One Identity Active Roles delivers automated user account and group management that overcomes the shortcomings of native Microsoft Active Directory and Azure Active Directory tools. These enhanced identity-management capabilities enable you to do your job more efficiently, more accurately, and with less manual intervention. Active Roles is designed with a
modular architecture, so your organization can easily meet your business
requirements today and in the future. With Active Roles, you can automate
tedious and error-prone administrative tasks and solve security issues by
protecting and controlling all-important administrative access.
Active Roles
Management and Security for Hybrid Active Directory and Beyond
02:59
Key benefits
Automate AD/AAD administration
Regulate admin access
Overcome native AD tool limitations
Expand AD control beyond Windows
Capabilities
Hybrid AD ready
Active Roles is optimized to serve the needs of both on-prem AD and Azure AD in a hybrid deployment. It offers a single console, unified workflows and a consistent administrative experience across your entire hybrid environment. It eliminates the cumbersome, error-prone, and unnecessary challenges that come with using separate native tools and manual processes.
Secure access
Active Roles provides comprehensive privileged account management for Active Directory and Azure Active Directory, enabling you to control access through delegation using a least-privilege model. Based on defined administrative policies and associated permissions, it generates and strictly enforces access rules, eliminating the errors and inconsistencies common with native approaches to hybrid AD management. Plus, robust and personalized approval procedures establish an IT process and oversight consistent with business requirements, with responsibility chains that complement the automated management of directory data.
Automate account administration
Active Roles automates a wide variety of tasks, including:
- Creating user accounts and groups in AD and AAD
- Extending AD/AAD-based account administrative actions to non-Windows systems and SaaS applications
- Creating mailboxes in Exchange and Exchange Online
- Populating groups across AD and AAD
- Assigning resource in Windows
It also automates the process of reassigning and removing user access rights in AD, AAD and AD-joined systems (including user and group de-provisioning) to ensure an efficient and secure administrative process over the user and group lifecycles. When a user’s access needs to be changed or removed, updates are made automatically across all relevant systems and applications in the hybrid AD/AAD environment, as well as AD-joined systems, including UNIX, Linux, Mac OS X rich (replace ‘as well as’ with ‘and’) and a growing collection of popular SaaS applications via the One Identity Starling Connect solution.
Day to day directory management
With Active Roles, you can easily manage all of the following for both the on-prem and Azure AD environments:
- Exchange recipients, including mailbox/OCS assignment, creation, movement, deletion, permissions and distribution list management
- Groups
- Computers, including shares, printers, local users and groups
- Active Directory and Azure Active Directory
Active Roles includes intuitive interfaces to optimize day-to- day administration and help-desk operations of the hybrid AD/AAD environment via both an MMC snap-in and a web interface.
Extend the administrative scope
Active Roles supports the SCIM standard, which allows any SCIM-enabled SaaS application (via One Identity Starling Connect) to be embraced in the AD-based account and group administration capabilities of Active Roles.
Manage groups and users in a hosted environment
Synchronize AD domain clients with host AD domain in hosted environments. Active Roles enables user and group account management from the client domain to the hosted domain, while also synchronizing attributes and passwords. Utilize out-of-the-box connectors to synchronize your on-premises AD accounts to Microsoft Office 365, Lync Online / Skype for Business and SharePoint Online.
Consolidate management points through integration
Active Roles complements your existing technology and IAM strategy. It simplifies and consolidates management points by ensuring easy integration with many One Identity products, including Identity Manager, Safeguard, Authentication Services, Password Manager and ChangeAuditor. Active Roles also automates and extends the capabilities of PowerShell, ADSI, SPML and customizable web interfaces.
Active Roles comes with all the synchronization technology necessary to manage and secure:
- Oracle Database
- Oracle Unified Directory
- Micro Focus NetIQ Directory
- IBM AS/400
- Lync / Skype for Business
- Exchange
- One Drive
- SharePoint
- AD LDS
- Office 365 (including roles and groups)
- Azure AD
- Microsoft SQL Server
- OLE DB (MS Access)
- Flat file
Automatic, consistent, and complete management
Active Roles overcomes the shortcomings of native tools for hybrid Active Directory management and security
Supported platforms
Lync / Skype for Business
Exchange
One Drive
SharePoint
AD LDS
Office 365
Azure AD
Microsoft SQL Server
OLE DB (MS Access)
Flat file
-
Single Pane of Glass
Manage all systems in your hybrid AD environment with a single pane of glass
-
Access Templates
Accelerate provisioning with simple, easily managed access templates
-
Drag and Drop Workflows
Enjoy simplicity with drag-and-drop workflows for user, admin and group tasks
-
Security Policy
Place 'guard rails' around data in AD for efficiency and security
-
Change History
Single-mouse-click view of the "who/what/when/where" of particular objects
-
Identity Analytics
Elegant user-rights interface heads off potential problems and reduces risk
Single Pane of Glass
Access Templates
Drag and Drop Workflows
Security Policy
Change History
Identity Analytics
Specifications
Before installing Active Roles 7.4, ensure that your system meets the following minimum hardware and software requirements.
Active Roles includes the following components:
- Administration Service
- Web Interface
- Console (MMC Interface)
- Management Tools
- Synchronization Service
This section lists the hardware and software requirements for installing and running each of these components.
- Platform
Any of the following:
- Intel 64 (EM64T)
- AMD64
- Processor speed: 2.0 GHz or faster
For best results, a multi-core processor recommended.
- Memory
At least 2 GB of RAM. The amount required depends on the total number of managed objects.
- Hard Disk Space
100 MB or more of free disk space. If SQL Server and Administration Service are installed on the same computer, the amount required depends on the size of the Active Roles database.
- Operating System
You can install Administration Service on a computer running:
- Microsoft Windows Server 2019, Standard or Datacenter edition
- Microsoft Windows Server 2016, Standard or Datacenter edition
- Microsoft Windows Server 2012 R2, Standard or Datacenter edition
- Microsoft Windows Server 2012, Standard or Datacenter edition
NOTE: Active Roles is not supported on Windows Server Core mode setup.
- Microsoft .NET Framework
Administration Service requires Microsoft .NET Framework 4.7.2 (see “Installing the .NET Framework” at http://go.microsoft.com/fwlink/?LinkId=257868).
- SQL Server
You can host the Active Roles database on:
- Microsoft SQL Server 2017, any edition
- Microsoft SQL Server 2016, any edition
- Microsoft SQL Server 2014, any edition, 32-bit (x86) or 64-bit (x64), with or without any Service Pack
- Microsoft SQL Server 2012, any edition, 32-bit (x86) or 64-bit (x64), with or without any Service Pack
- Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL)
- Windows Management Framewor
On all supported operating systems, the Administration Service requires Windows Management Framework 5.1 (see “Windows Management Framework 5.1” at http://go.microsoft.com/fwlink/?LinkId=272757).
- Operating system on domain controllers
Active Roles retains all features and functions when managing Active Directory on domain controllers running any of these operating systems, any edition, with or without any Service Pack:
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2012
Active Roles deprecates managed domains with the domain functional level lower than Windows Server 2012. We recommend that you raise the functional level of the domains managed by Active Roles to Windows Server 2012 or higher.
NOTE: Active Roles is not supported on Windows Server Core mode setup.
- Exchange Server
Active Roles is capable of managing Exchange recipients on:
- Microsoft Exchange Server 2019
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2010 Service Pack 3
- Microsoft Exchange 2013 CU11 is no longer supported. Refer KB article 202695.
- Platform
Any of the following:
- Intel 64 (EM64T)
- AMD64
- Processor speed: 2.0 GHz or faster
- Memory
At least 2 GB of RAM. The amount required depends on the total number of managed objects.
- Hard Disk Space
About 100 MB of free disk space.
- Operating System
You can install Web Interface on a computer running:
- Microsoft Windows Server 2019 Standard or Datacenter edition
- Microsoft Windows Server 2016, Standard or Datacenter edition
- Microsoft Windows Server 2012 R2, Standard or Datacenter edition
- Microsoft Windows Server 2012, Standard or Datacenter edition
NOTE:Active Roles is not supported on Windows Server Core mode setup.
- Microsoft .NET Framework
Web Interface requires Microsoft .NET Framework 4.7.2 (see “Installing the .NET Framework” at http://go.microsoft.com/fwlink/?LinkId=257868).
- Internet Services
On Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 Web Interface requires the Web Server (IIS) server role with the following role services:
- Web Server/Common HTTP Features/
- Default Document
- HTTP Errors
- Static Content
- HTTP Redirection
- Web Server/Security/
- Request Filtering
- Basic Authentication
- Windows Authentication
- Web Server/Application Development/
- .NET Extensibility
- ASP
- ASP.NET
- ISAPI Extensions
- ISAPI Filters
- Management Tools/IIS 6 Management Compatibility/
- IIS 6 Metabase Compatibility
- Handler Mappings
- Modules
Internet Information Services (IIS) must be configured to provide Read/Write delegation for the following features:
Use Feature Delegation in Internet Information Services (IIS) Manager to confirm that these features have delegation set to Read/Write.
- Web Server/Common HTTP Features/
- Web browser
You can access Web Interface using:
- Firefox 36 on Windows
- Google Chrome 61 on Windows
- Windows Internet Explorer 11
- Microsoft Edge on Windows 10
You can use a later version of Firefox, Google Chrome or Internet Explorer to access Web Interface; however, Web Interface 7.4 has been tested only against the browser versions listed above.
- Minimum screen resolution
Web Interface is optimized for screen resolutions of 1280 x 800 or higher. The minimum supported screen resolution is 1024 x 768.
- Platform
Any of the following:
- Intel x86
- Intel 64 (EM64T)
- AMD64
- Processor speed: 1.0 GHz or faster
- Memory (RAM)
At least 1 GB of RAM. The amount required depends on the total number of managed objects.
- Hard Disk Space
About 100 MB of free disk space.
- Operating System
You can install Active Roles console on a computer running:
- Microsoft Windows Server 2019, Standard or Datacenter edition
- Microsoft Windows Server 2016, Standard or Datacenter edition
- Microsoft Windows Server 2012 R2, Standard or Datacenter edition
- Microsoft Windows Server 2012, Standard or Datacenter edition
- Microsoft Windows 8.1, Professional or Enterprise edition, 32-bit (x86) or 64-bit (x64)
- Microsoft Windows 7 Ultimate, Professional, or Enterprise edition, 32-bit (x86) or 64-bit (x64) Service Pack 1
- Microsoft Windows 10, Professional or Enterprise edition, 32-bit (x86) or 64-bit (x64)
NOTE: Active Roles is not supported on Windows Server Core mode setup.
- Microsoft .NET Framework
Active Roles console requires Microsoft .NET Framework 4.7.2 (see “Installing the .NET Framework” at http://go.microsoft.com/fwlink/?LinkId=257868).
- Web browser
Active Roles console requires Internet Explorer 11.
Management Tools is a composite component that includes the Active Roles Management Shell, ADSI Provider, and SDK. On a 64-bit (x64) system, Management Tools also include the Active Roles Configuration Center.
- Platform
Any of the following:
- Intel x86
- Intel 64 (EM64T)
- AMD64
- Processor speed: 1.0 GHz or faster
- Memory (RAM)
At least 1 GB of RAM.
- Hard Disk Space
About 100 MB of free disk space.
- Operating System
You can install Management Tools on a computer running:
- Microsoft Windows Server 2019, Standard or Datacenter edition
- Microsoft Windows Server 2012 R2, Standard or Datacenter edition
- Microsoft Windows Server 2012, Standard or Datacenter edition
- Microsoft Windows Server 2016, Standard or Datacenter edition
- Microsoft Windows 8.1, Professional or Enterprise edition, 32-bit (x86) or 64-bit (x64)
- Microsoft Windows 10, Professional or Enterprise edition, 32-bit (x86) or 64-bit (x64)
NOTE: Active Roles is not supported on Windows Server Core mode setup.
- Microsoft .NET Framework
Management Tools require Microsoft .NET Framework 4.7.2 (see “Installing the .NET Framework” at http://go.microsoft.com/fwlink/?LinkId=257868).
- Windows Management Framework
On all supported operating systems, Management Tools require Windows Management Framework 5.1 (see “Windows Management Framework 5.1” at https://www.microsoft.com/enus/download/details.aspx?id=54616).
- Remote Server Administration Tools (RSAT)
To manage Terminal Services user properties by using Active Roles Management Shell, Management Tools require Remote Server Administration Tools (RSAT) for Active Directory. See Microsoft’s documentation for instructions on how to install Remote Server Administration Tools appropriate to your operating system.
- Platform
Any of the following:
- Intel 64 (EM64T)
- Processor speed: 2.0 GHz or faster
- AMD64
For best results, a multi-core processor recommended.
- Memory
At least 2 GB of RAM. The amount required depends on the number of objects being synchronized.
- Hard disk space
250 MB or more of free disk space. If SQL Server and Synchronization Service are installed on the same computer, the amount required depends on the size of the Synchronization Service database.
- Operating System
You can install the Synchronization Service on a computer running:
- Microsoft Windows Server 2019, Standard or Datacenter edition
- Microsoft Windows Server 2016, Standard or Datacenter edition
- Microsoft Windows Server 2012 R2, Standard or Datacenter edition
- Microsoft Windows Server 2012, Standard or Datacenter edition
NOTE:Active Roles is not supported on Windows Server Core mode setup.
- Microsoft .NET Framework
Synchronization Service requires Microsoft .NET Framework 4.7.2 (see “Installing the .NET Framework” at http://go.microsoft.com/fwlink/?LinkId=257868).
- SQL Server
You can host the Synchronization Service database on:
- Microsoft SQL Server 2017, any edition
- Microsoft SQL Server 2016, any edition
- Microsoft SQL Server 2014, any edition, 32-bit (x86) or 64-bit (x64), with or without any Service Pack
- Microsoft SQL Server 2012, any edition, 32-bit (x86) or 64-bit (x64), with or without any Service Pack
- Windows Management Framework
On all supported operating systems, the Synchronization Service requires Windows Management Framework 5.1 (see “Windows Management Framework 5.1” at https://www.microsoft.com/enus/download/details.aspx?id=54616).
- Supported connections
The Synchronization Service can connect to:
- Microsoft Active Directory Domain Services with the domain or forest functional level of Windows Server 2012 or higher
- Microsoft Active Directory Lightweight Directory Services running on any Windows Server operating system supported by Microsoft
- Microsoft Exchange Server version 2019, 2016, 2013, or 2010
NOTE: Microsoft Exchange 2013 CU11 is no longer supported. Refer KB article 202695.
- Microsoft Lync Server version 2013 with limited support
- Microsoft Skype for Business 2019, 2016 or 2015
- Microsoft Windows Azure Active Directory using the Azure AD Graph API version 1.6.
- Microsoft Office 365 directory
- Microsoft Exchange Online service
- Microsoft Skype for Business Online service
- Microsoft SharePoint Online service
- Microsoft SQL Server, any version supported by Microsoft
- Microsoft SharePoint 2019, 2016, or 2013
- Active Roles version 7.4, 7.3, 7.2, 7.1, 7.0, and 6.9
- One Identity Manager version 7.0 (D1IM 7.0)
- One Identity Manager version 8.0
- Support for Generic LDAP Connector, MY SQL Connector, Open LDAP Connector, IBM Db2 Connector, Salesforce Connector, Service now Connector, and RACF Connector.
- Data sources accessible through an OLE DB provider
- Delimited text files
- Legacy Active Roles ADSI Provider
To connect to Active Roles version 6.9, the Active Roles ADSI Provider of the respective version must be installed on the computer running the Synchronization Service. For installation instructions, see the Quick Start Guide for the appropriate Active Roles version.
- Microsoft Exchange Server Management Tools
To connect to Exchange Server 2007, the Exchange 2007 SP3 management tools must be installed on the computer running the Synchronization Service. For installation instructions, see “How to Install the Exchange 2007 Management Tools” at http://go.microsoft.com/fwlink/?linkid=88090.
- Azure AD Module for Windows PowerShell Version 2
To connect to the Office 365 directory, the following module must be installed on the computer running the Synchronization Service:
- Azure Active Directory Module for Windows PowerShell
For installation instructions, see “Install the Azure AD Module” at https://docs.microsoft.com/en-us/powershell/azure/active-directory/install-adv2?view=azureadps-2.0.
- Windows PowerShell Module for Skype for Business Online
To connect to the Lync Online service, Windows PowerShell Module for Lync Online must be installed on the computer running the Synchronization Service. For installation instructions, see “Windows PowerShell Module for Lync Online” at http://go.microsoft.com/fwlink/?LinkId=294688.
- SharePoint Online Management Shell
To connect to the SharePoint Online service, SharePoint Online Management Shell must be installed on the computer running the Synchronization Service. For installation instructions, see “SharePoint Online Management Shell” at http://go.microsoft.com/fwlink/?LinkId=255251.
- One Identity Manager API
To connect to One Identity Manager 7.0, One Identity Manager Connector must be installed on the computer running the Synchronization Service. This connector works with RESTful web service and SDK installation is not required.
- Internet Connection
To connect to cloud directories or online services, the computer running the Synchronization Service must have a reliable connection to the Internet.
- Microsoft .NET Framework
Synchronization Service requires Microsoft .NET Framework 4.7.2 (see “Installing the .NET Framework” at http://go.microsoft.com/fwlink/?LinkId=294688
- Additional Requirements
To synchronize passwords from an Active Directory domain to some other connected data system, you must install the Sync Service Capture Agent on all domain controllers in the source Active Directory domain.
The domain controllers on which you install Sync Service Capture Agent must run one of the following operating systems with or without any Service Pack (both x86 and x64 platforms are supported):
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2012
For more information, see the Active Roles Synchronization Service Administrator Guide.
For instructions on how to upgrade Active Roles, refer to the Active Roles Quick Start Guide.
When performing the upgrade, keep in mind that the components of the earlier version may not work in conjunction with the components you have upgraded. To ensure smooth upgrade to the new version, you should first upgrade the Administration Service and then upgrade the client components (Console and Web Interface).
Custom solutions (scripts or other modifications) that rely on the functions of Active Roles may fail to work after an upgrade due to compatibility issues. Prior to attempting an upgrade, you should test your existing solutions with the new version of the product in a lab environment to verify that the solutions continue to work.
The following table shows the version upgrade path that you can take from one version of the product to another. Source version refers to the current product version that you have installed. Destination version refers to the highest version of the product to which you can upgrade.
Source version
Destination version
6.9.0
7.4
7.0
7.4
7.1
7.4
7.2
7.4
7.3
7.4
Resources
Active Roles
Active Roles is a unified AD-management tool that secures hybrid environments and much more.
Read DatasheetEBook - The top five ways to relieve the pain of managing hybrid AD environments
Managing on-prem AD is hard enough, but when you throw Azure AD into the mix things can get out of control quickly. This eBook discusses the top five challenges facing those with a hybrid AD environment and offers actionable solutions to ease the pain.
Read E-bookFuture-Proof Your Tactical IAM Projects.
It’s often thought that identity and access management (IAM) is a term that is reserved for large-scale, strategic projects that focus on governance, enterprise provisioning and privileged account management (PAM). Without question, these things are very
Read E-bookThe Breach Prevention Playbook
This eBook focuses on the IAM practices and technologies that provide the best path to cyber-security.
Read E-bookThe 12 essential tasks for managing Active Directory Domain Services
Learn how to efficiently manage Active Directory domain services with the whitepaper "The 12 Essential Tasks of Active Directory Domain Services"
Watch VideoUse Active Directory groups to manage access control
Learn how to more effectively manage Active Directory access using the techniques described in the whitepaper "Access Control Is Easy: Use Active Directory Groups and Manage Them Well"
Watch VideoActive Roles help the University of West Scotland delivers fast, low impact systems migration
The university needed to streamline IT management by migrating 22,000 users from legacy environments to Active Directory® and Microsoft® Exchange Server. Active Roles provided flexible delegation of AD permissions and role-based security features
Read Case StudyKeep Active Directory secure by separating administration roles
Learn how to improve Active Directory security using the techniques described in the whitepaper "The Keys to the Kingdom: Limiting Active Directory Administrators" sponsored by One Identity.
Watch VideoGet started now
Simplify the security of your Active Directory
Support and services
Product Support
Self-service tools will help you to install, configure and troubleshoot your product.
Support Offerings
Find the right level of support to accommodate the unique needs of your organization.
Education Services
Training courses delivered through online web-based, on-site or virtual instructor-led.