Synchronization and provisioning rules

Synchronization rules

Rule

Description

One-way synchronization

The tool synchronizes changes from Microsoft Active Directory groups to BlackBerry Enterprise Service 10 groups. Changes made to the BlackBerry Enterprise Service 10 groups using the administration console do not affect the membership of Microsoft Active Directory groups.

Does not manage local user accounts

The BlackBerry Device Service and the Universal Device Service can host local user accounts and directory user accounts. You add directory user accounts by importing user information from Microsoft Active Directory. You create local users by manually specifying user information (user name, email address, and so on). Local users are not integrated with Microsoft Active Directory.

The tool does not synchronize, add, or remove local user accounts. The tool can synchronize, add, and remove directory user accounts only.

Does not manage user accounts that are not integrated with Microsoft Active Directory

The tool does not manage user accounts that have no Microsoft Active Directory identifiers, for example, default system accounts like system administrator.

The tool can only manage user accounts that are associated with Microsoft Active Directory user accounts (user accounts that were added to the server instance by importing user information from Microsoft Active Directory).

Does not add groups

The tool does not create new groups on the BlackBerry Device Service or Universal Device Service.

One-to-one mappings

The tool supports one-to-one mappings of Microsoft Active Directory groups to BlackBerry Enterprise Service 10 groups. You can configure as many one-to-one mappings as required.

For example, if you want to map both Group A and Group B in Microsoft Active Directory to Group 1 on the BlackBerry Device Service, you can configure two mappings: Group A to Group 1 and Group B to Group 1.

Nested subgroups

You can configure the tool to synchronize nested groups in Microsoft Active Directory with BlackBerry Enterprise Service 10 groups. The tool does not create new subgroups on the server instance.

For example, Group A in Microsoft Active Directory has a nested subgroup called Group B. You create Group 1 with no members on the BlackBerry Device Service. You map Group A to Group 1 and you permit the tool to synchronize nested groups. When you run the tool, the user accounts in Group A and the nested Group B are assigned to Group 1.

Synchronization outcomes

When you map a Microsoft Active Directory group to a BlackBerry Enterprise Service 10 group and run the synchronization process, the following occurs:
  • If a user account exists in the Microsoft Active Directory group but not in the BlackBerry Enterprise Service 10 group, the tool adds the user account to the BlackBerry Enterprise Service 10 group.
  • If a user account does not exist in the Microsoft Active Directory group but does exist in the BlackBerry Enterprise Service 10 group, the tool removes the user account from the BlackBerry Enterprise Service 10 group.

Users restricted to one Universal Device Service group

A user account can be a member of one Universal Device Service group only. After the synchronization process adds a user to a Universal Device Service group (or identifies that the user already exists in a Universal Device Service group), the tool ignores any changes that would add the user to another group. Details are written to the report and log file for any changes that are not performed.

Force synchronization option

If the tool cannot find the Microsoft Active Directory group, or the group is no longer valid, one of the following occurs:
  • If Force Synchronization is selected, the user accounts are removed from the BlackBerry Enterprise Service 10 group.
  • If Force Synchronization is not selected, the user accounts are not removed from the BlackBerry Enterprise Service 10 group. Details are written to the report and log file.

If you select this option, always preview the provisioning and synchronization process so that you can verify that the changes will occur as expected.

Provisioning resolves before synchronization

If you configured mappings of Microsoft Active Directory groups to virtual provisioning groups and mappings of Microsoft Active Directory groups to BlackBerry Enterprise Service 10 groups, the synchronization process resolves the provisioning tasks first (adding or removing user accounts), then performs the synchronization tasks.

Synchronization rules when the provisioning feature is disabled

Rule

Description

Does not add user accounts

If the tool identifies a Microsoft Active Directory user account that does not have a matching user account on the BlackBerry Device Service or Universal Device Service, the tool does not add the user to the server instance, and cannot synchronize the user account to BlackBerry Enterprise Service 10 group. The tool writes details to the report and log file.

Synchronization rules when the provisioning feature is enabled

Rule

Description

Adds user accounts

You map a Microsoft Active Directory group to a virtual provisioning group and start the synchronization process. If the tool identifies a Microsoft Active Directory user account that does not have a matching user account on the BlackBerry Device Service or Universal Device Service, the tool adds the required user account to the server instance.

If the Microsoft Active Directory group is mapped to the Provision User as Device Enabled virtual provisioning group, the tool adds a device-enabled user account. If the Microsoft Active Directory group is mapped to the Provision User virtual provisioning group, the tool adds an administrator account that is not device-enabled.

When the tool adds a device-enabled user account to the server instance, the server instance does not send an activation email to users. You must send the activation information to users.

Does not assign roles

When the tool adds an administrator account that is not device-enabled to the server instance, it does not assign an administrative role to the account.

It is a best practice to assign roles to administrator accounts by mapping the accounts to BlackBerry Enterprise Service 10 groups that are already associated with roles. You can also assign roles to administrator accounts using the administration console.

Deprovisioning

If you enable deprovisioning, every user account on the server instance must have a matching user account in a Microsoft Active Directory group that is mapped to one of the virtual provisioning groups. If the tool identifies a user account that does not exist in a provisioning mapping, the tool removes the user account from the server instance (if the De-provisioning action is set to Delete users). The tool does not remove local user accounts.

Deprovisioning options

If the tool identifies a user account that does not exist in a provisioning mapping, one of the following occurs:
  • If the De-provisioning action is set to Delete users, the user account is removed from the server instance.
  • If the De-provisioning action is set to Log only, the user account is not removed from the server instance. Details are written to the report and log file. You can use this list to remove the user accounts manually.

Provisioning priority

If a Microsoft Active Directory user account is mapped to both types of virtual provisioning groups, and the user does not currently have a matching user account on the server instance, the tool adds the user to the server instance as a device-enabled user account.

Provisioning conflicts

If you add an administrator account to the BlackBerry Device Service or Universal Device Service that is not device-enabled, and you later try to add the user to the server instance again as a device-enabled user account, the tool does not complete the task and writes details to the report and log file. You can remove and add the user again using the administration console, or you can configure mappings to remove the user account and add the user account again.

If you add a device-enabled user account to the server instance, and you later try to add the user to the server instance again as an administrator account that is not device-enabled, the tool does not complete the task and writes details to the report and log file. You can remove and add the user again using the administration console, or you can configure mappings to remove the user account and add the user account again.



Was this information helpful? Send us your comments.