD2ADD Provisioning Id} with your values.
243+
244+
9. This query will return the schema.
245+
![](media/concept-attributes/schema1.png)
246+
247+
## Next steps
248+
249+
- [What is provisioning?](what-is-provisioning.md)
250+
- [What is Azure AD Connect cloud provisioning?](what-is-cloud-provisioning.md)

‎articles/active-directory/cloud-provisioning/context/cp-context.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
### YamlMime:ContextObject
2+
brand: azure
3+
breadcrumb_path: ../bread/toc.yml
4+
toc_rel: ../TOC.yml

0 commit comments

Comments
 (0)