Create a Pending Report for Microsoft Identity Manager

Identity Panel has the ability to create reports of pending operations in MIM, FIM, or AD Connect.

Pending reports are not normal Identity Panel reports. Instead they are a special case schedule step. Because they don't use the regular reporting system they may be used during a go-live scenario before Identity Panel scanning is turned on.

Pending reports use csexport.exe to generate an XML file containing items that are pending export, or pending synchronization. The schedule step then parses the XML and creates an Excel spreadsheet with worksheets for Adds, Updates, and Deletes.

The Pending Report step process the file as an XML stream instead of a document, and splits worksheets when they reach the 3 million row max. This permits the reports to be used even when dealing with very large numbers of changes (it has been run in scenarios in excess of 8 million attribute level changes per MA).

Setup

Create a Pending report by adding the "Pending Report" schedule step. Prior to 3.3.9 this may be called "Pending Sync Report" or "Pending Export Report".

Select the required environment, and MA fields. You may run multiple pending reports in parallel provided they are for different MAs.

Choose Import or Export mode, and enter a fully qualified directory name to place the report files in. You MUST grant write access on this folder to the Panel Service account on the MIM server. It is possible but not recommended to use a file share.

Pending reports MUST be run on the MIM server. Ensure the schedule steps select preferred server and only preferred. The associated sync provider must have the CSExport path specified.

If you select "Append Date" the report in the directory will have the current year month day and hour appended, allowing you to accumulate a history of reports. Otherwise previous reports will be deleted.

You may optionally provide a comma-separated list of email addresses in the "Email To" field to send the resulting spreadsheet as a file attachment. This will only work if the report is small enough not to exceed the mailbox attachment limit. In most environments the file sizes will be small enough.

Conditions

Pending reports are recommended any time a threshold is configured on a management agent. Ideally the report threshold should be between 50% and 80% of the inverse of the run management agent step.

The pending report step should be place above the run MA step in the schedule sequence, so that if the MA condition is configured to pause the schedule the interruption will happen after the report has been generated.

For example:

Run MA Condition:

And(
  NumExportAdd(MA) < 50, 
  NumExportUpdate(MA) < 100, 
  NumExportDelete(MA) < 10
)

Pending Report Condition:

Or(
  NumExportAdd(MA) > 35), 
  NumExportUpdate(MA) > 70, 
  NumExportDelete(MA) > 6
)