Back to Synchronization
Synchronization Important

Auto Sync Projects

23 views

title: Auto Sync Projects category: Synchronization tags: auto-sync, object-classes, automatic, 24-classes, setup priority: High

Auto Sync Projects

When you set up IdentityCenter through the Quick Config Wizard or create a new connection, the system can automatically generate sync projects for all 24 supported Active Directory object classes. This means you get comprehensive directory coverage without manually configuring individual sync projects.

How Auto Sync Works

  1. You create a connection to Active Directory
  2. IdentityCenter detects the available object types
  3. Sync projects are automatically created for each supported object class
  4. Each project comes pre-configured with the correct LDAP filters and attribute mappings
  5. You can run all of them immediately or customize them first

Supported Object Classes

IdentityCenter supports syncing 24 AD object classes, organized into categories:

People & Accounts

Object Class What It Syncs LDAP Filter
Users Employee accounts, admin accounts, service accounts (&(objectClass=user)(objectCategory=person))
Contacts External contacts (typically mail-enabled) (objectClass=contact)
InetOrgPerson RFC 2798 person objects (some environments use these instead of users) (objectClass=inetOrgPerson)

Groups

Object Class What It Syncs LDAP Filter
Groups Security groups, distribution lists (&(objectClass=group)(objectCategory=group))

Computers & Devices

Object Class What It Syncs LDAP Filter
Computers Domain-joined workstations and servers (&(objectClass=computer)(objectCategory=computer))
Printers Network printers published in AD (objectClass=printQueue)

Service Accounts

Object Class What It Syncs LDAP Filter
gMSA Group Managed Service Accounts (objectClass=msDS-GroupManagedServiceAccount)
MSA Traditional Managed Service Accounts (objectClass=msDS-ManagedServiceAccount)

Organizational Structure

Object Class What It Syncs LDAP Filter
Organizational Units OU hierarchy (objectClass=organizationalUnit)

Infrastructure & Networking

Object Class What It Syncs LDAP Filter
Sites AD replication sites (objectClass=site)
Subnets AD site subnets (objectClass=subnet)
Site Links Replication topology links (objectClass=siteLink)

Security & Trust

Object Class What It Syncs LDAP Filter
Trusts Domain and forest trust relationships (objectClass=trustedDomain)
Foreign Security Principals Cross-domain/forest security principals (objectClass=foreignSecurityPrincipal)

DNS

Object Class What It Syncs LDAP Filter
DNS Zones AD-integrated DNS zones (objectClass=dnsZone)
DNS Nodes Individual DNS records (objectClass=dnsNode)

Group Policy

Object Class What It Syncs LDAP Filter
GPOs Group Policy Objects (objectClass=groupPolicyContainer)

Certificate Services

Object Class What It Syncs LDAP Filter
PKI Certificate Templates Certificate templates (objectClass=pKICertificateTemplate)
PKI Enrollment Services Certificate enrollment points (objectClass=pKIEnrollmentService)

Schema

Object Class What It Syncs LDAP Filter
Schema Classes AD schema class definitions (objectClass=classSchema)
Schema Attributes AD schema attribute definitions (objectClass=attributeSchema)

Other

Object Class What It Syncs LDAP Filter
Shared Folders Published file shares (objectClass=volume)
Service Connection Points Service discovery objects (objectClass=serviceConnectionPoint)

Attribute Mappings

Each auto-generated sync project comes with pre-configured attribute mappings tailored to that object class. For example:

User Attribute Mappings

The user sync project automatically maps:

  • displayName, givenName, sn (surname), mail
  • sAMAccountName, userPrincipalName
  • department, title, company, manager
  • telephoneNumber, mobile, streetAddress, l (city), st (state), postalCode
  • employeeID, employeeType, division
  • userAccountControl (for account status detection)
  • lastLogon, lastLogonTimestamp, pwdLastSet, accountExpires
  • whenCreated, whenChanged, objectGUID, objectSid

Group Attribute Mappings

  • cn, description, mail, managedBy
  • groupType (security vs. distribution, scope)
  • member (group membership list)
  • memberOf (nested group memberships)
  • whenCreated, whenChanged

Computer Attribute Mappings

  • cn, dNSHostName, operatingSystem, operatingSystemVersion
  • servicePrincipalName (SPNs)
  • lastLogon, lastLogonTimestamp, pwdLastSet
  • managedBy, location, description

Managing Auto Sync Projects

Viewing Projects

Navigate to Synchronization > Projects to see all auto-created sync projects. Each project is named with the format: [Connection Name] - [Object Class]

For example:

  • "Corporate AD - Users"
  • "Corporate AD - Groups"
  • "Corporate AD - Computers"

Customizing Projects

You can modify any auto-generated project:

  1. Click on the project name to open it
  2. Adjust the LDAP filter to narrow the scope (e.g., add an OU filter)
  3. Add or remove attributes from the mapping
  4. Change the sync schedule
  5. Save your changes

Disabling Unnecessary Projects

Not every organization needs all 24 object classes. To disable a sync project you don't need:

  1. Open the sync project
  2. Set the schedule to Manual (or disable the schedule)
  3. The project will only run when you manually trigger it

Tip: Most organizations only need 5-6 sync projects active: Users, Groups, Computers, Contacts, OUs, and possibly gMSAs. Start with these and enable others as needed.

Running Sync Projects

  • Run All — Click the "Sync All" button to run every project for a connection
  • Run Individual — Click "Run Now" on a specific project
  • Scheduled — Projects run automatically on their configured schedule

Best Practices

  1. Start with the essentials — Users, Groups, Computers, and OUs cover 90% of use cases
  2. Add service accounts early — gMSAs and MSAs are critical for security audits
  3. Review before scheduling — Run each project manually first to verify the results look correct
  4. Customize filters for large environments — If you have 50,000+ objects, filter by OU to sync only what you need
  5. Monitor sync history — Check Synchronization > History regularly for errors or unexpected object counts

Next Steps

Tags: auto-sync object-classes automatic 24-classes setup

Was this article helpful?

Related Articles

Synchronization Overview
Creating a Sync Project
Sync Troubleshooting Guide