My fellow MVP Jeff Ingalls released a new cool tool to check your MIM solution against well known best practices. There was a FIM 2010 R2 BPA (Best practice analyzer) in the past but that tool has not get updates for a long time.
So Jeff decided to create his own tool putting in all the know best practices spread over the internet.
These are the bullet points of MIMCheck:
A read-only, stand-alone, remote, command-line tool that performs Microsoft Identity Manager best practice analysis checks.
Version 1.0 features include:
- 38 best practice task checks including data integrity checks of the synchronization service database
- Run an entire category of tasks: syncserver, portalserver, syncdb, portaldb
- Manually specify synchronization or portal server names, ports, instance names, and database names
- Export all tasks, description, and references to output without performing any action
- Verbose output which includes task names, which can be used to run the task individually, requirements to run the task, reference(s) for further reading, a description of the task, number of errors, and a task result.
- Redirection of output to a datetime name stamped file for periodic automation
- Digitally signed
- Licensing options available for consultants and consulting companies who which to use the product as a service and/or charge for the use of the software.
You can download the tool from here: http://www.ingallsdesigns.com/downloads.html
You can drop Jeff a mail for feedback or feature requests.
He did also a small presentation of the tool at the MIM Team User Group meeting yesterday, so you can wait for the recording of that presentation available on the Unify Solutions youtube channel within a few days.
The Identity community project team has recently released the MIM Configuration Documenter on GitHub as an open source project.
Its a very cool and easy tool to document your MIM solution (Sync and Service).
It also supports MIMWAL.
The main intend of that tool is:
- Document deployment configuration details for the MIM / FIM solution!
- Track any configuration changes you have made since a specific baseline!!
- Build confidence in getting things right when making changes to the deployed solution!!
Current Version 1.17.0522.0 is the public beta which has limitation one some Management Agents but I’m sure there is more to come.
You can download precompiled binaries and source code from the Microsoft Repo:
Update: This does not work anymore as described, see my updated blog post on B2B redemption.
I think most of you are familiar with the concept of Azure AD Business-to-Business (B2B) where you can add users of other companies to your Azure AD tenant. This feature does not require the partner organization to already own or manage their own tenant; you can simply invite every user with an email address.
If the invited user already exists in an Azure AD tenant a guest user is created in your tenant that is linked to this user object in the foreign tenant.
If the invited user does not exists in an Azure AD tenant a shadow/unmanaged tenant is created behind the scenes for that user, additional users from the same domain will then created within this unmanaged tenant.
However, if you add a foreign user to your tenant an invitation mail is send to this user you add and the user has to redeem the invitation. By default, users are created as a guest user, which don’t have any permission (even read directory) in your tenant. Nevertheless, you can assign permissions like application permission, Azure AD or RBAC roles to such users.
Continue reading “Azure AD B2B: How to bulk add guest users without invitation redemption.”