You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/application-provisioning-config-problem-no-users-provisioned.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -63,4 +63,4 @@ For the next 3 months, the behavior will continue as it is today. Users with the
63
63
For questions about these changes, please reach out to [email protected]
64
64
## Next steps
65
65
66
-
[Azure AD Connect sync: Understanding Declarative Provisioning](../hybrid/concept-azure-ad-connect-sync-declarative-provisioning.md)
66
+
[Azure AD Connect sync: Understanding Declarative Provisioning](../hybrid/connect/concept-azure-ad-connect-sync-declarative-provisioning.md)
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/application-provisioning-log-analytics.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -91,7 +91,7 @@ AADProvisioningLogs
91
91
92
92
Azure Monitor lets you configure custom alerts so that you can get notified about key events related to Provisioning. For example, you might want to receive an alert on spikes in failures. Or perhaps spikes in disables or deletes. Another example of where you might want to be alerted is a lack of any provisioning, which indicates something is wrong.
93
93
94
-
To learn more about alerts, see [Azure Monitor Log Alerts](../../azure-monitor/alerts/alerts-log.md).
94
+
To learn more about alerts, see [Azure Monitor Log Alerts](../../azure-monitor/alerts/alerts-create-new-alert-rule.md).
95
95
96
96
Alert when there's a spike in failures. Replace the jobID with the jobID for your application.
97
97
@@ -115,5 +115,5 @@ We're taking an open source and community-based approach to application provisio
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/how-provisioning-works.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -201,7 +201,7 @@ Confirm the mapping for *active* for your application. If you're using an applic
201
201
**Configure your application to delete a user**
202
202
203
203
The scenario triggers a disable or a delete:
204
-
* A user is soft-deleted in Azure AD (sent to the recycle bin / AccountEnabled property set to false). Thirty days after a user is deleted in Azure AD, they're permanently deleted from the tenant. At this point, the provisioning service sends a DELETE request to permanently delete the user in the application. At any time during the 30-day window, you can [manually delete a user permanently](../fundamentals/active-directory-users-restore.md), which sends a delete request to the application.
204
+
* A user is soft-deleted in Azure AD (sent to the recycle bin / AccountEnabled property set to false). Thirty days after a user is deleted in Azure AD, they're permanently deleted from the tenant. At this point, the provisioning service sends a DELETE request to permanently delete the user in the application. At any time during the 30-day window, you can [manually delete a user permanently](../fundamentals/users-restore.md), which sends a delete request to the application.
205
205
* A user is permanently deleted / removed from the recycle bin in Azure AD.
206
206
* A user is unassigned from an app.
207
207
* A user goes from in scope to out of scope (doesn't pass a scoping filter anymore).
The following diagram shows an overview of how on-premises application provisioning works.
21
21
22
-

22
+

23
23
24
24
There are three primary components to provisioning users into an on-premises application:
25
25
@@ -37,12 +37,12 @@ There are three primary components to provisioning users into an on-premises app
37
37
38
38
You don't need to open inbound connections to the corporate network. The provisioning agents only use outbound connections to the provisioning service, which means there's no need to open firewall ports for incoming connections. You also don't need a perimeter (DMZ) network because all connections are outbound and take place over a secure channel.
39
39
40
-
The required outbound endpoints for the provisioning agents are detailed [here](../cloud-sync/how-to-prerequisites.md#firewall-and-proxy-requirements).
40
+
The required outbound endpoints for the provisioning agents are detailed [here](../hybrid/cloud-sync/how-to-prerequisites.md#firewall-and-proxy-requirements).
41
41
42
42
## ECMA Connector Host architecture
43
43
The ECMA Connector Host has several areas it uses to achieve on-premises provisioning. The diagram below is a conceptual drawing that presents these individual areas. The table below describes the areas in more detail.
@@ -68,7 +68,7 @@ However, for a data source such as SQL, which is flat, not hierarchical, the DN
68
68
69
69
This can be achieved by checking **Autogenerated** in the checkbox when configuring the genericSQL connector. When you choose DN to be autogenerated, the ECMA host will generate a DN in an LDAP format: CN=<anchorvalue>,OBJECT=<type>. This also assumes that the DN is Anchor **unchecked** in the Connectivity page.
70
70
71
-
[](.\media\on-premises-application-provisioning-architecture\user-2.png#lightbox)
71
+
[](./media/on-premises-application-provisioning-architecture/user-2.png#lightbox)
72
72
73
73
The genericSQL connector expects the DN to be populated using an LDAP format. The Generic SQL connector is using the LDAP style with the component name "OBJECT=". This allows it to use partitions (each object type is a partition).
74
74
@@ -81,7 +81,7 @@ Since ECMA Connector Host currently only supports the USER object type, the OBJE
81
81
82
82
1. The Azure AD provisioning service queries the ECMA Connector Host to see if the user exists. It uses the **matching attribute** as the filter. This attribute is defined in the Azure portal under Enterprise applications -> On-premises provisioning -> provisioning -> attribute matching. It is denoted by the 1 for matching precedence.
83
83
You can define one or more matching attribute(s) and prioritize them based on the precedence. Should you want to change the matching attribute you can also do so.
2. ECMA Connector Host receives the GET request and queries its internal cache to see if the user exists and has based imported. This is done using the matching attribute(s) above. If you define multiple matching attributes, the Azure AD provisioning service will send a GET request for each attribute and the ECMA host will check its cache for a match until it finds one.
87
87
@@ -144,7 +144,7 @@ This article lists the versions and features of Azure Active Directory Connect P
144
144
Microsoft provides direct support for the latest agent version and one version before.
145
145
146
146
### Download link
147
-
On-premises app provisioning has been rolled into the provisioning agent and is available from the portal. See [installing the provisioning agent](../cloud-sync/how-to-install.md).
147
+
On-premises app provisioning has been rolled into the provisioning agent and is available from the portal. See [installing the provisioning agent](../hybrid/cloud-sync/how-to-install.md).
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/on-premises-ecma-troubleshoot.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -260,7 +260,7 @@ By default, the agent emits minimal error messages and stack trace information.
260
260
261
261
To gather more information for troubleshooting agent-related problems:
262
262
263
-
1. Install the AADCloudSyncTools PowerShell module as described in [AADCloudSyncTools PowerShell Module for Azure AD Connect cloud sync](../../active-directory/cloud-sync/reference-powershell.md#install-the-aadcloudsynctools-powershell-module).
263
+
1. Install the AADCloudSyncTools PowerShell module as described in [AADCloudSyncTools PowerShell Module for Azure AD Connect cloud sync](../hybrid/cloud-sync/reference-powershell.md#install-the-aadcloudsynctools-powershell-module).
264
264
2. Use the `Export-AADCloudSyncToolsLogs` PowerShell cmdlet to capture the information. Use the following switches to fine-tune your data collection. Use:
265
265
266
266
-**SkipVerboseTrace** to only export current logs without capturing verbose logs (default = false).
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/plan-auto-user-provisioning.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -124,15 +124,15 @@ Consider your organizational needs to determine the strategy for deploying user
124
124
125
125
### Engage the right stakeholders
126
126
127
-
When technology projects fail, it's typically because of mismatched expectations on impact, outcomes, and responsibilities. To avoid these pitfalls, [ensure you're engaging the right stakeholders](../fundamentals/deployment-plans.md) and that stakeholder roles in the project are well understood by documenting the stakeholders and their project input and accountabilities.
127
+
When technology projects fail, it's typically because of mismatched expectations on impact, outcomes, and responsibilities. To avoid these pitfalls, [ensure you're engaging the right stakeholders](../architecture/deployment-plans.md) and that stakeholder roles in the project are well understood by documenting the stakeholders and their project input and accountabilities.
128
128
129
129
### Plan communications
130
130
131
131
Communication is critical to the success of any new service. Proactively communicate to your users about their experience, how the experience is changing, when to expect any change, and how to gain support if they experience issues.
132
132
133
133
### Plan a pilot
134
134
135
-
We recommend that the initial configuration of automatic user provisioning is in a test environment with a small subset of users before scaling it to all users in production. See [best practices](../fundamentals/deployment-plans.md#best-practices-for-a-pilot) for running a pilot.
135
+
We recommend that the initial configuration of automatic user provisioning is in a test environment with a small subset of users before scaling it to all users in production. See [best practices](../architecture/deployment-plans.md#best-practices-for-a-pilot) for running a pilot.
0 commit comments