This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AD Sync project with out of scope objects

Hello,

i would need some help to understand how IM treats object that are out of scope, especially the group membership.

Our scenario is the following: the synchronization against AD has been performed in a specific OU's subset (let's call them Corp OUs), and the service account we are using have a delegation to perform creations/deletions/modifications operations just on these Corp OUs. For now our Sync Project has been configured in read-only mode.

This Corp OU will also be the destination container of every user/group currently present in the domain, since we are using IDM to help with the AD reorganization.

At present time we have migrated users in the Corp OU and we have synchronized both users and groups, however some of the synchronized users still have a membership with out of scope groups (groups that are outside the Corp OU)

My question is: what will happens to those scoped-out groups and group membership when we'll switch our Sync Project to read-write mode. Will those out-of-scope groups be removed from the users even if IDM doesn't know anything about those groups? My opinion is that they should be left untouched but i need to be sure about that.

Can someone provide some enlightenment?

Thanks in advance,
Andrea

Parents
  • Hi Andrea,
    Group membership is a function of the group not the user. So since you are not synchronizing the groups, Identity Manager won't know they exist, and so won't do anything with them. I would still test this thoroughly, as this is kind of an unusual architecture choice
Reply
  • Hi Andrea,
    Group membership is a function of the group not the user. So since you are not synchronizing the groups, Identity Manager won't know they exist, and so won't do anything with them. I would still test this thoroughly, as this is kind of an unusual architecture choice
Children
No Data