In smaller 80 days deployments consisting of a single domain and forest built in tools such as the Active
Directory administrative center or Active Directory Users and Computers Management Council are generally
sufficient for managing the associated User Group and computer objects in your organization.
However as the administrator of a complex a tedious environment you will be managing millions of objects
across multiple forests and domains which makes tasks increasingly tedious and difficult.
If they are rather the only tools that are available to you in these situations you might need to implement
advanced identity management processes to handle the various issues associated with administration.
Let's consider the following scenarios if your scenario is user user management in complex aided years
deployments.
It is generally not feasible for an administrator to maintain user objects manually tasks such as creating
new user accounts.
UPDATE In a user department or provision in an Exchange server mailbox should generally be handled by
an automated workflow that is initiated by the authoritative data source.
For example you might decide to create a tedious user accounts automatically in a specific domain for
new employees based on data from your organization's H.R. application.
In the employee's department changes in the H.R. application.
You might want the same change to reflect on the correspondent a tedious User object handling these
tasks using an automated workflow is generally more efficient and less prone to human error.
The next scenario is group management similar to manage and user objects manually managing groups and
complex HDD deployments can present several challenges because group man memberships changes might often
require authorization.
You might decide to delegate management of group objects objects to designate it individual or group
of individuals.
However for those who are not administrators managing group objects might not be an intuitive process.
In some cases delegates and management of groups might still result in inefficiencies that could be
better handled by automation.
For example a role based access in your organization might depend on what department a user object is
assigned to.
Rather than manually maintaining a security group for each department in the organization using automation
to update group memberships based on the user's assigned department might be more efficient.
The next scenario is user self-service implement and user self-service for tasks such as account unlocking
and password resets can help you alleviate march of the administrative overhead that is associated with
complex eds as deployments.
Another scenario is cert management in a typical edit s deployment.
You might have one active directory cert service certification authority or forest.
Therefore in complexity the deployments with multiple forests you might have multiple certification
authorities to manage in this situation.
Maintaining the required templates automatic and royal enrollment policies and certificate revocation
of the provision to users across multiple forests can be a challenge.
Another scenario is identity SIMKIN As organizations become more cloud based.
You might need to seen user identities with cloud services such as Asia or Active Directory to use offerings
such as Microsoft Office 3 6 2 5 4 multi factor authentication.
You might also have multiple on premises authentication stores your legacy line of business applications
that necessitate seeing can user data so that it is consistent in each service.
Now some words about Microsoft Identity Manager 2016 to address many of the scenarios above you might
consider deploying an identity and access management platform such as Microsoft Identity Manager or
meme meme 2016 can seamlessly make your existing data DSA identities cloud ready.
It also provides powerful user of self-service capabilities and enhanced security features to support
your on premises or high brute infrastructure.
It is cloud ready identities meme 2016 can automatically prepare HDD identities for a SIM card with
Asia Active Directory by stander ties and HDD user attributes and values it is user self-service meme
2016 allows users to unlock their accounts or reset their password by using multi factor authentication.
It also allows users to create and maintain groups by using workflow approval and its support cert management
for multiple forest scenarios and memos about enhanced security Pam and mem 2016 uses a separate data
it is forest to provide additional time bound security of administrator accounts.