[Harbar] Use profile synchronisation with Identity Manager and SharePoint Server

•
•
• 
•
•
•
•
•
Chief Architect, ClearPeople
Edinburgh, United Kingdom Scotland 
www.harbar.net spence@harbar.net @harbars

Who are ClearPeople?
We are a hybrid breed of business offering technical consulting with creative digital agency
services.
Gold partner
experience with
Microsoft and
Sitecore technologies.
We are a ConsultagencyTM
We apply the right
technology
with a
human-centred
approach.

•
•
•
•
•
•
•
•
Demonstration
* Not extensive coverage due to time constraints

Whether you like it or not!
Importance has increased
significantly with each
major release of
SharePoint
A SharePoint Admin is an
Identity Admin
Social features == social
data
Key input into “AI” such as
Delve
Pretty much every
investment area relies on
Profiles for core functionality
App AuthZ, S2S, etc
Primarily a political and
social endeavor, NOT a
technical one
No toolset from any
vendor will solve this, they
only help

Who owns which data
Departmental controls
IS systems
Organizational culture
LCS: Legacy
Corporation
Syndrome
Is the data even there?
Is the data “clean”?
Is the data up to date?
Rate of change
e.g. Health of Active
Directory
Too many forests
and/or domains
Line of business
systems
Ancient, creaking
infrastructure
External (to SharePoint)
data sources
Authentication and
Authorization
Ego: IdM Consultant and Admin Egos
Protection of fiefdoms
Privacy &
Security
User privacy & organization’s
trustworthiness
Regulation and legislation
IdM implementation will need
far more security controls than
the systems it interacts with
Do NOT get into the profile
data storage business!

Especially when
Active Directory is
externally managed
e.g. Reboot of
domain controllers,
Windows Update
Large and/or bulk
updates
Replicating
Directory Changes
Additional rights for
property export
Ensure that SharePoint practitioners are involved early, and are
taken seriously (considered a “grown up at the table”) within
identity community

SharePoint
User Profile
Service
Application
UPS
(SharePoint
FIM)
LOB System
Active
Directory
ADI
(User Profile
Service Instance)
EIM
(External
MIM)
EIM
(Custom
Code)
Other
Directory

SharePoint
User Profile
Service
Application
LOB System
Active
Directory
ADI
(User Profile
Service Instance)
EIM
(External
MIM)
EIM
(Custom
Code)
Other
Directory

•
•
•
•
• 
•
•
•
• 

•
•
•
•
•
•
•
•

For the most
common scenario
Active Directory
only
Import Only!
Container selection
LDAP filters
Inclusion Based
One connection per
domain
Basically, an LDAP
query and updates
to Profile properties

•
•
•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•
•
• 
•

•
•
•
•
•
•
•
•
•
•
•
•
•

Learn about MIM Sync
•Complete a planning worksheet in Excel or similar of your requirements!
Install Microsoft Identity Manager Synchronization Service & SharePoint Connector
Create Management Agent Accounts
•AD requires Replicating Directory Changes on Domain(s) and Configuration Partition
•SharePoint requires Farm Administrator
Configure SharePoint UPA and My Site Host
•UPA: NetBIOSDomainNamesEnabled = $true & NoIlmUsed = $False (Use External Identity Manager)
•Permission Policy and User Policy for SharePoint MA Account on the My Site Web Application
Use MIMSync Toolkit to configure AD and SharePoint Management Agents*
•Fix up Management Agent configuration
•Configure additional properties, filters
Perform Sync Runs
Update-SPProfilePhotoStore
Schedule Sync Runs
* In a development
environment,
then use PowerShell and MA
export/import to deploy to
production

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
Great book, but covers
the whole product, with
not much detail on MIM
Sync / Classic
provisioning

[Harbar] Use profile synchronisation with Identity Manager and SharePoint Server

More Related Content

What's hot (20)

Similar to [Harbar] Use profile synchronisation with Identity Manager and SharePoint Server (20)

More from European Collaboration Summit (20)

Recently uploaded (20)

[Harbar] Use profile synchronisation with Identity Manager and SharePoint Server

Editor's Notes