You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/develop/scenario-desktop-acquire-token-wam.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -129,7 +129,7 @@ Applications cannot remove accounts from Windows!
129
129
- Removes app-only (not OS-wide) accounts.
130
130
131
131
>[!NOTE]
132
-
> Ony users can remove OS accounts, whereas apps themselves cannot. If an OS account is passed into `RemoveAsync`, and then `GetAccounts` is called with `ListWindowsWorkAndSchoolAccounts` enabled, the same OS accounts will still be returned.
132
+
> Only users can remove OS accounts, whereas apps themselves cannot. If an OS account is passed into `RemoveAsync`, and then `GetAccounts` is called with `ListWindowsWorkAndSchoolAccounts` enabled, the same OS accounts will still be returned.
|`redirect_uri`| Required | The redirect URI where you want the response to be sent for your app to handle. It must exactly match one of the redirect URIs that you registered in the portal, except that it must be URL-encoded, and it can have additional path segments. |
107
107
|`state`| Recommended | A value that's included in the request that's also returned in the token response. It can be a string of any content that you want. The state is used to encode information about the user's state in the app before the authentication request occurred, such as the page or view they were on. |
108
108
109
-
At this point, Azure AD enforces that only a tenant administrator can sign into complete the request. The administrator will be asked to approve all the direct application permissions that you have requested for your app in the app registration portal.
109
+
At this point, Azure AD enforces that only a tenant administrator can sign in to complete the request. The administrator will be asked to approve all the direct application permissions that you have requested for your app in the app registration portal.
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/concept-azure-ad-connect-sync-declarative-provisioning.md
+12-8Lines changed: 12 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -98,7 +98,7 @@ In the attribute flows there is a setting to determine if multi-valued attribute
98
98
99
99
100
100
101
-
There is also **Merge** and **MergeCaseInsensitive**. These options allow you to merge values from different sources. For example, it can be used to merge the member or proxyAddresses attribute from several different forests. When you use this option, all sync rules in scope for an object must use the same merge type. You cannot define **Update** from one Connector and **Merge** from another. If you try, you receive an error.
101
+
There is also **Merge** and **MergeCaseInsensitive**. These options allow you to merge values from different sources. For example, it can be used to merge the proxyAddresses attribute from several different forests. When you use this option, all sync rules in scope for an object must use the same merge type. You cannot define **Update** from one Connector and **Merge** from another. If you try, you receive an error.
102
102
103
103
The difference between **Merge** and **MergeCaseInsensitive** is how to process duplicate attribute values. The sync engine makes sure duplicate values are not inserted into the target attribute. With **MergeCaseInsensitive**, duplicate values with only a difference in case are not going to be present. For example, you should not see both "SMTP:bob@contoso.com" and "smtp:bob@contoso.com" in the target attribute. **Merge** is only looking at the exact values and multiple values where there only is a difference in case might be present.
104
104
@@ -122,14 +122,20 @@ In *Out to AD - User Exchange hybrid* the following flow can be found:
122
122
This expression should be read as: if the user mailbox is located in Azure AD, then flow the attribute from Azure AD to AD. If not, do not flow anything back to Active Directory. In this case, it would keep the existing value in AD.
123
123
124
124
### ImportedValue
125
-
The function ImportedValue is different than all other functions since the attribute name must be enclosed in quotes rather than square brackets:
125
+
126
+
The function ImportedValue is different than all other functions since the attribute name must be enclosed in quotes rather than square brackets:
127
+
126
128
`ImportedValue("proxyAddresses")`.
127
129
128
-
Usually during synchronization an attribute uses the expected value, even if it hasn’t been exported yet or an error was received during export (“top of the tower”). An inbound synchronization assumes that an attribute that hasn’t yet reached a connected directory eventually reaches it. In some cases, it is important to only synchronize a value that has been confirmed by the connected directory (“hologram and delta import tower”).
130
+
Inbound synchronization has a concept of assuming that an attribute that hasn’t yet reached a connected directory will eventually reach it at some point so, normally, synchronization gets an attribute value from the respective connector space, even if it hasn’t been yet exported or an error occurred during export.
131
+
In some cases, however, it is important to only synchronize a value that has been exported and confirmed during import from the connected directory. This function can be found in multiple “In From AD/AAD” out-of-box transformation rules where the attribute should only be synchronized when it has been confirmed that the value was exported successfully.
132
+
133
+
An example of this function can be found in the out-of-box Synchronization Rule *In from AD – User Common from Exchange*, for ProxyAddresses attribute flow with Hybrid Exchange. E.g., when a user’s ProxyAddresses is added, the ImportedValue function will only return the new value after it has been confirmed from the following import step:
129
134
130
-
An example of this function can be found in the out-of-box Synchronization Rule *In from AD – User Common from Exchange*. In Hybrid Exchange, the value added by Exchange online should only be synchronized when it has been confirmed that the value was exported successfully:
This function is required when the target directory might change or discard an exported attribute value silently, and we want the synchronization to only process confirmed attribute values.
138
+
133
139
## Precedence
134
140
When several sync rules try to contribute the same attribute value to the target, the precedence value is used to determine the winner. The rule with highest precedence, lowest numeric value, is going to contribute the attribute in a conflict.
135
141
@@ -140,11 +146,9 @@ This ordering can be used to define more precise attribute flows for a small sub
140
146
Precedence can be defined between Connectors. That allows Connectors with better data to contribute values first.
141
147
142
148
### Multiple objects from the same connector space
143
-
If you have several objects in the same connector space joined to the same metaverse object, precedence must be adjusted. If several objects are in scope of the same sync rule, then the sync engine is not able to determine precedence. It is ambiguous which source object should contribute the value to the metaverse. This configuration is reported as ambiguous even if the attributes in the source have the same value.
144
-
149
+
It is not possible to have several objects in the same connector space joined to the same metaverse object. This configuration is reported as ambiguous even if the attributes in the source have the same value.
145
150
146
-
For this scenario, you need to change the scope of the sync rules so the source objects have different sync rules in scope. That allows you to define different precedence.
147
-
151
+
148
152
149
153
## Next steps
150
154
* Read more about the expression language in [Understanding Declarative Provisioning Expressions](concept-azure-ad-connect-sync-declarative-provisioning-expressions.md).
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-group-writeback-v2.md
-5Lines changed: 0 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -136,11 +136,6 @@ These limitations and known issues are specific to group writeback:
136
136
- Nested cloud groups that are members of writeback enabled groups must also be enabled for writeback to remain nested in AD.
137
137
- Group Writeback setting to manage new security group writeback at scale is not yet available. You will need to configure writeback for each group.
138
138
139
-
If you have a nested group like this, you'll see an export error in Azure AD Connect with the message "A universal group cannot have a local group as a member." The resolution is to remove the member with the **Domain local** scope from the Azure AD group, or update the nested group member scope in Active Directory to **Global** or **Universal**.
140
-
- Group writeback supports writing back groups to only a single organizational unit (OU). After the feature is enabled, you can't change the OU that you selected. A workaround is to disable group writeback entirely in Azure AD Connect and then select a different OU when you re-enable the feature.
141
-
- Nested cloud groups that are members of writeback-enabled groups must also be enabled for writeback to remain nested in Active Directory.
142
-
- A group writeback setting to manage new security group writeback at scale is not yet available. You need to configure writeback for each group.
143
-
144
139
## Next steps
145
140
146
141
-[Modify Azure AD Connect group writeback default behavior](how-to-connect-modify-group-writeback.md)
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-sync-configure-filtering.md
+11-13Lines changed: 11 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ This article covers how to configure the different filtering methods.
34
34
## Basics and important notes
35
35
In Azure AD Connect sync, you can enable filtering at any time. If you start with a default configuration of directory synchronization and then configure filtering, the objects that are filtered out are no longer synchronized to Azure AD. Because of this change, any objects in Azure AD that were previously synchronized but were then filtered are deleted in Azure AD.
36
36
37
-
Before you start making changes to filtering, make sure that you [disable the scheduled task](#disable-the-scheduled-task) so you don't accidentally export changes that you haven't yet verified to be correct.
37
+
Before you start making changes to filtering, make sure that you [disable the built-in scheduler](#disable-the-synchronization-scheduler) so you don't accidentally export changes that you haven't yet verified to be correct.
38
38
39
39
Because filtering can remove many objects at the same time, you want to make sure that your new filters are correct before you start exporting any changes to Azure AD. After you've completed the configuration steps, we strongly recommend that you follow the [verification steps](#apply-and-verify-changes) before you export and make changes to Azure AD.
40
40
@@ -50,23 +50,21 @@ The filtering configuration is retained when you install or upgrade to a newer v
50
50
51
51
If you have more than one forest, then you must apply the filtering configurations that are described in this topic to every forest (assuming that you want the same configuration for all of them).
52
52
53
-
### Disable the scheduled task
53
+
### Disable the synchronization scheduler
54
54
To disable the built-in scheduler that triggers a synchronization cycle every 30 minutes, follow these steps:
55
55
56
-
1. Go to a PowerShell prompt.
57
-
2. Run `Set-ADSyncScheduler -SyncCycleEnabled $False` to disable the scheduler.
58
-
3. Make the changes that are documented in this article.
59
-
4. Run `Set-ADSyncScheduler -SyncCycleEnabled $True` to enable the scheduler again.
56
+
1. Open Windows Powershell, import the ADSync module and disable the scheduler using the follwoing commands
60
57
61
-
**If you use an Azure AD Connect build before 1.1.105.0**
62
-
To disable the scheduled task that triggers a synchronization cycle every three hours, follow these steps:
58
+
```Powershell
59
+
import-module ADSync
60
+
Set-ADSyncScheduler -SyncCycleEnabled $False
61
+
```
63
62
64
-
1. Start **Task Scheduler** from the **Start** menu.
65
-
2. Directly under **Task Scheduler Library**, find the task named **Azure AD Sync Scheduler**, right-click, and select **Disable**.
0 commit comments