You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-sync-endpoint-api-v2.md
+79-51Lines changed: 79 additions & 51 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ Microsoft has deployed a new endpoint (API) for Azure AD Connect that improves t
22
22
- write back for O365 unified groups, with no maximum membership limit when group writeback is enabled.
23
23
24
24
## Pre-requisites
25
-
In order to use the new V2 endpoint, you will need to use [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or newer and follow the deployment steps provided below to enable the V2 endpoint for your Azure AD Connect server.
25
+
In order to use the new V2 endpoint, you will need to use [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later and follow the deployment steps provided below to enable the V2 endpoint for your Azure AD Connect server.
26
26
27
27
### Public preview limitations
28
28
While this release has undergone extensive testing during multiple rounds of private preview releases you may still encounter issues. One of the goals of this public preview release is to find and fix any such issues.
@@ -31,7 +31,7 @@ While this release has undergone extensive testing during multiple rounds of pri
31
31
> While we provide support for this public preview release, we may not always be able to fix any issues you may encounter in a timely fashion, depending on the support requirements of your organization. For this reason, we urge you to use your best judgement before deploying this release in your production environment.
32
32
33
33
## Deployment guidance
34
-
You will need to deploy [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or newer to use the V2 endpoint. Use the link provided to download.
34
+
You will need to deploy [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later to use the V2 endpoint. Use the link provided to download.
35
35
36
36
It is recommended that you follow the [swing migration](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-upgrade-previous-version#swing-migration) method for rolling out the new endpoint in your environment. This will provide a clear contingency plan in the event, that a major rollback is necessary. The following example illustrates how a swing migration can be used in this scenario. For more information on the swing migration deployment method refer to the link provided.
37
37
@@ -52,91 +52,119 @@ When using the V2 endpoint, performance gains are a function of the number of sy
52
52
53
53
However, these performance gains can be negated by the additional processing required when syncing the addition of large groups. You could end up increasing the overall sync time by adding a significant amount of additional large groups to the sync process.
54
54
55
-
To gain a better understanding of how the addition of these new groups will impact your sync performance, we recommend you start by syncing only a few large groups with less than 100k members. You can then increase the number and size of groups by bringing more of them in scope, through OU, attribute, or max group size filtering. The performance improvements will be realized on the export and import tasks for the Azure AD connector, not the on-premises AD connector.
55
+
To gain a better understanding of how the addition of these new groups will impact your sync performance, it is recommended that you start by syncing only a few large groups with less than 100k members. You can then increase the number and size of groups by bringing more of them in scope, through OU, attribute, or max group size filtering. The performance improvements will be realized on the export and import tasks for the Azure AD connector, not the on-premises AD connector.
56
56
57
57
## Deployment step-by-step
58
-
### Phase one – install and validate AADConnect
59
-
It is recommended that you first perform the steps to install or upgrade to Azure AD Connect version 1.5.30.0 or newer and validate the sync process before you go to the second phase where you will enabled the V2 end point.
58
+
The following 3 phases is an in-depth example of deploying the new V2 endpoint. Use these phases as a guideline for your deployment.
59
+
60
+
### Phase one – install and validate Azure AD Connect
61
+
It is recommended that you first perform the steps to install or upgrade to [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later and validate the sync process before you go to the second phase where you will enabled the V2 end point.
60
62
On the Azure AD Connect server:
61
63
62
64
63
65
1.[Optional] Take database backup
64
-
2. Install or upgrade to Azure AD Connect version 1.5.30.0 or newer
66
+
2. Install or upgrade to [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later.
65
67
3. Validate this install
66
68
67
69
### Phase two – enable the V2 endpoint
68
-
The next step is to enable the V2 endpoint. Note that after you have enabled the V2 endpoint for your server you will be able to see some performance improvements for your existing workload. You will not yet be able to sync groups with more that 50K members though.
70
+
The next step is to enable the V2 endpoint.
71
+
72
+
> [!NOTE]
73
+
> After you have enabled the V2 endpoint for your server you will be able to see some performance improvements for your existing workload. You will not yet be able to sync groups with more that 50K members though.
74
+
69
75
To switch to the V2 endpoint, follow these steps:
70
-
Open an admin PowerShell prompt
71
-
Disable the sync scheduler after verifying that no synchronization operations are running:
76
+
77
+
1. Open a PowerShell prompt as administrator.
78
+
2. Disable the sync scheduler after verifying that no synchronization operations are running:
72
79
73
-
Set-ADSyncScheduler -SyncCycleEnabled $false
80
+
`Set-ADSyncScheduler -SyncCycleEnabled $false`
74
81
75
-
Switch to the V2 endpoint *
82
+
3. Import the new module:
76
83
77
-
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'
84
+
`Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'`
You have now enabled the V2 endpoint for your server. Please take some time to verify that there are no unexpected results after enabling the V2 endpoint before you move to the next phase where you will increase the group size limit.
84
95
>[!NOTE]
85
96
>The file / module paths may use a different drive letter, depending on the installation path provided when installing Azure AD Connect.
86
97
87
98
88
99
### Phase three – increase the group membership limit
89
-
After you have verified that the service is running without unexpected results, you can proceed to raising the group membership limit. We advise to first raise the membership limit to a slightly higher value, e g. 75K members, to see the larger groups syncing to AAD. Once you are satisfied with the results you can further raise the member limit.
100
+
After you have verified that the service is running without unexpected results, you can proceed to raising the group membership limit. It is recommended to first raise the membership limit to a slightly higher value, e g. 75K members, to see the larger groups syncing to Azure AD. Once you are satisfied with the results you can further raise the member limit.
101
+
90
102
The maximum limit is 250K members per group.
103
+
91
104
These are the steps to increase the membership limit:
92
-
Open Azure AD Synchronization Rules Editor
93
-
Raise the maximum member limit for groups
94
-
In the editor, chose ‘Outbound’ for Direction
95
-
Click on the ‘Out to AAD – Group Join’ sync rule
96
-
Click the ‘Edit’ button
97
-
Click the ‘Yes’ button to disable the default rule and create an editable copy
98
-
99
-
100
-
In the pop-up window on the ‘Description’ page, set the precedence to an available value between 1 and 99
101
-
102
-
103
-
On the ‘Transformations’ page, update the ‘Source’ value for the ‘member’ transformation, replacing ‘50000’ with a value between 50001 and 250000. This will increase the maximum membership size of groups that will sync to Azure AD. We suggest starting with a number of 100k, to understand the impact that syncing large groups will have on your sync performance.
104
-
105
-
Example
106
-
107
-
IIF((ValueCount("member")> 75000),Error("Maximum Group member count exceeded"),IgnoreThisFlow)
108
-
105
+
106
+
1. Open Azure AD Synchronization Rules Editor
107
+
2. Raise the maximum member limit for groups
108
+
3. In the editor, chose **Outbound** for Direction
109
+
4. Click on the **Out to AAD – Group Join** sync rule
8. On the **Transformations** page, update the **Source** value for the **member** transformation, replacing ‘50000’ with a value between 50001 and 250000. This will increase the maximum membership size of groups that will sync to Azure AD. We suggest starting with a number of 100k, to understand the impact that syncing large groups will have on your sync performance.
109
120
121
+
**Example**
110
122
111
-
Click Save
123
+
`IIF((ValueCount("member")> 75000),Error("Maximum Group member count exceeded"),IgnoreThisFlow)`
Note: If Azure AD Connect Health is not enabled, please change the windows application event log settings to archive the logs, instead of overwriting them. These logs may be used to assist in future troubleshooting efforts.
119
-
Note: After enabling the new endpoint, you may see additional export errors on the AAD connector with name ‘dn-attributes-failure’. There will be a corresponding event log entry for each error with id 6949, . These errors are informational and do not indicate a problem with your installation, but rather that the sync process could not add certain members to a group in AAD because the member object itself was not synced to AAD.
133
+
>[!NOTE]
134
+
> If Azure AD Connect Health is not enabled, please change the windows application event log settings to archive the logs, instead of overwriting them. These logs may be used to assist in future troubleshooting efforts.
135
+
136
+
>[!NOTE]
137
+
> After enabling the new endpoint, you may see additional export errors on the AAD connector with name ‘dn-attributes-failure’. There will be a corresponding event log entry for each error with id 6949, . These errors are informational and do not indicate a problem with your installation, but rather that the sync process could not add certain members to a group in Azure AD because the member object itself was not synced to Azure AD.
138
+
120
139
The new V2 endpoint code handles some types of export errors slightly different from how the V1 code handled this, and you may see more of these informational error messages when you use the V2 endpoint.
121
-
Note: When upgrading Azure AD Connect, ensure that the steps in Phase 2 are rerun, as the changes are not preserved through the upgrade process.
122
-
Tip: During subsequent increases to the group member limit in the ‘Out to AAD – Group Join’ sync rule, a full sync is not necessary, so you can elect to suppress the full sync by running the following command in PowerShell.
> When upgrading Azure AD Connect, ensure that the steps in Phase 2 are rerun, as the changes are not preserved through the upgrade process.
143
+
144
+
During subsequent increases to the group member limit in the **Out to AAD – Group Join** sync rule, a full sync is not necessary, so you can elect to suppress the full sync by running the following command in PowerShell.
Note: If you have O365 unified groups that have more than 50k members, these groups will be read into Azure AD Connect, and if group writeback is enabled, they will be written to your on-premises AD.
147
+
>[!NOTE]
148
+
> If you have O365 unified groups that have more than 50k members, these groups will be read into Azure AD Connect, and if group writeback is enabled, they will be written to your on-premises AD.
126
149
127
-
###Rollback
150
+
## Rollback
128
151
If, for whatever reason, you need to roll back the changes you made to enable the V2 endpoint, please follow these steps:
129
-
On the Azure AD Connect server:
130
-
[Optional] Take database backup
131
-
Open an admin PowerShell prompt
132
-
Disable the sync scheduler after verifying that no synchronization operations are running
152
+
153
+
1. On the Azure AD Connect server:
154
+
a. [Optional] Take database backup
155
+
2. Open an admin PowerShell prompt:
156
+
157
+
Disable the sync scheduler after verifying that no synchronization operations are running
133
158
134
-
Set-ADSyncScheduler -SyncCycleEnabled $false
159
+
`Set-ADSyncScheduler -SyncCycleEnabled $false`
160
+
135
161
Switch to the V1 endpoint *
136
162
137
-
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'
138
-
Set-ADSyncAADConnectorExportApiVersion 1
139
-
Set-ADSyncAADConnectorImportApiVersion 1
163
+
`Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'`
164
+
165
+
`Set-ADSyncAADConnectorExportApiVersion 1`
166
+
167
+
`Set-ADSyncAADConnectorImportApiVersion 1`
140
168
141
169
Open Azure AD Synchronization Rules Editor
142
170
Delete the editable copy of the ‘Out to AAD – Group Join’ sync rule
0 commit comments