User profile synchronization with Identity Manager and SharePoint Server 2016 was presented. The presentation covered the importance of user profile synchronization, challenges to consider when planning synchronization, and different approaches to configuring synchronization between Active Directory, SharePoint user profile service, and external identity sources using Microsoft Identity Manager. A demonstration of the Microsoft Identity Manager Sync Toolkit for SharePoint was provided.

2. User profile synchronization with
Identity Manager and SharePoint
Server 2016

3. Architect
Edinburgh, United Kingdom Scotland
www.harbar.net spence@harbar.net @harbars

4. Demonstration
* Not extensive coverage due to time constraints

6. Whether you like it or not!
Importance has increased
significantly with each
major release of
SharePoint
A SharePoint Admin is an
Identity Admin
Social features == social
data
Key input into “AI” such as
Delve
Pretty much every
investment area relies on
Profiles for core functionality
App AuthZ, S2S, etc
Primarily a political and
social endeavor, NOT a
technical one
No toolset from any
vendor will solve this, they
only help

8. Who owns which data
Departmental controls
IS systems
Organizational culture
LCS: Legacy
Corporation
Syndrome
Is the data even there?
Is the data “clean”?
Is the data up to date?
Rate of change
e.g. Health of Active
Directory
Too many forests
and/or domains
Line of business
systems
Ancient, creaking
infrastructure
External (to SharePoint)
data sources
Authentication and
Authorization
Ego: IdM Consultant and Admin Egos
Protection of fiefdoms
Privacy &
Security
User privacy & organization’s
trustworthiness
Regulation and legislation
IdM implementation will need
far more security controls than
the systems it interacts with
Do NOT get into the profile
data storage business!

9. Especially when
Active Directory is
externally managed
e.g. Reboot of
domain controllers,
Windows Update
Large and/or bulk
updates
Replicating
Directory Changes
Additional rights for
property export
Ensure that SharePoint practitioners are involved early, and are
taken seriously (considered a “grown up at the table”) within
identity community

13. SharePoint
User Profile
Service
Application
UPS
(SharePoint
FIM)
LOB System
Active
Directory
ADI
(User Profile
Service Instance)
EIM
(External
MIM)
EIM
(Custom
Code)
Other
Directory

14. SharePoint
User Profile
Service
Application
LOB System
Active
Directory
ADI
(User Profile
Service Instance)
EIM
(External
MIM)
EIM
(Custom
Code)
Other
Directory

15. 






16. 







18. For the most
common scenario
Active Directory
only
Import Only!
Container selection
LDAP filters
Inclusion Based
One connection per
domain
Basically, an LDAP
query and updates
to Profile properties

19. 
 https://channel9.msdn.com/Events/Ignite/2016/BRK3039





21. 





 https://www.microsoft.com/en-us/download/details.aspx?id=41164

22. Image Credit:
David Steadman

23. Image Credit:
David Steadman

24. 






26. 





https://github.com/SharePoint/PnP-Tools/tree/master/Solutions/UserProfile.MIMSync





27. 










28. Learn about MIM Sync
•Complete a planning worksheet in Excel or similar of your requirements!
Install Microsoft Identity Manager Synchronization Service & SharePoint Connector
Create Management Agent Accounts
•AD requires Replicating Directory Changes on Domain(s) and Configuration Partition
•SharePoint requires Farm Administrator
Configure SharePoint UPA and My Site Host
•UPA: NetBIOSDomainNamesEnabled = $true & NoIlmUsed = $False (Use External Identity Manager)
•Permission Policy and User Policy for SharePoint MA Account on the My Site Web Application
Use MIMSync Toolkit to configure AD and SharePoint Management Agents*
•Fix up Management Agent configuration
•Configure additional properties, filters
Perform Sync Runs
Update-SPProfilePhotoStore
Schedule Sync Runs
* In a development
environment,
then use PowerShell and MA
export/import to deploy to
production

30. 













31. 









33. https://blogs.msdn.microsoft.com/spses/2016/07/18/sharepoint-2016-issues-due-to-switching-
between-synchronization-types-in-upa-ad-import-external-identity-manager-mim/

34. Seriously!
https://sharepointupdates.com/
https://blogs.technet.microsoft.com/iamsupport/idmbuildversions/

35. 





36. 











38. 




Plan, plan, plan!

39. 




 https://github.com/SharePoint/PnP-Tools/tree/master/Solutions/UserProfile.MIMSync


41. http://www.harbar.net
https://technet.microsoft.com/en-us/library/mt797545(v=office.16).aspx
https://technet.microsoft.com/en-us/library/mt797546(v=office.16).aspx
https://technet.microsoft.com/en-us/library/mt627723(v=office.16).aspx
https://technet.microsoft.com/en-us/library/mt637055(v=office.16).aspx
https://blogs.technet.microsoft.com/iamsupport/2017/04/11/3365/
https://msdn.microsoft.com/en-us/library/dn511003(v=ws.10).aspx
Great book, but covers
the whole product, with
not much detail on MIM
Sync / Classic
provisioning