Install And Configure Microsoft Identity Manager 2016 SP1 For SharePoint 2016

The downloaded zip file will contain the folder USerProfile.MIMSync, which contains all the solution files.

The solutions scripts from UserProfile.MIMSync have been copied to the working directory.

Rectify an error in the Synchronization script

SharePointSync.psm1 module contains a set of PowerShell commandlets to set-up Microsoft Identity Manager sync engine with SharePoint and to kick off sync on-demand. However, the script was written for MIM 2016 and need some code correction for it to work with the latest MIM 2016 SP1. If we run the script without the changes, we will get the error, as shown below.

The error states that SharePoint Sync requires 4.3.2064 or greater. However, if we check, we can see that the installed version of Forefront Synchronization Service Manager is already 4.4.1302.

The error is caused because of an If/Else block, which was aimed at the first version of MIM 2016 in SharePointSync.psm1.To rectify the error, open SharePointSync.psm1.

We will replace the code block 79-89 with the set of code block given below, so that it works with MIM 2016 SP1 as well.

Corrected Code

Get configuration values for SharePoint Synchronization script

To enable SharePoint Synchronization, we will be running the SharePointMIMSync.ps1 file in MIM Server. Prior to running it, we will have to update the script with our environment variables.

We will need OrganizationalUnit and ForestDnsName parameters, which will have to be updated in the script. We can get the organizational unit by running the command given below. The distinguished name (DC=AzureAD,DC=Contoso,DC=com) will correspond to the Organizational Unit.

We can get AD forest name by running the command given below.

Prior to running the Synchronization script, ensure that Set-ExecutionPolicy script given below has been run, else we may get the error File is not digitally signed.

Run SharePoint Synchronization script

Now, we are ready to run SharePoint Sync Script. The running of the script involves two steps, which are given below.

• Import SharePointSync Module
• Run ‘Install-SharePointSyncConfiguration’ Command

After navigating to the directory, where the script is present, let’s load SharePointSync.psm1 module, as given below.

Now, we can finally run the ‘Install-SharePointSyncConfiguration’ command, which will enable MIM Synchronization with SharePoint. It needs the parameters given below to be filled.

• -Path - Location where the sync script is located.
• -ForestDnsName - AzureAD.Contoso.com (we got this earlier by running Get-ADForest command).
• -ForestCredential - Account that will be used to read objects from Active Directory. This account must have Replicate-Directory-Changes permissions in the Active Directory that is to be synchronized. We are using an AD administrator account here.
• -OrganizationalUnit - This is the distinguished name of the Active Directory container to be synchronized.We can get it by running the command “Get-ADComputer $env - COMPUTERNAME | Get-ADPrincipalGroupMembership”.
• -SharePointUrl - SharePoint Central Admin URL
• -SharePointCredential - SharePoint Farm Account.

Synchronization Script given below can be saved to a PS1 file say ‘SharePointMIMSync.ps1’ and we can run it from the console as ‘.\ SharePointMIMSync.ps1’.

On running Synchronization Script, it will ask for Sync Account, which we can input, as shown below.

It will also ask for SharePoint Farm account, which we can enter and click OK.

This will complete SharePoint Synchronization configuration and we will get the message given below. It has specifically said that before we start the synchronization, we should set the AD account password in the AD connector, which we will see in the coming section.

Run Synchronization Service Manager

Now, we can start Synchronization Service Manager to start the Synchronization of User Profiles.

We can see two management agents in Service Manager, which are given below.

• ADMA
  Active Directory Management Agent.
  
  
• SPMA
  SharePoint Management Agent.
  
  
  

Click ADMA and go to Connect to Active Directory Forest tab. Here, we have to specify the password for the SyncAccount that has Replicate-Directory-Changes permissions in Active Directory.

Also, ensure that we have selected AD partitions correctly, so that synchronization runs correctly.

Before running synchronization command, let's restart Forefront Identity Manager Service.

Finally, we can run SharePoint Synchronization Service.

It will perform the import of user profiles and we can see the success and details in Service Manager, as shown below.

Summary

Thus, we saw how to install and configure Microsoft Identity Manager 2016 SP1 for SharePoint Server 2016.