You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-sync-endpoint-api-v2.md
+25-25Lines changed: 25 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ It is recommended that you follow the [swing migration](https://docs.microsoft.c
38
38
### Swing migration for deploying V2 endpoint
39
39
The following steps will guide you through deploying the v2 endpoint using the swing method.
40
40
41
-
1. Deploy the V2 endpoint on the current staging server. This will be known as the **V2 server** in the steps below. The current active server will continue to process the production workload using the V1 endpoint, which will be called the **V1 server** below.
41
+
1. Deploy the V2 endpoint on the current staging server. This server will be known as the **V2 server** in the steps below. The current active server will continue to process the production workload using the V1 endpoint, which will be called the **V1 server** below.
42
42
1. Validate that the **V2 server** is still processing imports as expected. At this stage, large groups will not be provisioned to Azure AD or on-prem AD, but you will be able to verify that the upgrade did not result in any other unexpected impact to the existing synchronization process.
43
43
2. Once validation is complete, switch the **V2 server** to be the active server and the **V1 server** to be the staging server. At this time, large groups that are in scope to be synced will be provisioned to Azure AD, as well as large O365 unified groups will be provisioned to AD, if group writeback is enabled.
44
44
3. Validate that the **V2 server** is performing and processing large groups successfully. You may choose to stay at this step and monitor the synchronization process for a period.
@@ -50,31 +50,31 @@ The following steps will guide you through deploying the v2 endpoint using the s
50
50
## Expectations of performance impact
51
51
When using the V2 endpoint, performance gains are a function of the number of synced groups, size of those groups, and their group churn (the activity resulting from adding and removing users as members of the group). Using the new endpoint, without increasing the number, size, or churn of the synced groups, should result in shorter times for export and import to Azure AD.
52
52
53
-
However, these performance gains can be negated by the additional processing required when syncing large groups. You could end up increasing the overall sync time by adding a too many large groups to the sync process.
53
+
However, the performance gains can be negated by the additional processing required when syncing large groups. You could end up increasing the overall sync time by adding a too many large groups to the sync process.
54
54
55
-
To gain a better understanding of how the addition of these new groups will impact your sync performance, it is recommended that you start by syncing only a few large groups with less than 100k members. You can then increase the number and size of groups by bringing more of them in scope, through OU, attribute, or max group size filtering. The performance improvements will be realized on the export and import tasks for the Azure AD connector, not the on-premises AD connector.
55
+
To gain a better understanding of how the addition of the new groups will impact your sync performance, it is recommended that you start by syncing only a few large groups with less than 100k members. You can then increase the number and size of groups by bringing more of them in scope, through OU, attribute, or max group size filtering. The performance improvements will be realized on the export and import tasks for the Azure AD connector, not the on-premises AD connector.
56
56
57
57
## Deployment step by step
58
-
The following 3 phases are an in-depth example of deploying the new V2 endpoint. Use these phases as a guideline for your deployment.
58
+
The following three phases are an in-depth example of deploying the new V2 endpoint. Use the phases as a guideline for your deployment.
59
59
60
-
### Phase one – install and validate Azure AD Connect
60
+
### Phase 1 – install and validate Azure AD Connect
61
61
It is recommended that you first perform the steps to install or upgrade to [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later and validate the sync process before you go to the second phase where you will enable the V2 endpoint.
62
62
On the Azure AD Connect server:
63
63
64
64
65
65
1.[Optional] Take database backup
66
66
2. Install or upgrade to [Azure AD Connect version 1.5.30.0](https://www.microsoft.com/download/details.aspx?id=47594) or later.
67
-
3. Validate this install
67
+
3. Validate the installation
68
68
69
-
### Phase two – enable the V2 endpoint
69
+
### Phase 2 – enable the V2 endpoint
70
70
The next step is to enable the V2 endpoint.
71
71
72
72
> [!NOTE]
73
73
> After you have enabled the V2 endpoint for your server you will be able to see some performance improvements for your existing workload. You will not yet be able to sync groups with more that 50K members though.
74
74
75
-
To switch to the V2 endpoint, follow these steps:
75
+
To switch to the V2 endpoint, use the following steps:
76
76
77
-
1. Open a Powershell prompt as administrator.
77
+
1. Open a PowerShell prompt as administrator.
78
78
2. Disable the sync scheduler after verifying that no synchronization operations are running:
79
79
80
80
`Set-ADSyncScheduler -SyncCycleEnabled $false`
@@ -89,19 +89,19 @@ To switch to the V2 endpoint, follow these steps:
You have now enabled the V2 endpoint for your server. Please take some time to verify that there are no unexpected results after enabling the V2 endpoint before you move to the next phase where you will increase the group size limit.
94
+
You have now enabled the V2 endpoint for your server. Take some time to verify that there are no unexpected results after enabling the V2 endpoint before you move to the next phase where you will increase the group size limit.
95
95
>[!NOTE]
96
96
>The file / module paths may use a different drive letter, depending on the installation path provided when installing Azure AD Connect.
97
97
98
98
99
-
### Phase three – increase the group membership limit
99
+
### Phase 3 – increase the group membership limit
100
100
After you have verified that the service is running without unexpected results, you can proceed to raising the group membership limit. It is recommended to first raise the membership limit to a slightly higher value, e g. 75K members, to see the larger groups syncing to Azure AD. Once you are satisfied with the results you can further raise the member limit.
101
101
102
102
The maximum limit is 250K members per group.
103
103
104
-
These are the steps to increase the membership limit:
104
+
The following steps can be used to increase the membership limit:
105
105
106
106
1. Open Azure AD Synchronization Rules Editor
107
107
2. Raise the maximum member limit for groups
@@ -125,34 +125,34 @@ These are the steps to increase the membership limit:
> If Azure AD Connect Health is not enabled, please change the windows application event log settings to archive the logs, instead of overwriting them. These logs may be used to assist in future troubleshooting efforts.
134
+
> If Azure AD Connect Health is not enabled, change the windows application event log settings to archive the logs, instead of overwriting them. The logs may be used to assist in future troubleshooting efforts.
135
135
136
136
>[!NOTE]
137
-
> After enabling the new endpoint, you may see additional export errors on the AAD connector with name ‘dn-attributes-failure’. There will be a corresponding event log entry for each error with id 6949, . These errors are informational and do not indicate a problem with your installation, but rather that the sync process could not add certain members to a group in Azure AD because the member object itself was not synced to Azure AD.
137
+
> After enabling the new endpoint, you may see additional export errors on the AAD connector with name ‘dn-attributes-failure’. There will be a corresponding event log entry for each error with id 6949, . The errors are informational and do not indicate a problem with your installation, but rather that the sync process could not add certain members to a group in Azure AD because the member object itself was not synced to Azure AD.
138
138
139
-
The new V2 endpoint code handles some types of export errors slightly different from how the V1 code handled this, and you may see more of these informational error messages when you use the V2 endpoint.
139
+
The new V2 endpoint code handles some types of export errors slightly different from how the V1 code did. You may see more of the informational error messages when you use the V2 endpoint.
140
140
141
141
>[!NOTE]
142
142
> When upgrading Azure AD Connect, ensure that the steps in Phase 2 are rerun, as the changes are not preserved through the upgrade process.
143
143
144
-
During subsequent increases to the group member limit in the **Out to AAD – Group Join** sync rule, a full sync is not necessary, so you can elect to suppress the full sync by running the following command in Powershell.
144
+
During subsequent increases to the group member limit in the **Out to AAD – Group Join** sync rule, a full sync is not necessary, so you can elect to suppress the full sync by running the following command in PowerShell.
> If you have O365 unified groups that have more than 50k members, these groups will be read into Azure AD Connect, and if group writeback is enabled, they will be written to your on-premises AD.
148
+
> If you have O365 unified groups that have more than 50k members, the groups will be read into Azure AD Connect, and if group writeback is enabled, they will be written to your on-premises AD.
149
149
150
150
## Rollback
151
-
If, for whatever reason, you need to roll back the changes you made to enable the V2 endpoint, please follow these steps:
151
+
Ifyou have enabled the v2 endpoint and need to rollback, follow these steps:
152
152
153
153
1. On the Azure AD Connect server:
154
154
a. [Optional] Take database backup
155
-
2. Open an admin Powershell prompt:
155
+
2. Open an admin PowerShell prompt:
156
156
3. Disable the sync scheduler after verifying that no synchronization operations are running
157
157
158
158
`Set-ADSyncScheduler -SyncCycleEnabled $false`
@@ -168,7 +168,7 @@ If, for whatever reason, you need to roll back the changes you made to enable th
168
168
4. Open Azure AD Synchronization Rules Editor
169
169
5. Delete the editable copy of the **Out to AAD – Group Join** sync rule
170
170
6. Enable the default copy of the **Out to AAD – Group Join** sync rule
171
-
7. Open an admin Powershell prompt
171
+
7. Open an admin PowerShell prompt
172
172
8. Re-enable the Sync Scheduler
173
173
174
174
`Set-ADSyncScheduler -SyncCycleEnabled $true`
@@ -177,11 +177,11 @@ If, for whatever reason, you need to roll back the changes you made to enable th
177
177
> When switching back from the V2 to V1 endpoints, groups synced with more than 50k members will be deleted after a full sync is run, for both AD groups provisioned to Azure AD and O365 unified groups provisioned to AD.
178
178
179
179
## Frequently asked questions
180
-
**Q:Can a customer use this capability in production?**
181
-
</br>Yes, this can be used in production environments, with the caveat as mentioned before
180
+
**Q:Can a customer use this feature in production?**
181
+
</br>Yes, this can be used in production environments, with the caveat as mentioned before.
182
182
183
183
**Q:Who can the customer contact when things go wrong?**
184
-
</br>If you need support when using this feature please open a support case
184
+
</br>If you need support when using this feature you should open a support case.
185
185
186
186
**Q:Can I expect frequent updates to the public preview?**
187
187
</br>There is a limited degree of ongoing changes during a Public Preview. You should assess this risk when deploying Public Preview features in production.
0 commit comments