Configuring Attribute Synchronization
The process of synchronizing account data on a source with identity data in IdentityNow is known as attribute sync. Configure attribute syncs to occur automatically or perform them manually.
Traditionally, IdentityNow synchronized attributes at 1:00 am and 1:00 pm GMT (8:00 am and 8:00 pm CST/CDT) based on the time zone of your IdentityNow org. Due to recently released improvements, IdentityNow will synchronize attributes whenever changes are detected as a result of an aggregation. Attribute changes will no longer be queued.
Perform a manual attribute sync when you need to sync an identity's data immediately. For example, if a user with access to sensitive information loses their telephone, you probably won't want to wait for the next scheduled sync to update that phone number in your system. You'll want to update your system with their new phone number as soon as possible. In this case, all you need to do is update the user's telephone number in IdentityNow and run a manual attribute sync to apply the new phone number.
Attribute sync does not currently support syncing multi-value attributes to source accounts. For additional guidance on syncing attributes, see Best Practices: Attribute Sync.
- You understand your sources and the attribute data they contain.
- The supported source is configured for provisioning.
- The attributes to be synced are in the Create Profile provisioning policy for the source.
- The account attribute is mapped directly to an identity attribute in the Account > Create Profile.
- The Sync with Identity option has been selected for at least one attribute on a supported source's Account Sync tab.
Configuring Automatic Attribute Sync
Not all account attributes can be synchronized. To be included in the synchronization process, an account attribute must be included in the source's Account Create profile and mapped directly to an identity attribute.
To setup automatic attribute sync for a source:
Go to Admin > Connections > Sources.
Select the source to be enabled for attribute sync.
Select the Accounts tab.
Select Attribute Sync from the left panel. The Identity Attribute column displays the name of each identity attribute having contents that can be provisioned to the source you are editing. The Account Attribute column displays the name of the attribute on the source that has been mapped to the identity attribute on the source's Create Profile tab.
Select the check boxes in the Sync with Identity column for the attributes to be synced and click Save.
The contents of the selected identity attributes you selected automatically copy to the selected source the next time IdentityNow runs an automated attribute sync.
The selected attributes can also be manually synced for a specific user.
Configuring Manual Attribute Sync
Run a manual attribute sync for a specific identity for when you don't want to wait for the next automatic sync to update attribute data for that identity.
To update the related data in the source so that it matches what's in IdentityNow:
Go to Admin > Identity > Identity List.
Select the identity that you want to update attribute data for.
Select Synchronize Attributes from the Menu icon in the top right corner of the page. An attribute sync begins immediately.
Frequently Asked Questions
Q: Do all attributes gets synced every time the job runs?
A: Attribute sync only occurs when needed to synchronize systems. The sync compares the values in the IdentityNow and the source system. IdentityNow performs a sync when the attributes in the source system do not match those on IdentityNow.
Q: How will I know when the attribute sync process has finished?
A: Search account activity for events that involve updating a single attribute on an account and other identity attribute updates.
Q: Can I run aggregations during an attribute sync?
A: Attribute sync does not have any effect on the performance of other processing tasks such as aggregation, so you can schedule aggregations to run during the synchronization process.
To avoid getting into a synchronization loop, data aggregated after a sync must match the identity attribute. For example, account SQL queries that modify data during aggregation may cause cyclical attribute sync provisioning.
Q: Is role membership calculated during attribute sync?
A: No, but both attribute sync and role membership are calculated during the sync.
Q: How does attribute sync work with null and empty values?
A: IdentityNow treats null and empty values the same and synchronizes these values the same as any other values.