Forefront / Microsoft Identity Manager does not come with an out-of-the-box management agent for managing SharePoint Online.
Whilst the DirSync/AADConnect solution will allow you to synchronise attributes from your On Premise Active Directory to AzureAD, SharePoint only leverages a handful of them. It then has its own set of attributes that it leverages. Many are similarly named to the standard Azure AD attributes but with the SPS- prefix.
For example, here is a list of SPO attributes and a couple of references to associated Azure AD attributes;
- UserProfile_GUID
- SID
- SPS-PhoneticFirstName
- SPS-PhoneticLastName
- SPS-PhoneticDisplayName
- SPS-JobTitle
- SPS-Department
- AboutMe
- PersonalSpace
- PictureURL
- UserName
- QuickLinks
- WebSite
- PublicSiteRedirect
- SPS-Dotted-line
- SPS-Peers
- SPS-Responsibility
- SPS-SipAddress
- SPS-MySiteUpgrade
- SPS-ProxyAddresses
- SPS-HireDate
- SPS-DisplayOrder
- SPS-ClaimID
- SPS-ClaimProviderID
- SPS-ClaimProviderType
- SPS-SavedAccountName
- SPS-SavedSID
- SPS-ResourceSID
- SPS-ResourceAccountName
- SPS-ObjectExists
- SPS-MasterAccountName
- SPS-PersonalSiteCapabilities
- SPS-UserPrincipalName
- SPS-O15FirstRunExperience
- SPS-PersonalSiteInstantiationState
- SPS-PersonalSiteFirstCreationTime
- SPS-PersonalSiteLastCreationTime
- SPS-PersonalSiteNumberOfRetries
- SPS-PersonalSiteFirstCreationError
- SPS-DistinguishedName
- SPS-SourceObjectDN
- SPS-FeedIdentifier
- SPS-Location
- Certifications
- SPS-Skills
- SPS-PastProjects
- SPS-School
- SPS-Birthday
- SPS-Interests
- SPS-StatusNotes
- SPS-HashTags
- SPS-PictureTimestamp
- SPS-PicturePlaceholderState
- SPS-PrivacyPeople
- SPS-PrivacyActivity
- SPS-PictureExchangeSyncState
- SPS-TimeZone
- SPS-EmailOptin
- OfficeGraphEnabled
- SPS-UserType
- SPS-HideFromAddressLists
- SPS-RecipientTypeDetails
- DelveFlags
- msOnline-ObjectId
- SPS-PointPublishingUrl
- SPS-TenantInstanceId
My customer has AADConnect in place that is synchronising their On Premise AD to Office 365. They also have a MIM 2016 instance that is managing user provisioning and lifecycle management. I’ll be using that MIM 2016 instance to manage SPO User Profile Attributes.
The remainder of this blog post describes the PS MA I’ve developed to manage the SPO attributes to allow their SPO Online Forms etc to leverage business and organisation user metadata.
Using the Granfeldt PowerShell Management Agent to manage SharePoint Online User Profiles
In this blog post I detail how you can synchronise user attributes from your On Premise Active Directory to an associated users SharePoint Online user profile utilising Søren Granfeldt’s extremely versatile PowerShell Management Agent. Provisioning and licensing of users for SPO is performed in parallel by the DirSync/AADConnect solution. This solution just provides attribute synchronisation to SPO User Profile attributes.
Overview
In this solution I’m managing the attributes that are pertinent to the customer. If you need an additional attribute or you have created custom attributes it is easy enough to extent.
Getting Started with the Granfeldt PowerShell Management Agent
First up, you can get it from here. Søren’s documentation is pretty good but does assume you have a working knowledge of FIM/MIM and this blog post is no different.
Three items I had to work out that I’ll save you the pain of are;
- You must have a Password.ps1 file. Even though we’re not doing password management on this MA, the PS MA configuration requires a file for this field. The .ps1 doesn’t need to have any logic/script inside it. It just needs to be present
-
The credentials you give the MA to run this MA are the credentials for the account that has permissions to manage SharePoint Online User Profiles. More detail on that further below.
-
The path to the scripts in the PS MA Config must not contain spaces and be in old-skool 8.3 format. I’ve chosen to store my scripts in an appropriately named subdirectory under the MIM Extensions directory. Tip: from a command shell use dir /x to get the 8.3 directory format name. Mine looks like C:\PROGRA~1\MICROS~4\2010\SYNCHR~1\EXTENS~2\SPO
Managing SPO User Profiles
In order to use this working example there are a couple of items to note;
- At the top of the Import and Export scripts you’ll need to enter your SPO Tenant Admin URL. If your tenant URL is ‘CORP.sharepoint.com’ then at the top of the scripts enter ‘CORP-admin.sharepoint.com’. The Import script will work with corp.sharepoint.com but the export won’t.
-
Give the account you’re using to connect to SPO via your MIM permissions to manage/update SPO User Profiles
- Navigate to your tenant admin URL eg. https://corp-admin.sharepoint.com/_layouts/15/tenantprofileadmin/manageuserprofileserviceapplication.aspx
- Select User Profiles => Manage User Properties
- Add the account you’re connecting to SPO via MIM with and give it Follow People and Edit Profile permissions
Schema.ps1
As mentioned above I’m only syncing attributes pertinent to my customers’ requirements. That said I’ve selected a number of attributes that are potentials for future requirements.
Password Script (password.ps1)
Empty as described above
Import.ps1
A key part of the import script is connecting to SPO and accessing the full User Profile. In order to do this, you will need to install the SharePoint Online Client Components SDK. It’s available for download here https://www.microsoft.com/en-us/download/details.aspx?id=42038
The import script then imports two libraries that give us access to the SPO User Profiles.
Import-Module
‘C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.UserProfiles.dll’
Import-Module
‘C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll’
Import values for attributes defined in the schema.
Export.ps1
The business part of the MA. Basically enough to take attribute value changes from the MV to the SPO MA and export them to SPO. In the example script below I’m only exporting three attributes. Add as many as you need.
Wiring it all together
In order to wire the functionality together, I’m doing it just using the Sync Engine MA configuration as we’re relying on AADConnect to create the users in Office365, and we’re just flowing through attribute values.
Basically, create the PS MA, create your MA Run Profiles, import users and attributes from the PS MA, validate your joins and Export to update SPO attributes as per your flow rules.
Management Agent Configuration
As per the tips above, the format for the script paths must be without spaces etc. I’m using 8.3 format and I’m using the Office 365 account we gave permissions to manage user profiles in SPO earlier.
Password script must be specified but as we’re not doing password management it’s empty as detailed above.
If your schema.ps1 file is formatted correctly you can select your attributes.
I have a few join rules. In the pre-prod environment though I’m joining on WorkEmail => mail.
My import flow is just bringing back in users mobile numbers that users are able to modify in SPO. I’m exporting Title, Location and Department to SPO.
Summary
Using the Granfeldt PowerShell MA it was very easy to manage user SharePoint Online User Profile attributes.
Follow Darren on Twitter @darrenjrobinson