Enabling Incremental Reconciliation from Azure AD to OIM: Step-by-Step Guide

Azure AD into OIM

A complete guide on how to enable the incremental reconciliation from Azure Active Directory AD which is trusted application into Oracle Identity Manager OIM.

What is Incremental Reconciliation?

The incremental reconciliation is a concept in IDM demography were during the reconciliation of data from a source, only the delta is picked by OIM connector which has been changed after last reconciliation timestamp.

So, let us say that if the reconciliation from Azure to OIM has been triggered on 10th Oct,2022 at 2:00pm PST and next scheduled run of reconciliation is on 14th Oct,2022 at 2:00 pm PST, then, the data which has been modified/changed after 2:00pm PST 10th Oct,2022 will be picked up by the connector and will be reconciled in OIM.

Therefore, in this article, you will know on how to enable this functionality of delta reconciliation from Azure AD to OIM.

Pre-Requisites

The OIG 12c – Azure AD connector should be installed in respective OIM instance as Trusted Source through AoB/Application Onboarding approach. Refer then below screenshot.

Azure AD Incremental Reconciliation Step 1

The Scheduled Task named as: AzureAD AzureAD User Trusted Reconciliation should be present in respective environment of OIG.

Azure AD Incremental Reconciliation Step 2

Enabling Incremental Reconciliation for Azure AD Trusted Source in OIG

  1. Login to Identity – Self Service Console using XELSYSADM user.

Azure AD Incremental Reconciliation Step 3

  1. Navigate to Manage Tab. Click on Manage.

Azure AD Incremental Reconciliation 4

  1. You will get below page.

Azure AD Incremental Reconciliation

  1. Click on Applications tile.

Azure AD Incremental Reconciliation

  1. Below page will be rendered.

Azure AD Incremental Reconciliation

  1. Perform the blank search on this page by clicking on “Search” button.

Azure AD Incremental Reconciliation

  1. Results will be displayed as shown in below screenshot. Note that search result will differ as per your OIG environment and list of connectors you have installed through Aob approach.

Azure AD Incremental Reconciliation

  1. Look for AzureAD connector installation which is configured as Trusted source.

Azure AD Incremental Reconciliation

  1. Select the Connector and click on Edit.

Azure AD Incremental Reconciliation

  1. Below page will be rendered.

Azure AD Incremental Reconciliation

  1. Scroll down till you see the Advanced Settings section.

Azure AD Incremental Reconciliation

  1. Expand the Advanced Settings section.

Azure AD Incremental Reconciliation

  1. Below page will be rendered.

Azure AD Incremental Reconciliation

  1. Search for “relURLs” configuration.

Azure AD Incremental Reconciliation

  1. The existing relURLs configuration will be as follows.
New relURLs configuration

“ACCOUNT.SEARCHOP=/$(api_version)$/users?$(Filter Suffix)$&$select=displayName,givenName,userType,mailNickname,userPrincipalName,id,preferredLanguage,usageLocation,accountEnabled,surname,country, onPremisesLastSyncDateTime&$top=$(PAGE_SIZE)$&$skiptoken=$(PAGE_TOKEN)$”,”ACCOUNT.manager.SEARCHOP=/$(api_version)$/users/$(UID)$/manager”,”ACCOUNT.manager=/$(api_version)$/users/$(UID)$/manager/$ref”

16. Change the relURLs to below value.

Existing relURLs configuration

“ACCOUNT.SEARCHOP=/$(api_version)$/users?$(Filter Suffix)$&$select=displayName,givenName,userType,mailNickname,userPrincipalName,id,preferredLanguage,usageLocation,accountEnabled,surname,country&$top=$(PAGE_SIZE)$&$skiptoken=$(PAGE_TOKEN)$”,”ACCOUNT.manager.SEARCHOP=/$(api_version)$/users/$(UID)$/manager”,”ACCOUNT.manager=/$(api_version)$/users/$(UID)$/manager/$ref”

17. Update the configuration in relURLs parameter of Advanced Settings.

Azure AD Incremental Reconciliation

  1. Once updated, scroll up and click on Apply.

Azure AD Incremental Reconciliation

  1. You will get below message.

Azure AD Incremental Reconciliation

  1. Then, login to OIG – System Admin Console.

Azure AD Incremental Reconciliation

  1. Click on Scheduler.

Azure AD Incremental Reconciliation

  1. Below popup will be rendered.

Azure AD Incremental Reconciliation

  1. Search for Scheduler named using search string as: *AzureAD*.

Azure AD Incremental Reconciliation

  1. Click on Search button.

Azure AD Incremental Reconciliation

  1. You will get below results.

Azure AD Incremental Reconciliation

  1. Click on Scheduler named as : AzureAD AzureAD User Trusted Reconciliation.

Azure AD Incremental Reconciliation

  1. The scheduled task will be opened.

Azure AD Incremental Reconciliation

  1. Enter the Incremental Recon Attribute as : onPremisesLastSyncDateTime

Azure AD Incremental Reconciliation

  1. Apply the changes.

Azure AD Incremental Reconciliation

  1. Apply the changes.

Azure AD Incremental Reconciliation

  1. The changes will be applied successfully and Incremental Recon Attribute will be updated successfully in scheduled task.

Azure AD Incremental Reconciliation

Known Issues

Issue # 1: Latest Token attribute is not getting updated after successful execution of Scheduled Task for Trusted Reconciliation.

Issue Details

  1. There might be case where even after successful execution of scheduled task for trusted reconciliation of user and providing the Incremental Recon attribute name, the latest token attribute is not getting updated in Scheduled Task Parameter. Refer the below screenshot.

Azure AD Incremental Reconciliation

Resolution:

  1. Validate with Azure AD team and ask them, to enable the onPremisesLastSyncDateTime attribute.
  2. Also, in the relURL, the onPremisesLastSyncDateTime should be present. Therefore, when OIM makes the call with Azure AD graph APIs, the call will ask for onPremisesLastSyncDateTime attribute to be fetched from Azure AD to OIM.

Author: Rohit Wekhande, IDMWORKS, Sr AIM Consultant