Trying to create a transform within AADC (Azure AD Connect)

Question

Hi Guys
Im looking for a little help on AADC and out of box ruiles
Im working with a business who have acquired another company and need to synchronise identities from this new forest into AzureAD then migration mailboxes (multiforest hybrid). This new forest has a lot of groups which are similarly named to the existing forest. This is distribution groups like HR, Sales etc. The natural solution would be for forestB to rename all their groups prior to sync however this is a big task and will effect on premises users prior to onboarding to Exchange Online. One idea i had was whether we could prefix all these groups only within AzureAD as part of the sync by using a custom group join rule. The problem is I don't know how to construct the attribute or know what language MIM uses under the bonnet to even google.
The plan for me would be to duplicate the existing Group Common join rule for the MA associated with forestB with a higher precendent and change the transform already used for displayname.

Below is the following screen shot from AADC with the displayname as:
IIF(IsNullOrEmpty([displayName]),[cn],[displayName])

Firstly what languaue or format is used by FIM
Secondly - what does the current transform do? I can see there is an if statement and CN buried in there
Thirdly- How can i prefix all displaynames with "Prefix_" (what would be the transform format)

Answer 1

Hello @Graham Lindsay ,

Let me answer your queries one by one.

What you see in the transformations is called declarative provisioning . This has a separate language called Declarative Provisioning Expression Language The expression language which is used in attribute flows is a subset of Microsoft VB for apps (similar to VBScript) . The Declarative Provisioning Expression Language is only using functions and is not a structured language. The list of function which are used in Azure AD connect Sync is provided in an article for function reference. Please check the link for more information. You can understand more on the default configurations in the sync rules in AAD connect here. Its more or less regular expressions.

Your second question related to knowing about what the current transform does.

IIF(IsNullOrEmpty([displayName]),[cn],[displayName])

The IF function is designed in such a way where it evaluates one condition at the start and then returns the values mentioned in the expression . The second parameter(in this case [cn]) is returned if condition is true and the last parameter(in this case [displayName]) is returned if condition is false. The following is an attempt to best describe the exact meaning of the above transform.

"" If displayName attribute is not present for the object or is an empty value in the connector space or metaverse then update the value of cn attribute to the displayName And if its not null or empty then let whatever value displayName attribute has from the source connector, get updated to the displayName attribute in target (AD connector space or AAD connector space or MV ). ""

IIF(IsNullOrEmpty([displayName]),"Prefix_" & [cn],"Prefix_" & [displayName])

If the related attribute from source has any value populated for displayName then it will Append the string "prefix_" before displayName and if the related attribute from source does not have any value then it will append "prefix_" before cn attribute and store the resultant in displayName target attribute.

I have made changes as per the existing rule that you have. I would suggest you to test it before applying it in your own environment because there may be other rules within your configuration/environment dependent on each other which would change the resultant value within the metaverse. For this you can copy this rule and create a test rule. within the test rule you can create a scoping filter to have a scope specific to one test group so that any modification can be seen on that group itself and this rule does not apply to any other object. You can use attribute based filtering for defining scoping filters. Once testing is complete you can apply this rule in the main sync rule.

Hope the information helps . If the information provided in the post helps , please do mark it as answer so that its helpful to other members of the community. In case you have any further queries please let us know and we will be happy to help.

I have linked many article which you can go through to understand more . They are not specific to FIM but the concept is the same in both AAD connect and FIM products. FIM actually provides you much larger ways of customizing the object provisioning.

Thank you.

Answer 2

Thank you so much for this information, awesome responsive