Should be assigned when the object is created.Shouldn't be case-sensitive and avoid values that may vary by case.Shouldn't be based on user's name because these can change.Must be either a string, integer, or binary.Not contain a special character: \ ! # $ % & * + / = ? ^ ` | ~ ( ) ' :, " _.Characters not being a-z, A-Z, or 0-9 are encoded and counted as 3 characters.The attribute value must follow the following rules: The same rules apply to all object types, but it's only for users this problem usually is a concern. This topic only talks about sourceAnchor as it relates to users. If you use federation, then this attribute together with the userPrincipalName is used in the claim to uniquely identify a user.If you move from a cloud-only identity to a synchronized identity model, then this attribute allows objects to "hard match" existing objects in Azure AD with on-premises objects.When a new sync engine server is built, or rebuilt after a disaster recovery scenario, this attribute links existing objects in Azure AD with objects on-premises.
The attribute is used for the following scenarios: Since this attribute’s value can't be changed after it has been set, it's important to pick a design that supports your scenario. The word immutable, that is "can't be changed", is important to this document. The attribute is also called immutableId and the two names are used interchangeably. It uniquely identifies an object as being the same object on-premises and in Azure AD. The sourceAnchor attribute is defined as an attribute immutable during the lifetime of an object. This document is a deep dive on certain areas and these concepts are briefly described in other documents as well.
The purpose of this document is to describe areas that must be considered while configuring Azure AD Connect.
0 kommentar(er)
