• Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
    Dedicated community for Japanese speakers
  • 한국 커뮤니티
    Dedicated community for Korean speakers
Exit
2

Migrating from User Sync Tool to Azure Sync

New Here ,
May 17, 2022 May 17, 2022

Copy link to clipboard

Copied

Hello,

I'm hoping to get some clarification. I've looked at the online docs, and apologies if I missed something, but I'm a bit unclear... we are planning on moving away from using the User Sync Tool and replacing it with Azure Sync.

 

I'm wondering if someone may be able to clarify 2 things for me:

 

#1. Once the sync with Azure is setup, how can the user who is a member of and AD group be assigned to a product profile?

For example, with the User Sync Tool we have an AD group that contains all users who require access to Adobe Photoshop (for example), the sync tool associates the AD group with the product profile in the Adobe console (as shown below).

 

(sample code from user-sync-config.yml)

groups:
    - directory_group: "AD_AdobePhotoshop"
      adobe_groups:
        - "Adobe Photoshop"

 

How will this work when using Azure Sync? If I want to make sure everyone in the AD group (AD_AdobePhotoshop) is added in the Product profile "Adobe Photoshop" when the sync occurs, do I need to do any additional steps?

 

#2. All of our accounts are already federated id. When moving from User Sync Tool to Azure Sync will it create duplicate user accounts for those that already exist?

TOPICS
Admin console , Enterprise , Manage account , Users and groups

Views

664

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines

correct answers 1 Correct answer

New Here , Jun 08, 2022 Jun 08, 2022

We went ahead and migrated from the User Sync Tool to Azure Sync a couple of weeks ago.

Thought I'd post our experience regarding the two questions mentioned above in case anyone was interested.

 

For #1 - what we found out was that once you configured Azure sync, the AD groups appeared in the Adobe admin console under Users > User Groups. So, from the example above, if we had an AD group called "AD_Photoshop" mapped to an Adobe group called "Adobe Photoshop", the "AD_Photoshop" group would appear

...

Votes

Translate

Translate

correct answers 1 Pinned Reply

Adobe Employee , May 20, 2024 May 20, 2024

Hi Josh,

Seems like you have it resolved, but I'll just throw in some expected behaviour explanation.

 

#1

groups:
    - directory_group: "AD_AdobePhotoshop"
      adobe_groups:
        - "Adobe Photoshop

 

The above means that AD_AdobePhotoshop will map to a User Group in the Admin Console named "Adobe Photoshop". When moving to Azure Sync, it will create a new User Group with the AD Group's name (uncustomisable) so the old 'renamed user group' can be removed.

 

#2

 

It doesn't seem like you ra

...

Votes

Translate

Translate
New Here ,
Jun 08, 2022 Jun 08, 2022

Copy link to clipboard

Copied

We went ahead and migrated from the User Sync Tool to Azure Sync a couple of weeks ago.

Thought I'd post our experience regarding the two questions mentioned above in case anyone was interested.

 

For #1 - what we found out was that once you configured Azure sync, the AD groups appeared in the Adobe admin console under Users > User Groups. So, from the example above, if we had an AD group called "AD_Photoshop" mapped to an Adobe group called "Adobe Photoshop", the "AD_Photoshop" group would appear in the Adobe admin console. Clicking on that AD group, would list all the users who are members of that group.

 

Now that we had the AD group synchronized, we simply added the AD group to the specific product profile. Under Products, we'd select our specific product (eg. Adobe Photoshop) > Select our product profile > Click on Users and add the AD group we had just synced.

 

Since the AD group was now tied to a product profile, we no longer needed the group "Adobe Photoshop" from the admin console, so we removed all the users tied to that group and deleted the group - since it was an exact duplicate of the AD group we had just synced using Azure.

 

We also tested to see what would happened if we renamed the AD group to match the Adobe group - it seems as though Azure sync overwrites the Adobe group and takes ownership of it. We did not test what would happen if we did the opposite (rename the Adobe group to match the AD group), but I'm guessing the behavior is the same. I guess we could've simplified the migration a bit by doing it this way, but since we weren't sure what would happen and the impact behind it, we didn't - plus we had a strict naming conventions that our AD team wanted us to follow 🙂 .

 

For #2 - No duplicate users were created for those that had already been synchronized by the User Sync Tool.

 

As for testing, we were able to test to some degree (depending on how often your User Sync Tool runs). We found that once you setup Azure Sync, the User Sync Tool no longer works, and both tools can't be running concurrently (I believe Adobe mentions this in their documentation), so you will need to disable the User Sync Tool after setting up Azure Sync. Something to keep in mind.

 

Hope this has been helpful.

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
May 16, 2024 May 16, 2024

Copy link to clipboard

Copied

Thank you for sharing your experiences. We also want to switch to Azure Sync and I had exactly the same questions. Your information will help me a lot.

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Employee ,
May 20, 2024 May 20, 2024

Copy link to clipboard

Copied

LATEST

Hi Josh,

Seems like you have it resolved, but I'll just throw in some expected behaviour explanation.

 

#1

groups:
    - directory_group: "AD_AdobePhotoshop"
      adobe_groups:
        - "Adobe Photoshop

 

The above means that AD_AdobePhotoshop will map to a User Group in the Admin Console named "Adobe Photoshop". When moving to Azure Sync, it will create a new User Group with the AD Group's name (uncustomisable) so the old 'renamed user group' can be removed.

 

#2

 

It doesn't seem like you ran into this... but if there was any discrepancy in the attributes being pulled over that could cause some errors as well. If the Username in Azure (UPN by default) is the same as what is being synced over from your legacy UST - then the ID will be the same. However, if there is any discrepancy in Username, a new Federated ID would be created in the Admin Console even if it links to the same user.

 

If you were not pulling UPN for the UST, you can customise the attributes before you run the Azure Sync to pull the same Attribute across.

See: https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/customize-application-attri...

 

 

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines