thanks Andy,
has anyone considered the "API-driven provisioning to Microsoft Entra ID" and "API-driven provisioning to on-premises Active Directory" SCIM endpoints in Entra as a replacement for MIM? For SITS customers these look like a possible replacement for MIM. StuTalk -> ServiceBus -> business logic -> Entra ID. Customisable schema to extend as required.
cheers,
Alistair
________________________________________
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> on behalf of Andy Swiffin (Staff) <[log in to unmask]>
Sent: 10 January 2024 08:53
To: [log in to unmask]
Subject: Re: Where are we all in regards to MIM and its EOL
Warning. This email contains web links and was not sent by the UHI.
Only click on these links if you are certain that the email is genuine and the content is safe.
Hi Alastair,
Hope all is well at UHI
Isn't that exactly why we moved to MIM, to get away from "a suite of in-house developed (perl) scripts (that were written by someone no longer with us and which no-one actually understands)"? OK, there is some software development you have to do within MIM to get it to do stuff, but it should be possible to get any MIM consultant in who will be able to make sense of what they find in the event that the people who look after it leave. It seems a bit retrograde to go back to doing everything in house.
my 2 groats
Andy
(Dundee)
________________________________
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> on behalf of Alistair Young <[log in to unmask]>
Sent: 09 January 2024 15:02
To: [log in to unmask] <[log in to unmask]>
Subject: Re: Where are we all in regards to MIM and its EOL
[Some people who received this message don't often get email from [log in to unmask] Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
CAUTION: This email originated from outside the University of Dundee. Do not click links or open attachments unless you recognise the sender's email address and know the content is safe.
Given the integration landscape is much easier these days with less developer-heavy routes into integrating systems, do people see a MIM replacement as a suite of in-house developed "glue pods" that dispense appropriate sticky stuff between appropriate systems, based on sources of truth within the organisation? e.g. Logic apps, power apps, graph api etc?
As opposed to a monolithic off the shelf product that has connectors for everything apart from that one critical system?
For example, it's quite simple to wire to up a StuTalk feed to a listener that does to Entra what MIM does to on-prem AD. Feed the Entra changes back in to on-prem AD if required and suddenly the MIM Sync Engine is no longer required.
thanks,
Alistair
________________________________________
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> on behalf of Jules Andreae <[log in to unmask]>
Sent: 04 January 2024 13:30
To: [log in to unmask]
Subject: Re: Where are we all in regards to MIM and its EOL
Warning. This email contains web links and was not sent by the UHI.
Only click on these links if you are certain that the email is genuine and the content is safe.
Thanks for the correction Andy, I had mis-remembered the SharePoint EOL dates actually being 2026. I incorrectly was thinking it was this year.
Also some very useful insights into SoftwareIDM, thank Tim.
Jules
-----Original Message-----
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> On Behalf Of Andy Swiffin (Staff)
Sent: Wednesday, January 3, 2024 3:25 PM
To: [log in to unmask]
Subject: Re: Where are we all in regards to MIM and its EOL
CAUTION: This email originated from outside of the organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe.
Hi,
We too started looking at the HyperSync Panel back before the MIM end date was extended. OCG were doing some stuff with it: https://oxfordcomputertraining.com/resources/after-mim-hypersync-panel<https://oxfordcomputertraining.com/resources/after-mim-hypersync-panel>
I went through the softwareIDM website to try and price a replacement for what we had to get some idea, the numbers were pretty eye watering but these were list price and I never got round to digging any further to see what they would do for education.
There really is nothing we've found to do the kind of things that we do with MIM. We make a lot of use of the MIM portal/service to run a lot of workflows based on user attribute changes and we use MIM to aggregate multiple sources (students/staff) and use it to populate various on premises systems. We have a group engine that MIM writes to and reads from that keeps thousands of groups/lists up to date based on ldap filters.
I think you're being a bit hard, Jules, when you say "the current state of a heavily deprecated MIM" - the deprecations concern things like windows 2008 (that should be long gone!) and connectors to lotus notes etc, (thankfully we could never work out what Bhold actually did!). All of the functionality we actually use is fine.
We haven't looked at Logic Apps to see if there's anything we could do there, although if there's a huge price issue I can see that being very "popular" in the light of what's about to happen re- storage.
Cheers
Andy
(Dundee)
-----Original Message-----
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> On Behalf Of Jules Andreae
Sent: Wednesday, January 3, 2024 2:43 PM
To: [log in to unmask]
Subject: Re: Where are we all in regards to MIM and its EOL
[Some people who received this message don't often get email from [log in to unmask] Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
CAUTION: This email originated from outside the University of Dundee. Do not click links or open attachments unless you recognise the sender's email address and know the content is safe.
Hi Tim,
Thanks for your insights. Some of the main stumbling blocks I see with Entra Governance is around it supported sources of truth.
Specifically support for multiple sources of truth, Staff & Student. I have not seen any updates around multiple sources now being supported and it still seems limited to cloud based HR solutions only. For us the student side provisioning has a reasonable amount of pre-provisioning logic, and again is an on-prem hosted solution. Though also with plans to be cloud hosted soon "tm".
As you have stated, we are all generally in tight positions where new costs are concerned. From the licensing side, the main functionality is in "Entra ID Plan 2 Step-ip" (renamed AzureAD P2), which is also a part of A5 coverage, so appealing to keep costs at current levels. Or utilizing as much functionality as possible to reduce other software costs. When looking at MIM functionality in Logic Apps, like you I worry about the cost scaling on this based on what a final solution would look like. The per run costs soon add up, as we see with some logic apps associated with our dynamics instances.
SoftwareIDM is the only other solution I have currently (briefly) looked at, after chatting to the Dev whom was present at the Identity Summit. It looks like a promising product that would be interesting to see being used at an institution.
From,
Jules
-----Original Message-----
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> On Behalf Of Purkiss, Tim
Sent: Wednesday, January 3, 2024 11:39 AM
To: [log in to unmask]
Subject: Re: Where are we all in regards to MIM and its EOL
[You don't often get email from [log in to unmask] Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
CAUTION: This email originated from outside of the organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe.
Hi Jules,
The Entra Governance options have expanded considerably and are looking more like viable replacements for many MIM tasks, assuming the organisation is also moving generally towards Entra ID. In particular, Entra now has lifecycle features and more flexible APIs - so in theory you could be shifting MIM MA code into Logic Apps, populating Entra via API and then syncing back to on-prem AD if you still need that presence. The big downside is that some of the features are hidden behind a new expensive licensing tier. Our back-of-a-napkin roadmap for MIM and AADC is along those lines, depending a lot on how much things would cost.
The only product I've seen that works either alongside or as a cloud replacement specifically for MIM is Software IDM's Identity Panel suite - again, potentially costly, but maybe not when compared to additional MS licensing. And likely still cheaper to implement than one of the big IAM platforms.
Regards,
Tim
____________________________________
Tim Purkiss
Platform Owner: Identity and Access Management Information Services Division UCL
E: [log in to unmask]
-----Original Message-----
From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> On Behalf Of Jules Andreae
Sent: Tuesday, January 2, 2024 4:13 PM
To: [log in to unmask]
Subject: Where are we all in regards to MIM and its EOL
⚠ Caution: External sender
Afternoon All and a happy new year to all,
It has been a while since the last discussion on the future of MIM discussions in this list and I am sure for some institutions much will have changed.
Despite 2029 still being a good while away, the current state of a heavily deprecated MIM (https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features<https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features>) and lack of a like for like functional replacement means we are considering our full range of options for the daunting task of its full replacement. Varying from functionality based replacements, to a full reconsideration of our identity ecosystem and lifecycle, in what is a more and more cloud first world. The latter option being a massive undertaking, with a hefty associated risk from the scale of replacement of this core infrastructure and associated processes.
I would be interested to hear from others in the list. Are you still awaiting updates from Microsoft on getting the tooling feature more on par? Have you started your MIM replacement journey? If so I would be very interested in what direction you have gone, and how that journey has gone / is going.
From our perspective:
Until now. we have been waiting to see what happens from Microsoft, with the delayed EOL giving us much needed breathing room to complete other aspects of cloud migrations and associated development work. While in this state we have split our identity based workflows for new processes. Utilising cloud first approaches for cloud service workflows. Which has mainly been utilising Azure, with most work going into Runbooks alongside logic apps, utilising PowerApps when a user front end is required. As such not adding onto our MIM workflows and complexity. As an organization we did not implement MIM portal, these azure workflows allows us to really demonstrate the benefit of the user first approach. Empowering users through PowerApps which have business logic embedded in the associated workflows.
Our first workflow implemented via this process was management of exchange corporate/shared mailboxes. Previously the process was managed by our support teams, with only minimal automation on deletion, mailbox owners now have full control over the lifecycle (creation, renewal, access management, closure, etc.) - helping to improve the experience for our users and free up staff time for other tasks. These have been great experiences to give context to our goals and requirements when replacing MIM, both in times of the scale / impact of improvements we could make, but also the time of effort they can require.
from,
Jules
Julian A Andreae | Infrastructure Development Engineer (Identity and Cloud) Server Infrastructure Development Team, Information Services, University of Kent
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1<https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1>
This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY<http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY>, a mailing list hosted by http://www.jiscmail.ac.uk/<http://www.jiscmail.ac.uk/>, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/<https://www.jiscmail.ac.uk/policyandsecurity/>
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1<https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1>
This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY<http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY>, a mailing list hosted by http://www.jiscmail.ac.uk/<http://www.jiscmail.ac.uk/>, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/<https://www.jiscmail.ac.uk/policyandsecurity/>
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1<https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1>
This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY<http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY>, a mailing list hosted by http://www.jiscmail.ac.uk/<http://www.jiscmail.ac.uk/>, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/<https://www.jiscmail.ac.uk/policyandsecurity/>
The University of Dundee is a registered Scottish Charity, No: SC015096
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1<https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1>
This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY<http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY>, a mailing list hosted by http://www.jiscmail.ac.uk/<http://www.jiscmail.ac.uk/>, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/<https://www.jiscmail.ac.uk/policyandsecurity/>
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1<https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1>
This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY<http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY>, a mailing list hosted by http://www.jiscmail.ac.uk/<http://www.jiscmail.ac.uk/>, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/<https://www.jiscmail.ac.uk/policyandsecurity/>
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1<https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1>
This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY<http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY>, a mailing list hosted by http://www.jiscmail.ac.uk/<http://www.jiscmail.ac.uk/>, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/<https://www.jiscmail.ac.uk/policyandsecurity/>
The University of Dundee is a registered Scottish Charity, No: SC015096
________________________________
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1
########################################################################
To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1
This message was issued to members of www.jiscmail.ac.uk/MICROSOFT-IDENTITY, a mailing list hosted by www.jiscmail.ac.uk, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/
|
