There are many Management Policy Rules (MPRs) in FIM Service that control how user objects can be modified by self-service, administrators, or the synchronization engine.
In many cases, we need to modify the existing MPRs and/or create new ones. Whether we use the existing MPRs or decide to create new ones is something you can decide as you wish. In my examples in this book, I will reuse many of the built-in MPRs and add new ones when needed.
Before we can start our user management, it is a good idea to look at the existing MPRs and try to understand what they will do. If we go into FIM Portal, select Management Policy Rules, and search for user, we will get around 21 MPRs (many are regarding group management) in our default FIM 2010 R2 setup. Take a quick look at them in the following screenshot and you will notice that many are disabled by default:
One that is enabled by default is Synchronization: Synchronization account controls users it synchronizes...