ILM

1
ILM 2 from an IT Pro's Perspective

• Andreas Kjellman
• Program Manager

2
ILM 2 from an IT Pro's Perspective

• It looks like youre deploying ILM 2.
• Would you like help?
• Get help with understanding how to deploy ILM
  2.

3
Agenda

• Planning
• Architecture
• Deployment
• Operations
• Security and Protection

4
Deployment

• Planning

5
Step 1, vison/scope

• Know your scope
• Provisioning and synchronization
• User profile
• Group management
• Password reset
• Other custom scenarios

6
Step 2, identify

• Identify your business processes
• Approval and Authorization
• Delegation
• Identify your business rules
• Authority and Precedence
• Connected systems
• Identify user and support roles (Helpdesk,
  Administrators, )

7
Step 3, the features

• Map processes, rules, and roles to features
• Identify the delta between capabilities and
  business need
• Identify custom objects and attributes
• Decide build vs buy
• Bring in a partner or vendor if needed

8
Step 3, the features

• Where to use workflow and where to use management
  agents?
• Should you use declarative provisioning or
  traditional provisioning?

9
Step 4, the details

• Objects and attributes
• objects internal to ILM
• objects that are exposed to other connected
  systems
• Authorization and approvals
• Workflow activities

10
Step 4, the details

• Password self-service reset
• Different security policies
• Different languages
• Group management
• Groups for self-service
• Groups for delegated administration

11
Step 4, the details

• Declarative vs. Traditional provisioning
• Declarative and traditional provisioning work
  hand-in-hand
• How to schedule MAs
• As in MIIS and ILM

12
The team

• When do you need a developer and what should they
  know?
• Windows Workflow Foundation (WF)
• Web services (WCF)

13
Deployment

• Architecture

14
Component names
ILM Portal ILM Password Reset Portal
ILM Synchronization Service
ILM Service and Portal
ILM Certificate Management
ILM Service
ILM Add-ins and Extensions ILM Add-in for
Outlook ILM Password and Authentication
Extensions ILM CM Client
15
Architecture

• What load is expected on the system
• What up-time and SLAs do you need to achieve?
• What components should be combined or separated?

16
Databases

• Total of 4 databases
• ILM Synchronization Service DB
• ILM Service DB
• ILM Service Audit DB
• ILM Certificate Management DB

17
Topologies Scenario 1
18
Topologies Scenario 2
19
Topologies Scenario 3
20
Deployment

• Deployment

21
Migration and coexistence

• From MIIS 2003 or ILM 2007
• From an existing infrastructure
• Configuration from dev ? test ? prod

More gtgt Migration scenarios Migrating from
MMS\MIIS\ILM to ILM 2
22
Migrate from MIIS/ILM

• Backup your encryption keys
• Move the database to your new server
• Install ILM 2
• Done!

23
Coexist with an existing AD

• Import data from an existing AD

Sync Rule Filter Description 1 Attribute
flow member ILM ? AD
Sync Rule Filter Description 2 Attribute
flow member ILM ? AD
Sync Rule Filter Description 3 Attribute
flow member ILM ? AD
Group member attribute equal precedence
24
Configuration migration

• Unique Id needed for Data-Configuration

Configuration
Data
User Group Custom
Set MPR Workflow Definition Synchronization Rule
Schema
Portal configuration
Custom configuration
25
ILM Add-ins and Extensions

• Needed for
• Password Reset Self Service
• Authentication in the portal
• Outlook approvals and requests
• How to
• Deploy using SCCM or similar product
• All settings are configurable using GPOs

26
Languages

• ILM Portal, ILM CM, and ILM CM client
• English, German, Spanish, French, Italian,
  Japanese, Dutch, Portuguese, Chinese (Simplified
  and Traditional)
• ILM Add-ins and Extensions
• Support for 30 languages
• All Office languages except Right-To-Left
  languages

27
Service Accounts

• There are three accounts we care about

Sync Service
ILM Synchronization Service service account
ILM MA account
ILM Service service account
SQL cluster
Portal
ILM Service
Exchange
28
Deployment

• Operations

29
Service Accounts

• ILM Service service account
• If you need to change, some planning is needed
• Both (old and new) accounts must be set in the
  Outlook add-in
• Run a Change install on Service and Portal
• When all approvals with the old account are
  finished, remove the account from Outlook add-in

30
Troubleshooting

• WCF trace files
• Tracing in production, why you might consider a
  separate server

31
Patching

• Updates will be distributed via Microsoft Update.

32
Deployment

• Security

33
Permissions

• New default permissions in the Synchronization
  Engine.
• Local administrators will update binaries.
• MIISAdmins will still have full control over the
  Synchronization Service configuration.

34
Summary

• Planning
• Architecture
• Deployment
• Operations
• Security and Protection
• http//www.microsoft.com/ilm2

35
Deployment

• QA