Handling PowerShell elevated permission?

Question

Hello,

We are currently evaluating Adaxes for our own consulting company and for our customers too.

Our setup include AD On Prem with Azure AD Connect which sync new identities to Azure AD on a schedule.

When we create or update a new account with Adaxes we can rely on Azure AD support but that's kinda partial for what I see.

The best option would be to trigger the Azure AD sync command when we save, to have a more complete scenario.

We followed the related documenation to add a custom action for that purpose, but we end with a priviledge issue.

What is the proper way to have out Adaxes service account allowed to start the sync? This part is not in the documentation we found.

Thanks a lot

Comments

Hello,

We followed the related documenation to add a custom action for that purpose

Could you, please, provide all the possible details regarding the workflow you have configured? Please, post here or send us (support@adaxes.com) screenshots.

we end with a priviledge issue.

What exactly do you mean? Do you face any error messages? If so, please, post here or send us screenshots.

---

Hello

Sorry, I forgot to close this topic.

Issue I got was not permission related but context related. We had to import the PowerShell Module before running the delta sync.

This is our final configuration:

Import-Module "C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1"
Start-ADSyncSyncCycle -PolicyType Delta

Answer 1

Hello,

Thank you for the confirmation. You can also use the below script where the $dirsyncServer variable specifies the fully qualified domain name of the server that hosts the AAD Connect tool.

$dirsyncServer = "dirsync.domain.com" # TODO: modify me

Invoke-Command -ComputerName $dirsyncServer -ErrorAction Stop -ScriptBlock {
    Import-Module "C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1"

    Start-ADSyncSyncCycle -PolicyType Delta
}