We would like to empower certain members of our Service Desk to issue TAP (Temporary Access Passwords) via Active Roles instead of granting Azure PIM roles.   I can find the powershell scripts that will do it, but they require MS Graph credentials.   Is there…

We are trying to configure RSTS in Active Roles 8.3 to use it's native API, but after creating and configuring an application in the RSTS Admin page, the RSTS tab in Active Roles Configuration Center displays an error, "A communication error occured between…

The Active Roles Support Team has a new offering which we hope will help to identify configuration and performance-related issues in customer environments:

https://github.com/OneIdentity/active-roles-assessment-script 

This script is safe to run in all…

Hi everyone,

There was a bug from a previous version of Active Roles from a few years ago where searching for an account and going to Exchange Online Properties didn't show anyone in Full Access but did in Send As.  The Full Access does show if you…

I ran my ps script directly on the server is work well but for some reason when I import to the Active Roles I got an error Term Get-ADUser is not recognized

hope someone could help me :-)

Get-ADUser -Filter * -SearchBase "DC=xxx,DC=xxx" -Properties …

Hi,

I'm using Active Roles 8.1.3 and I created a virtual attribute, added it to the user object and added it on the web console against user.  I later realised I could do what I wanted to do a lot easier with a managed unit so I deleted the attribute…

from One Identity documentation...

"Enabled User Accounts are all the user accounts in the domain(s) to be managed by the Software, including, but not limited to, users' logon accounts, secondary accounts tied to users, administrative accounts, service…

Hello,

I'm trying to create a workflow that will update user's description if the company or TAM_AppsScope attributes are modified.

Company is the AD attribute (single string) whereas TAM_AppsScope is an ARS VA (multi-valued string).

In my workflow…

Hi everyone,

The Active Roles console has an Additional Account Info tab which includes the password last set and password age (days) attributes; is there a way to display these in the web version?  I don't see them in the list when I try to customise…

Hi everybody,

In our environment we need to create temporary users in active directory and deprovision them after X hours (with a maximum of 12 hours).

We thought of using AD group temporary memberships.

Specifically, when a user is created, it is added…

My users are complaining that they can't see entire branches of the tree view.   We're working on weaning users off ADUC and this is a concern because ADUC users are accustomed to working from the tree view.  

Is there a security setting that exposes…

When I run below cmdlet from server "A", system returns below exception. However, another engineer runs same cmdlet from server "B", it works fine from his end. I was told that probably ARS module is missing but I do not know what ARS module is missing…

After importing ActiveRolesManagementShell module into powershell script, I was able to run Get-QADuser cmdlet successfully.  From this article, Get-QADUser Reference – iTomation I found different ways of using Get-QADUser cmdlet.

I am looking for…

Hi, 

I'm using the following command to set account expiration date but it is not working. 

Set-QADUser -Identity username -AccountExpires date

The AccountExpires value changes, but not AccountExpirationStatus value doesn't changes. Also, on the…

Hi, 

I'm using the following command to set account expiration date but it is not working. 

Set-QADUser -Identity username -AccountExpires date

The AccountExpires value changes, but not AccountExpirationStatus value doesn't changes. Also, on the…

Hi, 

I'm using the following command to set account expiration date but it is not working. 

Set-QADUser -Identity username -AccountExpires date

The AccountExpires value changes, but not AccountExpirationStatus value doesn't changes. Also, on the…

Hello -

I've inherited an Active Roles installation on an AD domain so I'm still learning some of the ins and outs of it.

I have a need to create an OU structure, within our existing managed domain, that is not managed by Active Roles.  So, effectively…

Hi guys,

I'm currently trying to build a guest account invitation process in ARS (8.1.5.) and added several new virtual attributes to the "EDS-Azure-GuestUser" class.

Is there a way to add those attributes to a policy? When I select "EDS…

Hi all. Is there a way to publish data (write-back or outbound events) from ARS to an SCIM endpoint?

AFAIK the SCIM connection can only be used as source.

Any thoughts?

So, customer is interested in using ARS to connect to a middleware through some kind of not yet defined protocol (SCIM maybe?) in order to do user management and provisioning for multiple systems.

Rules for each system will remain in middelware layer…

Hi,

I want to configure just-in-time-privileges so that when I check out an AD-account in Safeguard SPP this account will be enabled and configured as a member of a group in AD, i.e. Domain Admins. I find several videos and demos describing this, but…

Gi w og waj off fi osukh vbs kv vk kh gi gesi og  zeb bheed if garib esn mg zade

Getting an issue with QAD Powershell Cmdlets in Windows 11, running ARS 8.1.5:

The below works fine when ran from the ARS (Windows 2022) Server - all Deprov tasks complete as per the deprovisioning policy based on the Managed Unit:

Connect-QADService -Service…

Hi,

I have been trying to get additional attributes (description f.e.) when copy a user from Web Interface, but with $Request method on a Powershell script it's has been impossible to get the source object.

I finally used the VB scipt that is at the…

I created a Managed Unit with multiple Include queries.  The result shows me the display name, distinguished name and SAM account name of user objects.

Is it possible to export (powershell) this list to a CSV file?