Installing and configuring the Outlook Live Management Agent with Forefront Identity Manager 2010.

Hi folks,

As much as it surprises me, I still receive the odd question about the Outlook Live Management Agent when used in conjunction with Forefront Identity Manager 2010. It’s with that in mind that I’m providing the following brief write-up on how to manually install the OLMA, and although there’s not a lot of value in covering the attribute flow in depth, I’ll at least provide a guideline on how to configure the management agent to work with Live@EDU.

Please pay attention to the fact I mentioned this relates to a manual installation of the agent and subsequent configuration. We do not use the Self Service Portal component form FIM 2010 as Sharepoint is not our university’s standard for collaboration. As such, we only use the Synchronisation Service Manager along with writing the code ourselves.

Part 1: Installing the Outlook Live Management Agent.

1. Download the “OLSync R4 Download Package.zip” file from connect.microsoft.com – you’ll need to use your Live@EDU registered admin account to do this;
2. Extract the contents of the .zip file;
3. Run the Galsync_R4_v2.msi installer:
1. Welcome screen = Next;
2. License agreement page = I agree & Next;
3. Installation option = Extract files for manual installation & Next;
4. Extract files = choose a directory & Extract;
5. Finish.
4. Using Explorer, navigate to the location where you extracted the files to from step 3 above where you should see the following three sub-directories:
1. Extensions;
2. SourceCode;
3. UIShell
5. Copy all of the contents of each directory as follows (I’m just using the default installation directory for FIM as the destination):
1. Extensions -> C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\Extensions
2. SourceCode -> C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\SourceCode
3. UIShell\XMLs\PackagedMAs -> C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\UIShell\XMLs\PackagedMAs
6. You have now completed a manual installation of the Outlook Live Management Agent.

Part 2: Configuring the Outlook Live Management Agent.

1. Start the Forefront Synchronisation Manager;
2. Select the “Management Agents” tab;
3. Choose the Create action either from the side menu, or the context-sensitive menu;
4. Choose “Outlook Live Management Agent” from the drop-down list named “Management agent for”;
5. Give it whatever name you feel suits the purpose;
6. Next;
7. Set “Connect to” equal to “https://ps.outlook.com/powershell;”
8. Set “User” equal to the account you created as your service account, which by default will look something like “olsync@university.edu.au”;
9. Set “Password” equal to whatever you set the password to be;
10. Next;
11. Click the New button:
1. Set “Parameter Name” equal to “ProvisioningDomain”;
2. Set “Value” equal to your Live@EDU domain name, for example “university.edu.au”;
3. For a list of this and other parameters you can set, have a read of this outlook.com help page.
12. OK;
13. Next;
14. Next (skipping “Configure Attributes”);
15. Next (skipping “Map Object Types”);
16. Next (skipping “Define Object Types”);
17. Next (skipping “Configure Connector Filter” – though you may want to come back to this depending on your requirements);
18. Configuring the “Join and Projection Rules” section depends on your current FIM topology and could take a light year to discuss. If you’ve work with ILM/FIM before, just do what you do best here. If you have absolutely no idea, then you can use the following as a simplistic example for creating mailboxes. We use the metaverse attribute “accountName” as our primary key, meaning our configuration for this screen is as follows:
1. Highlight “Mailbox”;
2. Click “New Join Rule”;
3. On the left side (“Data source”) choose “Alias”;
4. On the right side (metaverse) choose “accountName”;
5. Click the “Add Condition” button, and if you’re prompted about the attribute being non-indexed, just accept that and move on;
6. OK;
19. Next;
20. Okay, with this screen you’re largely on your own – sorry. There’s just too much scope for variance here between organisations/institutions, and it’s extremely likely you’re also going to be dealing with writing your own rule extensions here, too. Still, just so you have some point of reference, here’s the attributes we populate with what they’re based on in brackets:
1. UserPrincipalName (custom e-mail address attribute);
2. Name (accountName metaverse attribute);
3. DisplayName (displayName metaverse attribute);
4. Alias (accountName metaverse attribute);
5. WindowsLiveID (custom e-mail address attribute – same as UserPrincipalName);
6. FirstName (firstName metaverse attribute);
7. LastName (lastName metaverse attribute);
8. EmailAddresses (rule extension as there are multiple addresses added to accounts, and we also have to be able to handle name changes – as I suspect you will, too);
21. Next;
22. Next (skipping “Deprovisioning” – again, it’s up to you as to how you handle this – if at all);
23. If you have enabled PCNS – or intend to, then you can use this final screen (“Configure Extensions”) to enable password management, and if you have written one, to include the “Rules extension name” (a .DLL file – which is beyond the scope of this article).
24. You have now finished defining the structure of your Outlook Live Management Agent.

Part 3: Rules extensions.

This is an exceptionally important part of the process, but beyond the scope of this article. Essentially, if you’re not already familiar with ILM/FIM then you’re possibly not aware that you will need to create at least one rule extension which handles the provisioning of new objects into the Live@EDU connector space.

If you deployment requires it, you may also need to write another rules extension that handles the customised calculation of values to flow back out from the metaverse to the connector space for the OLMA. To give you a simple example, the code might do something as simple as combine a student’s given and surnames to produce a display name. You can’t do this with the “Direct” flow (in the attribute flow screen of the MA). It needs to be an “Advanced” export flow, for which you specify the rule name and write the code to go along with it.

At this point you have done enough to get the OLMA talking to Live@EDU – so long as there no other peripheral issues such as ports being blocked by firewalls and whatnot. You can proceed to run a Full Import and Full Synchronise cycle(s) to populate the connector space and metaverse respectively, though before you can provision accounts into Live@EDU, you’ll have to write your own code to handle the provisioning of the object within the Provision() function.

Cheers,
Lain