How to access Microsoft Identity Manager Hybrid Report data using PowerShell, Graph API and oAuth2

24th of May, 2017 / / No Comments 
Update: Dec 20 2018. 
See this post that details the changes to the Azure AD 
Reports and Events Rest API.

Hybrid Reporting is a great little feature of Microsoft Identity Manager. A small agent installed on the MIM Sync Server will send reporting data to Azure for MIM SSPR and MIM Group activities. See how to install and configure it here.

But what if you want to get the reporting data without going to the Azure Portal and looking at the Audit Reports ?… [Keep reading] “How to access Microsoft Identity Manager Hybrid Report data using PowerShell, Graph API and oAuth2”

Synchronizing Exchange Online/Office 365 User Profile Photos with FIM/MIM

23rd of May, 2017 / / No Comments

Introduction

This is Part Two in the two-part blog post on managing users profile photos with Microsoft FIM/MIM. Part one here detailed managing users Azure AD/Active Directory profile photo. This post delves deeper into photos, specifically around Office 365 and the reason why you may want to manage these via FIM/MIM.

Background

User profile photos should be simple to manage. But in a rapidly moving hybrid cloud world it can be a lot more complex than it needs to be.… [Keep reading] “Synchronizing Exchange Online/Office 365 User Profile Photos with FIM/MIM”

How to Synchronize users Active Directory/Azure Active Directory Photo using Microsoft Identity Manager

23rd of May, 2017 / / No Comments

Introduction

Whilst Microsoft FIM/MIM can be used to do pretty much anything your requirements dictate, dealing with object types other than text and references can be a little tricky when manipulating them the first time. User Profile Photos fall into that category as they are stored in the directory as binary objects. Throw in Azure AD and obtaining and synchronizing photos can seem like adding a double back-flip to the scenario.
This post is Part 1 of a two-part post.… [Keep reading] “How to Synchronize users Active Directory/Azure Active Directory Photo using Microsoft Identity Manager”

Understanding Password Sync and Write-back

15th of May, 2017 / / 5 Comments

For anyone who has worked with Office 365/Azure AD and AADConnect, you will of course be aware that we can now sync passwords two ways from Azure AD to our on-premises AD. This is obviously a very handy thing to do for myriad reasons, and an obvious suggestion for a business intending to utilise Office 365. The conversation with the security bod however, might be a different kettle of fish. In this post, I aim to explain how the password sync and write-back features work, and hopefully arm you with enough information to have that chat with the security guys.… [Keep reading] “Understanding Password Sync and Write-back”

Using the Lithnet PowerShell Modules to generate full object metadata FIM/MIM HTML Reports

11th of May, 2017 / / No Comments


How many times have you wanted a consolidated report out of FIM/MIM for an object? What connectors does it have, what are the values of the attributes, which Management Agent contributed the value(s) and when? Individually of course you can get that info using the Metaverse Search and looking at the object in MIM Portal. But what if you wanted it all with a single query? This blog post provides an approach to doing just that.… [Keep reading] “Using the Lithnet PowerShell Modules to generate full object metadata FIM/MIM HTML Reports”

Scripting queries for Lithnet Get-MVObject searches into the Microsoft Identity Manager Metaverse

10th of May, 2017 / / No Comments

It probably seems obvious by now, but I seem to live in PowerShell and Microsoft Identity Manager. I’m forever looking into the Microsoft Identity Manager Metaverse for objects.
However, sometimes I get tripped up by the differences in Object Classes between the FIM/MIM Service and the Metaverse, the names of the Object Classes (obviously not Person, Group and Contact) and in situations where they are case-sensitive.  If you’re using the Sync Service Manager Metaverse Search function though you get a pick list.… [Keep reading] “Scripting queries for Lithnet Get-MVObject searches into the Microsoft Identity Manager Metaverse”

MfaSettings.xml updates not taking effect

6th of May, 2017 / / No Comments

First published at https://nivleshc.wordpress.com
Last week, I was at a client site, extending their Microsoft Identity Manager (MIM) 2016 Self Service Password Reset Solution so that it could use Azure MultiFactor Authentication (MFA). This is an elegant solution since instead of using Questions and Answers to authenticate yourself when trying to reset your password, you can use One Time Passwords (OTP), sent as a security code via a text message to your registered mobile device.
I followed the steps as outlined in https://github.com/Microsoft/MIMDocs/blob/master/MIMDocs/DeployUse/working-with-self-service-password-reset.md… [Keep reading] “MfaSettings.xml updates not taking effect”

Scripting the generation & creation of Microsoft Identity Manager Sets/Workflows/Sync & Management Policy Rules with the Lithnet Resource Management PowerShell Module

26th of April, 2017 / / 2 Comments

Introduction

Yes, that title is quite a mouthful. And this post is going to be quite long. But worth the read if you are having to create a number of rules in Microsoft/Forefront Identity Manager, or even more so the same rule in multiple environments (eg. Dev, Staging, Production).
My colleague David Minnelli introduced using the Lithnet RMA PowerShell Module and the Import-RMConfig cmdlet recently for bulk creation of MIM Sets and MPR’s. David has a lot of the background on Import-RMConfig and getting started with it.… [Keep reading] “Scripting the generation & creation of Microsoft Identity Manager Sets/Workflows/Sync & Management Policy Rules with the Lithnet Resource Management PowerShell Module”

FIM: An object with DN "CN=BLAH" already exists in management agent "BLAH MA"

26th of April, 2017 / / 3 Comments

If you treat the FIM Synchronization Service well and your configuration is good, it will reward you and the ‘magic’ will happen. At my customer site, the ‘magic’ stopped working and I was faced with an increasing number of synchronization errors being ‘An object with DN “CN=<blah>” already exists in management agent “<blah> MA” ‘. For users that were already provisioned correctly, the FIM Synchronization Service was attempting to re-provision a duplicate object in the destination directory but obviously the account already existed.… [Keep reading] “FIM: An object with DN "CN=BLAH" already exists in management agent "BLAH MA"”

FIM: An object with DN "CN=BLAH" already exists in management agent "BLAH MA"

26th of April, 2017 / / No Comments

If you treat the FIM Synchronization Service well and your configuration is good, it will reward you and the ‘magic’ will happen. At my customer site, the ‘magic’ stopped working and I was faced with an increasing number of synchronization errors being ‘An object with DN “CN=<blah>” already exists in management agent “<blah> MA” ‘. For users that were already provisioned correctly, the FIM Synchronization Service was attempting to re-provision a duplicate object in the destination directory but obviously the account already existed.… [Keep reading] “FIM: An object with DN "CN=BLAH" already exists in management agent "BLAH MA"”