You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-sync-endpoint-api-v2.md
+36-36Lines changed: 36 additions & 36 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,14 @@
1
1
---
2
2
title: 'Azure AD Connect sync V2 endpoint public preview | Microsoft Docs'
3
-
description: This topic documents updates to the Azure AD connect sync endpoints.
3
+
description: This document covers updates to the Azure AD connect sync v2 endpoints API.
4
4
services: active-directory
5
5
author: billmath
6
6
manager: daveba
7
7
editor: ''
8
8
ms.service: active-directory
9
9
ms.workload: identity
10
10
ms.topic: conceptual
11
-
ms.date: 05/15/2020
11
+
ms.date: 05/18/2020
12
12
ms.subservice: hybrid
13
13
ms.author: billmath
14
14
ms.collection: M365-identity-device-management
@@ -25,40 +25,40 @@ Microsoft has deployed a new endpoint (API) for Azure AD Connect that improves t
25
25
In order to use the new V2 endpoint, you will need to use [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later and follow the deployment steps provided below to enable the V2 endpoint for your Azure AD Connect server.
26
26
27
27
### Public preview limitations
28
-
While this release has undergone extensive testing during multiple rounds of private preview releases you may still encounter issues. One of the goals of this public preview release is to find and fix any such issues.
28
+
While this release has undergone extensive testing, you may still encounter issues. One of the goals of this public preview release is to find and fix any such issues.
29
29
30
30
>[!IMPORTANT]
31
-
> While we provide support for this public preview release, we may not always be able to fix any issues you may encounter in a timely fashion, depending on the support requirements of your organization. For this reason, we urge you to use your best judgement before deploying this release in your production environment.
31
+
> While support is provided for this public preview release, Microsoft may not always be able to fix all issues you may encounter immediately. For this reason, it is recommended that you use your best judgement before deploying this release in your production environment.
32
32
33
33
## Deployment guidance
34
34
You will need to deploy [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later to use the V2 endpoint. Use the link provided to download.
35
35
36
-
It is recommended that you follow the [swing migration](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-upgrade-previous-version#swing-migration) method for rolling out the new endpoint in your environment. This will provide a clear contingency plan in the event, that a major rollback is necessary. The following example illustrates how a swing migration can be used in this scenario. For more information on the swing migration deployment method refer to the link provided.
36
+
It is recommended that you follow the [swing migration](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-upgrade-previous-version#swing-migration) method for rolling out the new endpoint in your environment. This will provide a clear contingency plan in the event, that a major rollback is necessary. The following example illustrates how a swing migration can be used in this scenario. For more information on the swing migration deployment method, refer to the link provided.
37
37
38
38
### Swing migration for deploying V2 endpoint
39
39
The following steps will guide you through deploying the v2 endpoint using the swing method.
40
40
41
-
1. Deploy the V2 endpoint on the current staging server. We will call this the **V2 server** in the steps below. The current active server will continue to process the production workload using the V1 endpoint, which we will call the **V1 server** below.
42
-
2. Validate that the **V2 server** is still processing imports as expected. At this stage, large groups will not be provisioned to Azure AD or on-prem AD, but you will be able to verify that the upgrade did not result in any other unexpected impact to the existing synchronization process.
43
-
3. Once validation is complete, switch the **V2 server** to be the active server and the **V1 server** to be the staging server. At this time, large groups that are in scope to be synced will be provisioned to Azure AD, as well as large O365 unified groups will be provisioned to AD, if group writeback is enabled.
44
-
4. Validate that the **V2 server** is performing and processing large groups successfully. You may choose to stay at this step and monitor the synchronization process for a period.
41
+
1. Deploy the V2 endpoint on the current staging server. This will be known as the **V2 server** in the steps below. The current active server will continue to process the production workload using the V1 endpoint, which will be called the **V1 server** below.
42
+
1. Validate that the **V2 server** is still processing imports as expected. At this stage, large groups will not be provisioned to Azure AD or on-prem AD, but you will be able to verify that the upgrade did not result in any other unexpected impact to the existing synchronization process.
43
+
2. Once validation is complete, switch the **V2 server** to be the active server and the **V1 server** to be the staging server. At this time, large groups that are in scope to be synced will be provisioned to Azure AD, as well as large O365 unified groups will be provisioned to AD, if group writeback is enabled.
44
+
3. Validate that the **V2 server** is performing and processing large groups successfully. You may choose to stay at this step and monitor the synchronization process for a period.
45
45
>[!NOTE]
46
46
> If you need to transition back to your previous configuration, you can perform a swing migration from the **V2 server** back to the **V1 server**. Since the V1 endpoint does not support groups with over 50k members, any large group that was provisioned by Azure AD Connect, in either Azure AD or on-prem AD, will be subsequently deleted.
47
-
5. Once you are confident in using the V2 endpoint, upgrade the **V1 server** to begin using the V2 endpoint.
47
+
4. Once you are confident in using the V2 endpoint, upgrade the **V1 server** to begin using the V2 endpoint.
48
48
49
49
50
50
## Expectations of performance impact
51
51
When using the V2 endpoint, performance gains are a function of the number of synced groups, size of those groups, and their group churn (the activity resulting from adding and removing users as members of the group). Using the new endpoint, without increasing the number, size, or churn of the synced groups, should result in shorter times for export and import to Azure AD.
52
52
53
-
However, these performance gains can be negated by the additional processing required when syncing the addition of large groups. You could end up increasing the overall sync time by adding a significant amount of additional large groups to the sync process.
53
+
However, these performance gains can be negated by the additional processing required when syncing large groups. You could end up increasing the overall sync time by adding a too many large groups to the sync process.
54
54
55
55
To gain a better understanding of how the addition of these new groups will impact your sync performance, it is recommended that you start by syncing only a few large groups with less than 100k members. You can then increase the number and size of groups by bringing more of them in scope, through OU, attribute, or max group size filtering. The performance improvements will be realized on the export and import tasks for the Azure AD connector, not the on-premises AD connector.
56
56
57
-
## Deployment step-by-step
58
-
The following 3 phases is an in-depth example of deploying the new V2 endpoint. Use these phases as a guideline for your deployment.
57
+
## Deployment step by step
58
+
The following 3 phases are an in-depth example of deploying the new V2 endpoint. Use these phases as a guideline for your deployment.
59
59
60
60
### Phase one – install and validate Azure AD Connect
61
-
It is recommended that you first perform the steps to install or upgrade to [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later and validate the sync process before you go to the second phase where you will enabled the V2 end point.
61
+
It is recommended that you first perform the steps to install or upgrade to [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later and validate the sync process before you go to the second phase where you will enable the V2 endpoint.
62
62
On the Azure AD Connect server:
63
63
64
64
@@ -74,7 +74,7 @@ The next step is to enable the V2 endpoint.
74
74
75
75
To switch to the V2 endpoint, follow these steps:
76
76
77
-
1. Open a PowerShell prompt as administrator.
77
+
1. Open a Powershell prompt as administrator.
78
78
2. Disable the sync scheduler after verifying that no synchronization operations are running:
79
79
80
80
`Set-ADSyncScheduler -SyncCycleEnabled $false`
@@ -105,7 +105,7 @@ These are the steps to increase the membership limit:
105
105
106
106
1. Open Azure AD Synchronization Rules Editor
107
107
2. Raise the maximum member limit for groups
108
-
3. In the editor, chose**Outbound** for Direction
108
+
3. In the editor, choose**Outbound** for Direction
109
109
4. Click on the **Out to AAD – Group Join** sync rule
8. On the **Transformations** page, update the **Source** value for the **member** transformation, replacing ‘50000’ with a value between 50001 and 250000. This will increase the maximum membership size of groups that will sync to Azure AD. We suggest starting with a number of 100k, to understand the impact that syncing large groups will have on your sync performance.
119
+
8. On the **Transformations** page, update the **Source** value for the **member** transformation, replacing ‘50000’ with a value between 50001 and 250000. This replacement will increase the maximum membership size of groups that will sync to Azure AD. We suggest starting with a number of 100k, to understand the impact that syncing large groups will have on your sync performance.
120
120
121
121
**Example**
122
122
@@ -125,7 +125,7 @@ These are the steps to increase the membership limit:
@@ -141,7 +141,7 @@ The new V2 endpoint code handles some types of export errors slightly different
141
141
>[!NOTE]
142
142
> When upgrading Azure AD Connect, ensure that the steps in Phase 2 are rerun, as the changes are not preserved through the upgrade process.
143
143
144
-
During subsequent increases to the group member limit in the **Out to AAD – Group Join** sync rule, a full sync is not necessary, so you can elect to suppress the full sync by running the following command in PowerShell.
144
+
During subsequent increases to the group member limit in the **Out to AAD – Group Join** sync rule, a full sync is not necessary, so you can elect to suppress the full sync by running the following command in Powershell.
@@ -152,29 +152,29 @@ If, for whatever reason, you need to roll back the changes you made to enable th
152
152
153
153
1. On the Azure AD Connect server:
154
154
a. [Optional] Take database backup
155
-
2. Open an admin PowerShell prompt:
156
-
157
-
Disable the sync scheduler after verifying that no synchronization operations are running
155
+
2. Open an admin Powershell prompt:
156
+
3. Disable the sync scheduler after verifying that no synchronization operations are running
158
157
159
-
`Set-ADSyncScheduler -SyncCycleEnabled $false`
158
+
`Set-ADSyncScheduler -SyncCycleEnabled $false`
160
159
161
-
Switch to the V1 endpoint *
160
+
Switch to the V1 endpoint *
162
161
163
-
`Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'`
162
+
`Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'`
164
163
165
-
`Set-ADSyncAADConnectorExportApiVersion 1`
164
+
`Set-ADSyncAADConnectorExportApiVersion 1`
166
165
167
-
`Set-ADSyncAADConnectorImportApiVersion 1`
166
+
`Set-ADSyncAADConnectorImportApiVersion 1`
168
167
169
-
Open Azure AD Synchronization Rules Editor
170
-
Delete the editable copy of the ‘Out to AAD – Group Join’ sync rule
171
-
Enable the default copy of the ‘Out to AAD – Group Join’ sync rule
172
-
Open an admin PowerShell prompt
173
-
Re-enable the Sync Scheduler
168
+
4.Open Azure AD Synchronization Rules Editor
169
+
5.Delete the editable copy of the **Out to AAD – Group Join** sync rule
170
+
6.Enable the default copy of the **Out to AAD – Group Join** sync rule
171
+
7.Open an admin Powershell prompt
172
+
8.Re-enable the Sync Scheduler
174
173
175
-
Set-ADSyncScheduler -SyncCycleEnabled $true
174
+
`Set-ADSyncScheduler -SyncCycleEnabled $true`
176
175
177
-
Note: When switching back from the V2 to V1 endpoints, groups synced with more than 50k members will be deleted after a full sync is run, for both AD groups provisioned to Azure AD and O365 unified groups provisioned to AD.
176
+
>[!NOTE]
177
+
> When switching back from the V2 to V1 endpoints, groups synced with more than 50k members will be deleted after a full sync is run, for both AD groups provisioned to Azure AD and O365 unified groups provisioned to AD.
178
178
179
179
## Frequently asked questions
180
180
**Q:Can a customer use this capability in production?**
@@ -183,8 +183,8 @@ Note: When switching back from the V2 to V1 endpoints, groups synced with more t
183
183
**Q:Who can the customer contact when things go wrong?**
184
184
</br>If you need support when using this feature please open a support case
185
185
186
-
**Q:How about breaking changes and functional takebacks?**
187
-
</br>There is a limited degree of ongoing change during a Public Preview. You should assess this risk when deploying Public Preview features in production.
186
+
**Q:Can I expect frequent updates to the public preview?**
187
+
</br>There is a limited degree of ongoing changes during a Public Preview. You should assess this risk when deploying Public Preview features in production.
188
188
189
189
**Q:Time to next milestone?**
190
190
</br>Public Preview capabilities may be withdrawn and possibly redesigned before reaching further milestones.
0 commit comments