nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ArcGIS Online ADFS Integration

MikeBenson1

Hello,

I am looking for any information available in how existing AGOL Organization user accounts, user published content and group memberships migrate when the individuals Active Directory account is integrated with AGOL.

Is there the capability to map an existing AGOL account to the new AD account?

Does Esri provide an automated mechanism to migrate user published content and group memberships from the existing AGOL account to the new AD account?

If the migration is a manual process, are there any recommended best practices to follow?

Thanks in advance for any suggestions or responses.

Mike

Encontre mais publicações marcadas com

Accepted answers

Mike Minami

There is nothing currently built into ArcGIS.com to move users in an automated fashion. The admin can manually move items from one user to another, then delete the previous user. There are some python utilities here that may be worth looking at.

https://github.com/Esri/ago-tools

Note that while people have success with these tools, they are unsupported by Esri.

Thanks,

Mike

All comments

Mike Minami

Note that while people have success with these tools, they are unsupported by Esri.

Thanks,

Mike

deleted-user--EOLRcEP5EU5

Mike,

Can I retain my original AGOL accounts while making the transition to AD?

Or once I establish ADFS as the identity provider, can my users no longer login with AGOL accounts to our Organization

Mike Minami

Yes, you can maintain both your AD accounts and AGOL accounts. They are considered separate accounts. Now, you'll probably want to consolidate, as each account consumes a "named user" in the subscription.

Thanks,

Mike

DavidRunneals

We are in the process of rolling this out to our organization, and we have been using the firstname.lastname_<org_ID> already with the AGOL Enterprise Login. If we configure our NameID to be firstname.lastname_<org_ID>, will users be able to login to their already established accounts, there by making the roll out 100x easier?

Also related, would creating a pre-established account for users with the same NameID that would be coming from AD allow users to get to the already pre-established account?

Mike Minami

Unfortunately, you can't can't configure your enterprise logins to use the same username that already exists in AGOL. If you do this, the enterprise login will fail because a username already exists.

However, this is a good idea and I'll write it up as an enhancement. I'm not sure what it would take to do this, so no guarantees...

Mike

TimHaverland4

Hi Mike,

Thanks for the reply and for offering to submit this as an enhancement. I would think this is a pretty common occurrence since the default AGOL organizational account naming convention uses the username of the new user's email address, and that username is typically an organization's enterprise login username.

One clarification: if an enterprise AGOL account name already exists, will the login fail, or will AGOL create a unique username using the patten <NameID>_<OrgID>? For example, if tim.haverland_noaa exists AGOL will create an account name like tim.haverland9_noaa?

This has important implications for how we plan for a migration to enterprise logins.

Tim

JillMathias2

Has there been any changes to moving users over to AD accounts within AGOL?

TIA

Jill

Participe da Conversa

Membros conectados podem postar, seguir atualizações e mais. Novo aqui? Registre uma conta gratuita.

Links Rápidos

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.