1.4 Driver Features

The Azure AD driver supports the following features:

1.4.1 Supported Operations

By default, the Azure AD Driver synchronizes User and Group Objects, and Exchange Mailboxes. You can customize the driver to synchronize additional classes and attributes.

Add Supported Attributes:

Specify the appropriate configuration details while adding supported attributes. You can add multiple supported attributes if required

  • Attribute Name: Specify the name of the supported attribute to be added to the list.

  • Attribute Type: Specify the type of the supported attribute.

  • Multivalued: Specify if the attribute is multivalued.

  • Navigation Property: Specify if the attribute is a navigational property.

  • Class Name: Specify the class name to which the supported attribute belongs to.

Click “+” add the supported attributes to the list. Click “-” to remove the supported attribute from the list.

The driver supports the following operations on the Publisher Channel:

  • Add, Modify, Delete, And Query Operations.

  • Migrate Operation Only Through Azure Ad Attributes. Exchange Attributes Are Not Supported For Migration.

NOTE:The Password Synchronization is not supported in the Publisher Channel.

Attributes that are not supported by MS Graph API on Publisher Channel and Query are as listed Below. This list may subject to change.

  • “birthday”

  • “hireDate”

  • “mailboxSettings”

  • “deviceEnrollmentLimit”

  • “aboutMe”

  • “interests”

  • “mySite”

  • “pastProjects”

  • “preferredName”

  • “responsibilities”

  • “schools”

  • “skills”

  • “signinActivity”

  • “print”

  • “photo”

  • “physicalDeliveryOfficeName”

  • “LitigationHoldEnabled”

  • “ArchiveStatus”

  • “ServerLegacyDN”

  • “Type”

Unsupported Attributes for Query User:

  • “Birthday”

  • “Hiredate”

  • “Mailboxsettings”

  • “Deviceenrollmentlimit”

  • “Aboutme”

  • “Interests”

  • “Mysite”

  • “Pastprojects”

  • “Schools”

  • “Skills”

Unsupported Attributes for Query Group:

  • AutoSubscribeNewMembers

  • hasMembersWithLicenseErrors

  • allowExternalSender

  • autoSubscribeNewMember

  • hideFromAddressLists

  • hideFromOutlookClients

  • isSubscribedByMail

  • unseenCount

The following Exchange Groups can be added through the Publisher Channel:

  • Office 365 Group

  • Distribution Group

  • Security Group

  • Mail Enabled Security Group

  • Unified / Microsoft 365 Group

NOTE:You need to write a policy to set a value for Equivalent To Me while modifying a group membership.

The driver supports the following Operations on the Subscriber Channel:

  • Add, Modify, Delete, Migrate, And Query Operations On Users And Groups.

  • Add Or Delete Licenses Only On User Objects.

  • Set Or Reset A Password Only On User Objects.

  • Execute Powershell Cmdlets Using Policies.

  • Assign Or Revoke Roles And Licenses In Hybrid Mode.

The following Exchange Groups can be added through the Subscriber Channel:

  • Distribution Group

  • Security Group

  • Office 365 Group

  • Mail Enabled Security Groups

  • Unified/Microsoft 365 Groups

Support for SharePoint Online sites

A SharePoint team site connects you and your team to shared content and resources. When you create a team site, a Microsoft 365 Group is automatically created. Any users you add to your team site are automatically added to your Microsoft 365 Group. Similarly, when you create a Microsoft 365 Group in Outlook, a SharePoint in Microsoft 365 team site is automatically created and any users you add to your Microsoft 365 Group get added to the team site.

NOTE:Only SharePoint Team site is supported but not the SharePoint Communication site.

Access the SharePoint Team site using the link: https://<tenant>.sharepoint.com/sites/<group>.

For example: https://asnlab.sharepoint.com/sites/SampleEngineeringTeam.

Figure 1-2

1.4.2 Schema Extension

The Azure AD driver allows you to extend the Azure AD schema to include different types of attributes such as Integer, Boolean, and String using the driver parameters. For example, You can add, remove, or change extension attributes on a User or A Group Class with the allowed attribute types. For more information, see the Microsoft website.

1.4.3 License Handling

In the Office 365 driver, you created custom licenses to disable specific service plans. For example, to disable Office 365 ProPlus from your enterprise plan, you specified this string in the driver configuration. OFFICESUBSCRIPTION.

In the Azure AD driver, license handling is simplified. The driver lists all the available service plans for your subscription in Identity Applications. Each service plan can be individually assigned or revoked for a user through the License Entitlement resource. For example, if you want to assign only Office 365 ProPlus to a user, select OFFICESUBSCRIPTION from the list of service plans. The driver also supports assigning or revoking multiple plans to a user.

1.4.4 Hybrid Mode

The following figure shows the hybrid mode deployment scenario:

Figure 1-3

In this deployment, Azure AD Connect integrates on-premise Active Directory with Azure Active Directory. Azure Active Directory does not allow modifications on user and group objects that were synchronized through Azure AD Connect. However, it allows you to provision roles and licenses to the users. To accomplish this, you must deploy an Azure AD driver in hybrid mode. To synchronize identities from the Identity Vault to on-premise Active Directory, you must have an AD driver in your environment.

To provision roles and licenses, set the driver in hybrid mode in Designer or OpenText Identity Console. For more information, see Configuring the Driver.

The driver performs the following actions when operating in hybrid mode:

  • When a user is provisioned to AD through AD driver's user account entitlements and the user is synchronized to Azure AD through Azure AD Connect, the driver updates the user association in the OpenText Identity Vault.

  • When a user is deleted from Azure AD, the driver removes the association for the user from the OpenText Identity Vault.

  • When a user is granted or revoked roles or licenses through entitlements, the driver grants or revokes roles or licenses after an association is created for the user.

  • When an account entitlement is revoked for a user in AD, the driver removes the association for the user from the Identity Vault.

NOTE:You cannot add users, delete users, and modify user attributes through the publisher channel when you operate the Azure AD driver in hybrid mode. However, the Azure AD driver will update the associations accordingly.

In hybrid mode, the AD driver's account tracking takes precedence over Azure AD driver. The password synchronization to the Identity Vault is handled by AD driver in hybrid mode.

1.4.5 Entitlements

The Azure AD driver supports entitlements. By default, it supports UserAccount, Group, Licenses, SKU and Roles entitlements.

When using entitlements, an action such as provisioning an account in the target directory is delayed until the proper approvals have been made. In Role-Based Services, rights assignments are made based on attributes of a user object. Entitlements standardize a method of recording this information on objects in the OpenText Identity Vault. From the driver perspective, an entitlement grants or revokes the right to resources in Azure AD. You can use entitlements to grant the rights to an account in Azure AD, to control group membership, roles, and licenses.

1.4.6 Group Cache Clear Interval

The Group cache clear interval is a feature introduced in the Subscriber channel, to improve the driver’s performance while adding or removing group’s members. This parameter can be specified in hours. For example, if you specify 1 in this field, it indicates 1 hour, and 2 indicates 2 hours, etc.

NOTE:

  • This feature is applicable for Driver versions 5.1.4 and later.

  • The Driver also requires an upgrade of the base package to MFAZUREBASE_1.0.3.20210225161038.jar and above, to configure this feature.

The Group cache clear interval feature is applicable only for the following Group types:

  • Distribution Lists

  • Mail Enabled Security Groups

  • Unified/Microsoft 365 Groups

When you add or remove a member to a group for the first time, the driver cache is updated based on the calls made to Azure application. For subsequent modifications to the group membership, the driver makes one call to the application to find the group and retrieves all the other required information from the in-memory cache, thereby reducing the time taken to process the changes of the group membership.

Clearing and rebuilding the cache is an event driven process. The group cache build time starts when an event is processed, and the cache is built as subsequent events occur. Upon processing subsequent events, the driver checks for the value set in the Group cache clear interval parameter in driver configuration. If these subsequent events are encountered:

  • within the specified duration, the group cache is maintained

  • post the specified duration, the cache is cleared and rebuilt. The Group cache build time is also reset.

For example, the driver is started at 9:00 AM with the Group cache clear interval specified in hours as 1, in Driver configuration. Driver processes any event on Subscriber channel at 9:10 AM then this time will be the cache build start time. Post this, the driver processes add or remove members to AzureUnified (Unified type Group) or AzureDistribution (Distribution list type Group) then all the information fetched from the application while processing the modify event gets added to Group Cache, and is maintained until the Group cache clear interval is hit, that is till 10:10 AM and any event processed by Subscriber Channel post 10:10 AM will trigger the group cache to clear, rebuilt and reset the Group cache build start time.

To see the group cache related messages, you must set the trace level to 7.

To specify this value in Designer, double click the Azure Driver’s connector line, and navigate to Driver Configuration > Driver Parameters > Subscriber Options.

Specify a numerical value (for example, -1, 0, 1, 2, etc.) in the Group cache clear interval field. The numerical value specified here corresponds to hours.

  • -1: indicates the cache feature is disabled.

  • 0: indicates that the cache is cleared only upon driver restart.

  • 1: indicates the cache feature is enabled and cleared every one hour.

  • 2: indicates the cache feature is enabled and cleared every two hours.

NOTE:The Group cache feature works only when the member of a group is processed in an event. If any other attribute of a group (for example, description) is modified along with the member addition or removal, this feature does not have any impact.