Book Image

Microsoft Identity Manager 2016 Handbook

By : David Steadman, Jeff Ingalls
Book Image

Microsoft Identity Manager 2016 Handbook

By: David Steadman, Jeff Ingalls

Overview of this book

Microsoft Identity Manager 2016 is Microsoft’s solution to identity management. When fully installed, the product utilizes SQL, SharePoint, IIS, web services, the .NET Framework, and SCSM to name a few, allowing it to be customized to meet nearly every business requirement. The book is divided into 15 chapters and begins with an overview of the product, what it does, and what it does not do. To better understand the concepts in MIM, we introduce a fictitious company and their problems and goals, then build an identity solutions to fit those goals. Over the course of this book, we cover topics such as MIM installation and configuration, user and group management options, self-service solutions, role-based access control, reducing security threats, and finally operational troubleshooting and best practices. By the end of this book, you will have gained the necessary skills to deploy, manage and operate Microsoft Identity Manager 2016 to meet your business requirements and solve real-world customer problems.
Table of Contents (22 chapters)
Microsoft Identity Manager 2016 Handbook
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Enabling password management in AD


The goal for SSPR is, usually, to reset the password of users' accounts in Active Directory, but the SSPR feature in MIM is not limited to Active Directory, and can be used to reset passwords in other connect data sources (CDS) as well.

In order for MIM to change the password of a user in AD (or any other CDS), the account used by MIM (svc-adma in our example) needs to have the reset password permission in AD, or a similar permission in another CDS:

  1. In the Management Agent for the target CDS, in this case the AD, we need to check the Enable password management checkbox:

  2. If we then look at the settings, we can make some adjustments, as shown in the following screenshot:

    Note

    The Unlock locked accounts when resetting passwords option is not enabled by default. It is up to your security team to determine if this setting is right for you. The authors have seen organizations that have this setting enabled as well as disabled.

The Management Agent for AD is now ready...