Forum - Recent Threads

Connect Active roles to Service Now

kj — Wed, 22 May 2019 15:57:09 GMT

Hello Gurus,

We are planning to integrate Active roles with Service Now. We would really appreciate if someone can share their experience with all the details as what is required on Active roles side and Service now side to establish a bi-directional communication.

Thanks in advance

RE: Connect Active roles to Service Now

allison.lethy — Wed, 28 Oct 2026 16:10:48 GMT

are you able to confirm what the 'correct rights on the ServiceNow side' are required? After created the connection in ARSS > Test Connection, i get an error message that the servicenow instance is not configured properly? The account has a number of roles related to SOAP that were required to get this far.

In a split server scenario (Admin / Web), should I install RSTS on admin or web?

jraines — Wed, 21 Oct 2026 18:42:42 GMT

Our deployment has multiple servers in a split server scenario. Example - 4 admin servers and 3 web servers (one admin is for background jobs). Where is it appropriate to install the RSTS services? They need certificates, so will they co-exist best on the web servers? Or do they need to live on the Admin servers?

For additional info, our web servers are on basic authentication, not on SAML 2.0 All our servers are on prem.

Regards,

Jon

how to update the database when the server is migrated

charleneforbes — Mon, 19 Oct 2026 16:03:00 GMT

Hi,

I'm having trouble logging in to the support portal so hoping I can ask here. Just a quick question, our SQL database admins are planning to migrate the cluster on to a new server. Is it just a case of updating the database connection in the Configuration Center when the work is done?

Thanks

Charlene

RE: how to update the database when the server is migrated

charleneforbes — Tue, 20 Oct 2026 14:53:21 GMT

HI, thanks for that, I managed to email support and get my account restored. Their advice was similar; essentially migrate the database with all the same permissions, redo the connection with configuration manager, then restart the Active Roles admin service.

RE: how to update the database when the server is migrated

richard lambert — Tue, 20 Oct 2026 13:22:54 GMT

Hello, the below steps are from KB article "Migrate the Microsoft SQL Active Roles databases" (000004980)

HOW TO: Migrate the Microsoft SQL Active Roles databases

And once your support portal is restored, there is another KB article to review: SQL settings for Active Roles performance (000016273)

You can submit a general case here to have your access restored:

https://support-user.oneidentity.com/s/submit-case

From KB000004980, to migrate the DB:

Problem Description

It might be necessary for performance, capacity, or supportability reasons to migrate the Active Roles SQL Configuration and/or Management History databases from the existing SQL host to a new one.

NOTE: If SQL Database replication is enabled, it will be necessary to break replication, delete all subscribers, and demote the Publisher before proceeding with the below steps, as mixed SQL versions are not supported within a SQL Replication Group.

After the below steps have been completed, SQL Replication will need to be reconfigured from scratch.

Resolution

Open the Active Roles Configuration Center. On the Administration Service tab, under the Active Roles databases section, note the current Active Roles Service Account, Active Roles Admin Group, and the Configuration and/or Management History database server and database names.
Stop the Active Roles Administration Service on all Active Roles Administration Service hosts.
In SQL Server Management Studio on the current Microsoft SQL Server host, back up the noted database(s) to disk. For assistance with backing up the databases please see this Microsoft resource.
Copy the database backup files to the target Microsoft SQL Server host or to a network location accessible from that host.
In SQL Server Management Studio, create a new Configuration database and restore the backup. Repeat for the Management History database if a separate database is used. For assistance with restoring a database please see this Microsoft resource.
Ensure that the necessary permissions for the Active Roles Service Account are added to the new SQL instance. db_owner and/or sysadmin should be sufficient.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\One Identity\Active Roles\Configuration\Service
Set the Configured DWORD value to 0.
Close and then reopen the Active Roles Configuration Center.
On the Dashboard tab, under the Administration Service, click on Configure
Specify the Service Account which was previously noted in the Active Roles Configuration Center in Step 1 above. Click Next.
Specify the Active Directory Group granted the Active Roles Admin Role which was previously noted in the Active Roles Configuration Center in Step 1 above. Click Next.
On the Database Options screen, choose to use an Existing Active Roles database and click Next.
Specify the new SQL Server host and the configuration database name. Click Next and Change, then Finish.
The Active Roles Administration Service will need to be restarted. Choose Restart now in the prompt which appears in order to continue.
If Management History is stored in a separate database, choose the Change button in the Active Roles database section.
Check the box labeled Store management history data in a separate database (advanced) and click Next.
Choose to use an Existing Active Roles database and click Next.
Specify the SQL Server and database name of the new Management History database and click Next and Change, then Finish.
The Active Roles Administration Service will need to be restarted. Choose Restart now in the prompt which appears in order to complete the process.

RE: how to update the database when the server is migrated

georgesalazar789 — Tue, 20 Oct 2026 08:08:45 GMT

We are planning to migrate our SQL database cluster to a new server, and I would like to understand the steps required to ensure everything continues working properly after the migration. Our SQL database administrators will be handling the server-side work, but I am not entirely sure what needs to be changed on the application side. My first thought was that updating the database connection details in the Configuration Center might be enough, but I would appreciate confirmation from anyone who has completed a similar migration.

Before making any changes, I assume it is important to verify that the database has been migrated successfully and that all the required data, users, permissions, and stored procedures are available on the new server. We would also need to confirm the correct server name, database name, authentication method, and connection settings. If the application uses a specific service account or encrypted connection, those details may need to be checked as well. I would prefer to understand the complete procedure beforehand rather than risk an unexpected interruption when the application tries to connect to the new database.

Has anyone experienced this type of SQL database migration and can explain whether changing the connection settings in the Configuration Center is sufficient, or whether additional steps are necessary? For example, do we need to restart any application services, update other configuration files, or verify the connection through a separate test? I would appreciate any practical advice on the recommended migration sequence, including what should be checked before switching over and how to confirm that the application is functioning correctly afterward. Thanks in advance for sharing your experience and recommendations.

RE: Unable to delete computer objects since updating to 8.5

craig mcfarlane — Thu, 15 Oct 2026 12:57:13 GMT

Yep. Running in production and its has fixed the issue

Unable to delete computer objects since updating to 8.5

charleneforbes — Wed, 29 Jul 2026 10:08:32 GMT

Hi,

I updated from 8.2.1 to 8.5 a couple of days ago and the update went fine but since then no one, not even the AR admins, can delete computer objects. I thought it was the msFVE-RecoveryInformation objects they couldn't delete, but it worked before the update. I' followed the instructions in this link but it didn't help. Unable to delete computer objects with BitLocker subtree/leaf object (4226632)

Delegates have full control of computer objects and delete child objects access to the OUs they're in, but even the AR admins like me can't delete computers. The initial message that comes up when we try to delete one is for the recovery info and that comes up with an error Administrative Policy returned an error, object reference not set to an instance of an object. If I say no to deleting the recovery info I then get to the message about deleting the computer itself, but trying to delete that comes up with a message saying You do not have sufficient privileges to delete......this object is protected from accidental deletion. The directory service can perform the requested operation only on a leaf object. I've checked the the computers are NOT protected from deletion (we can delete the same object directly in AD) and enabling the protection then removing it didn't make any difference. I even ran native AD as the service account and could delete a computer with that, so it['s only via Active Roles itself it doesn't work. Very confusing!

Any ideas? Has anyone else come across this?

Thanks

RE: Unable to delete computer objects since updating to 8.5

leejohnc — Thu, 15 Oct 2026 12:48:54 GMT

ARS 8.7 does seem to have resolved this issues. The resolution is mentioned in the release notes for the newest version, and our testing in non-production has confirmed it resolved for us.

RE: Unable to delete computer objects since updating to 8.5

attila keresztes — Thu, 15 Oct 2026 12:00:18 GMT

Hi all, sorry this took a while. This is a known Active Roles deletion issue (KB [4383759](support.oneidentity.com/.../computer-object-with-leaf-object-cannot-be-deleted)). One community member reported that this Active Roles PowerShell command worked when MMC deletion failed:

```powershell
$Connection = Connect-QADService -Proxy -Service '<AdminServiceFQDN>'
$Computer = Get-QADComputer -Identity '<computerName>' -Connection $Connection
Remove-QADObject -Identity $Computer.DN -Connection $Connection -Force -DeleteTree
```

`-DeleteTree` removes the computer and its child objects, so verify the target and test safely before using it. This workaround was reported in one environment and may not work in every setup. Please check the KB or Support for the current public fix status.

RE: Deprovision Entra ID user

attila keresztes — Thu, 15 Oct 2026 11:57:52 GMT

Hi Chinmoy, thanks for the extra details. There are two different object types here:

1. For users in Entra DS, changes synced from Entra ID happen outside Active Roles. An Active Roles change workflow normally won't be triggered by that external sync. For periodic checks, JohnnyQuest's scheduled Automation Workflow / Managed Unit approach is a reasonable starting point.
2. For Entra ID cloud objects, Get-QADUser and Set-QADUser aren't the right cmdlets. I can't confirm the supported way to read/write an Active Roles virtual attribute on those objects without knowing your Active Roles version. Could you share the version and confirm whether the attribute is on an Entra ID cloud user or an Entra DS user? Then we can check the supported method and the workflow search settings.

Please test the scheduled search on a test user first and share any errors.

Deprovision Entra ID user

chinmoy jena — Mon, 05 Oct 2026 18:52:23 GMT

Hi,

I'm building a new environment where we will be managing all Entra ID users using Active roles. There is no Active directory user to be managed.

I have a script that has all the deprovision task defined and works perfectly. I created a virtual attribute and trying to trigger a workflow (that will trigger the script) when the entra users virtual attribute is modified.

But problem is the workflow doesn't trigger when virtual attribute is modified.

can someone please help me?

We have a ActiveRoles Web Connector API configure in Entra, Where and how do I renew the Certificate that is expiring in API. Version in Desc. Thanks

jysantos — Wed, 11 Mar 2026 15:55:11 GMT

We have a ActiveRoles Web Connector API configure in Entra, Where and how do I renew the Certificate that is expiring in API. Version 8.1.5 and where to find in ARS? Thanks

Appreciate your inputs or any article to help me get and upload the new certificate in Entra.

RE: We have a ActiveRoles Web Connector API configure in Entra, Where and how do I renew the Certificate that is expiring in API. Version in Desc. Thanks

leejohnc — Mon, 12 Oct 2026 12:52:00 GMT

I just tried to remove and readd the app, and it wouldn't let me

RE: Deprovision Entra ID user

chinmoy jena — Tue, 06 Oct 2026 13:40:46 GMT

Thanks JohnnyQuest

1. We have Entra DS added as a managed domain. Which has a dirsync server connected. In this case Active roles should be able to detect the chnages as the changes are flown from Entra ID to Entra DS?

2. Search in the workflow: Does the workflow search works with the entra objects in a management group ? If yes, can you confirm me the settings need to be used?

a. Use this activity to: (trying with "Search in the organizational unit or container")

b. Find: (will the user option works?) In: (targeting to managed unit containing the Entra object)

I have tried all the possible options. Do you have a proven method that it works ?

One more additional questions:

How can I read / write a virtual attribute of an Entra user using powershell ? Get-Qaduser / Set-Qaduser works for AD / Entra DS users, but not for Entra ID user account. I can access via GUI, but not Via powershel.

RE: Deprovision Entra ID user

JohnnyQuest — Mon, 05 Oct 2026 19:21:10 GMT

I don't think Change Workflows work with Entra objects.

A good work around would be to:

1) Create a Managed Unit who's membership rule is to look for objects with the virtual attribute set - i.e. containing a value such as "DEPROV ME"
2) Create an Automation Workflow that searches the Managed Unit - you can implement this as a search in the workflow or within your script's code - your choice.
3) Schedule your workflow to run as often you see fit - maybe every 15 minutes?

RE: AR access M365 tenant with M365\ServicePricipal and MFA?

JohnnyQuest — Thu, 01 Oct 2026 20:10:43 GMT

MFA is not really practical for a Service Principal but you could add a measure of security to it by making it subject to Conditional Access policy.

AR access M365 tenant with M365\ServicePricipal and MFA?

Aidar.Karabalaev — Thu, 01 Oct 2026 17:36:50 GMT

Hello ActiveRoles experts,

Many my customers raise questions: is it possible to somehow turn on MFA on AR to access M365 tenant via M365\ServicePrincipal?
If not, then is there anything instead of MFA? To secure the channel.
Given, MSFT policy suggests – any M365 tenant admins must use MFA to manage M365 cloud objects.
Any suggestions?

Thank you!

I need to query Azure Entra for inactive users before deprovisioning AD accounts

jraines — Wed, 30 Sep 2026 23:59:27 GMT

We have hybrid users in AD and Entra that are being deprovisioned if they don't sign into AD within the 180 day time period. For various reasons they are hybrid users instead of cloud only. So I need to check with Azure Entra sign-ins before deprovisioning

I've tried my hand at writing a script (below) using $context but I can never get it to return any data. I'm probably missing something obvious, and there's test garbage in my script (so you can see where I'm going down wrong paths).

I read something about having to set the tenant in order to use context, but I couldn't figure that out. Anyway... here's the attempt. Any help is appreciated as I have a few VIPs asking about this.

function Get-AzureInactiveAccounts
{

$error_count = 0
$error_messages = @()
try {
$now = Get-Date -Format "yyyy-MM-dd_HHmmss"
# Import Microsoft Graph module via Active Roles context (specifying major version 2)
$context.O365ImportModule("Microsoft.Graph", 2)

#connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"
# Calculate the OData-formatted timestamp for $days_back days ago
$days_back = 75
$CutoffDate = (Get-Date).AddDays(-$days_back).ToString("yyyy-MM-ddTHH:mm:ssZ")

$user_export_path = "C:\temp\InactiveUsers_$now.csv"
# Filter directly inside the Graph command
# This only downloads users whose last login attempt was > $days_back days ago
$InactiveUsers_cmd = "Get-MgUser -All -ConsistencyLevel eventual -Filter 'accountEnabled eq true and signInActivity/lastSignInDateTime lt $CutoffDate' `
-Property Id, DisplayName, UserPrincipalName, AccountEnabled, SignInActivity | Out-File -File $user_export_path"
$context.O365ExecuteScriptCmd($InactiveUsers_cmd)
#Test to see if the file exists
if (-Not (Test-Path -Path $user_export_path)) {
throw "Failed to create inactive users export file at $user_export_path"
}
Add-Content -Path $user_export_path -Value "Retrieved inactive users at $now"
$InactiveUsers = Get-Content -Path $user_export_path

} catch {
$errorstack = $_.ScriptStackTrace
$error_count++
$error_messages += "Error retrieving inactive Azure AD users: $_ Stack: $errorstack"
}

RE: I need to query Azure Entra for inactive users before deprovisioning AD accounts

JohnnyQuest — Thu, 01 Oct 2026 14:13:09 GMT

You are correct that in order to use the $Context, you need to have your M365 tenant setup in your Active Roles Configuration Center.

In brief, setting up the tenant in the Configuration Center will create a Service Principal in your tenant that Active Roles will use for accessing Entra objects.

With that in place, the $Context object will now be able to leverage that Service Principal to perform your script's actions.

RE: Upgrading from 8.2.1 to 8.6 - should I do 8.3 first and then 8.6, or what path is best?

jraines — Mon, 28 Sep 2026 15:57:06 GMT

We don't have a lot of Bitlocker devices. We do have some in one part of the organization, but we're not storing Bitlocker keys in AD. They manage them other ways.

We have a significant number of computer devices that our staff need to be able to delete if they are reimaging, so that does sound like a showstopper.

Upgrading from 8.2.1 to 8.6 - should I do 8.3 first and then 8.6, or what path is best?

jraines — Tue, 22 Sep 2026 18:46:35 GMT

I need to upgrade ARS to current version (8.6), but I'm still back on 8.2.1 It seems that 8.3 was a significant upgrade and then 8.6 was a chain of fixes and updates to 8.3 So should I move to 8.3 and confirm that, or is it possible (wise?) to go directly to 8.6?

Powershell cmd to remove single user among multiple from secondary owners.

c0dac0da — Fri, 25 Sep 2026 12:28:55 GMT

Trying to use the below script to remove one user from a list of secondary users however the result is the first user in the script is getting removed and not the user that is defined. Any suggestions?

Set-QADObject -Identity "ADGroup" -ObjectAttributes @{ edsvaSecondaryOwners= @{remove=@(CN of the user)}}

RE: Powershell cmd to remove single user among multiple from secondary owners.

c0dac0da — Fri, 25 Sep 2026 15:37:14 GMT

Thanks Richard, delete instead of remove did the trick.