Skip to main content
J
Josh0x33
New Participant
May 17, 2022
Answered

Migrating from User Sync Tool to Azure Sync

  • May 17, 2022
  • 1 reply
  • 2383 views

Hello,

I'm hoping to get some clarification. I've looked at the online docs, and apologies if I missed something, but I'm a bit unclear... we are planning on moving away from using the User Sync Tool and replacing it with Azure Sync.

 

I'm wondering if someone may be able to clarify 2 things for me:

 

#1. Once the sync with Azure is setup, how can the user who is a member of and AD group be assigned to a product profile?

For example, with the User Sync Tool we have an AD group that contains all users who require access to Adobe Photoshop (for example), the sync tool associates the AD group with the product profile in the Adobe console (as shown below).

 

(sample code from user-sync-config.yml)

groups:
    - directory_group: "AD_AdobePhotoshop"
      adobe_groups:
        - "Adobe Photoshop"

 

How will this work when using Azure Sync? If I want to make sure everyone in the AD group (AD_AdobePhotoshop) is added in the Product profile "Adobe Photoshop" when the sync occurs, do I need to do any additional steps?

 

#2. All of our accounts are already federated id. When moving from User Sync Tool to Azure Sync will it create duplicate user accounts for those that already exist?

    This topic has been closed for replies.
    Correct answer Josh0x33

    We went ahead and migrated from the User Sync Tool to Azure Sync a couple of weeks ago.

    Thought I'd post our experience regarding the two questions mentioned above in case anyone was interested.

     

    For #1 - what we found out was that once you configured Azure sync, the AD groups appeared in the Adobe admin console under Users > User Groups. So, from the example above, if we had an AD group called "AD_Photoshop" mapped to an Adobe group called "Adobe Photoshop", the "AD_Photoshop" group would appear in the Adobe admin console. Clicking on that AD group, would list all the users who are members of that group.

     

    Now that we had the AD group synchronized, we simply added the AD group to the specific product profile. Under Products, we'd select our specific product (eg. Adobe Photoshop) > Select our product profile > Click on Users and add the AD group we had just synced.

     

    Since the AD group was now tied to a product profile, we no longer needed the group "Adobe Photoshop" from the admin console, so we removed all the users tied to that group and deleted the group - since it was an exact duplicate of the AD group we had just synced using Azure.

     

    We also tested to see what would happened if we renamed the AD group to match the Adobe group - it seems as though Azure sync overwrites the Adobe group and takes ownership of it. We did not test what would happen if we did the opposite (rename the Adobe group to match the AD group), but I'm guessing the behavior is the same. I guess we could've simplified the migration a bit by doing it this way, but since we weren't sure what would happen and the impact behind it, we didn't - plus we had a strict naming conventions that our AD team wanted us to follow 🙂 .

     

    For #2 - No duplicate users were created for those that had already been synchronized by the User Sync Tool.

     

    As for testing, we were able to test to some degree (depending on how often your User Sync Tool runs). We found that once you setup Azure Sync, the User Sync Tool no longer works, and both tools can't be running concurrently (I believe Adobe mentions this in their documentation), so you will need to disable the User Sync Tool after setting up Azure Sync. Something to keep in mind.

     

    Hope this has been helpful.

    1 reply

    J
    Josh0x33AuthorCorrect answer
    New Participant
    June 8, 2022

    We went ahead and migrated from the User Sync Tool to Azure Sync a couple of weeks ago.

    Thought I'd post our experience regarding the two questions mentioned above in case anyone was interested.

     

    For #1 - what we found out was that once you configured Azure sync, the AD groups appeared in the Adobe admin console under Users > User Groups. So, from the example above, if we had an AD group called "AD_Photoshop" mapped to an Adobe group called "Adobe Photoshop", the "AD_Photoshop" group would appear in the Adobe admin console. Clicking on that AD group, would list all the users who are members of that group.

     

    Now that we had the AD group synchronized, we simply added the AD group to the specific product profile. Under Products, we'd select our specific product (eg. Adobe Photoshop) > Select our product profile > Click on Users and add the AD group we had just synced.

     

    Since the AD group was now tied to a product profile, we no longer needed the group "Adobe Photoshop" from the admin console, so we removed all the users tied to that group and deleted the group - since it was an exact duplicate of the AD group we had just synced using Azure.

     

    We also tested to see what would happened if we renamed the AD group to match the Adobe group - it seems as though Azure sync overwrites the Adobe group and takes ownership of it. We did not test what would happen if we did the opposite (rename the Adobe group to match the AD group), but I'm guessing the behavior is the same. I guess we could've simplified the migration a bit by doing it this way, but since we weren't sure what would happen and the impact behind it, we didn't - plus we had a strict naming conventions that our AD team wanted us to follow 🙂 .

     

    For #2 - No duplicate users were created for those that had already been synchronized by the User Sync Tool.

     

    As for testing, we were able to test to some degree (depending on how often your User Sync Tool runs). We found that once you setup Azure Sync, the User Sync Tool no longer works, and both tools can't be running concurrently (I believe Adobe mentions this in their documentation), so you will need to disable the User Sync Tool after setting up Azure Sync. Something to keep in mind.

     

    Hope this has been helpful.

      W
      Adobe Employee
      Wingkin
      Adobe Employee
      May 21, 2024

      Hi Josh,

      Seems like you have it resolved, but I'll just throw in some expected behaviour explanation.

       

      #1

      groups:
    - directory_group: "AD_AdobePhotoshop"
      adobe_groups:
        - "Adobe Photoshop

       

      The above means that AD_AdobePhotoshop will map to a User Group in the Admin Console named "Adobe Photoshop". When moving to Azure Sync, it will create a new User Group with the AD Group's name (uncustomisable) so the old 'renamed user group' can be removed.

       

      #2

       

      It doesn't seem like you ran into this... but if there was any discrepancy in the attributes being pulled over that could cause some errors as well. If the Username in Azure (UPN by default) is the same as what is being synced over from your legacy UST - then the ID will be the same. However, if there is any discrepancy in Username, a new Federated ID would be created in the Admin Console even if it links to the same user.

       

      If you were not pulling UPN for the UST, you can customise the attributes before you run the Azure Sync to pull the same Attribute across.

      See: https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/customize-application-attributes

       

       

      S
      Sreenath31923951mvwv
      New Participant
      November 21, 2024

      Hi, thanks for all the discussions/answers here. 
      Would like to get a clarification in below scenario also

         I have a group called "editors" in Active directory

         Existing UST process has created the group in admin console with same name ie "editors"

      1. What will happen in this case when i switch from UST ot azure sync, as Azure sync will try to create the the same user group (editors) in admin console. 

      2. if we have to create new groups for every group created by UST (we have around 100+), how do we manage assigning product profiles to all of them. Do we have to do that manually.

       

      Thanks in advance

      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices