Maintaining account synchronization and migrating FIM 2010 R2 to MIM 2016 for an IT provider in a banking group
As a subcontractor to a system integrator, we maintained FIM 2010 R2 account synchronization and migrated it to MIM 2016 for an IT provider in a banking group. The system synchronizes user accounts into Active Directory. The 2021 scope included consulting, 1 year of contracted maintenance and an account-provisioning connector. The 2023 scope was migration to MIM 2016.
- 2021: ConsultancyFIM Synchronization Service
- 2021: Existing system administrationFIM 2010 R2 under a 1-year contract
- 2021: Connector developmentCreates accounts in Active Directory, tested in UAT
- 2023: Migration to MIM 2016Migration from FIM 2010 R2
- Industry
- Finance
- Year
- 2021, 2023
- Scope of work
- Contracted work through a system integrator in 2 phases: in 2021, consultancy on FIM Synchronization Service, FIM 2010 R2 system administration under a 1-year contract and development of a Connector that creates user accounts in Active Directory · in 2023, migration from FIM 2010 R2 to MIM 2016
Summary
- This case covers administration of the FIM 2010 R2 user account sync system and its migration to MIM 2016, for an IT service provider within a banking group.
- In 2021, the contracted scope had 3 parts: consultancy on FIM Synchronization Service, FIM 2010 R2 system administration under a 1-year contract, and development of a Connector that creates user accounts in Active Directory, tested in a UAT environment.
- The 3 parts of the 2021 work have the status of delivered according to the requirements of each contract.
- In 2023, the same customer migrated the system from FIM 2010 R2 to Microsoft Identity Manager (MIM) 2016, and the migration work was completed in the same year.
- The 2 phases were contracted work that we took on as a subcontractor to a system integrator, which holds the contract with the end customer. This page therefore summarises the scope and status of the contracted work.
The on-site brief
An IT service provider within a banking group used FIM 2010 R2 to sync user account data into Active Directory. The customer needed someone to advise on and administer this system, and a Connector for creating user accounts in Active Directory. Later, the customer needed to migrate the system to MIM 2016, the version Microsoft developed as the successor to FIM 2010 R2.
What we did
In 2021, the scope of work was consultancy on FIM Synchronization Service, FIM 2010 R2 system administration under a 1-year contract, and development of a Connector that creates user accounts in Active Directory (Provisioning), tested in a UAT environment. In 2023, the scope of work was migrating the system from FIM 2010 R2 to MIM 2016. The 2 phases were contracted work taken on through a system integrator.
Results
The 3 parts of the 2021 work, namely consultancy, system administration and the Connector, have the status of delivered according to the requirements. The migration to MIM 2016 has the status of completed in 2023.
How the brief came about
The challenge in this case was an older user account sync system that needed an administrator and an additional Connector, and later had to be migrated to a newer version. This IT service provider within a banking group used FIM 2010 R2 as its Identity Management system (a system for managing user accounts and access rights). The system synced user account data into Active Directory (the directory Windows uses to authenticate users and computers in an organisation).
The user account sync system sits behind employees' access to computers and work systems. If creating or changing accounts in Active Directory stops working, new employees may not yet be able to log in, and permission changes have to go back to being done by hand.
What are FIM and MIM?
Forefront Identity Manager (FIM) and Microsoft Identity Manager (MIM) are Microsoft software for syncing and managing user accounts across multiple systems from a single point. MIM 2016 is the version Microsoft developed as the successor to FIM 2010 R2. FIM Synchronization Service is the component that retrieves and sends user account data between the systems connected to FIM.
Requirements and constraints
The work in this case had to be delivered according to the requirements of each contract and had to work with the systems the customer was using. The main requirements and constraints are as follows.
- The source system is FIM 2010 R2, which syncs user accounts into Active Directory, and the target system of the migration is MIM 2016.
- The Connector for creating user accounts in Active Directory must be tested in a UAT environment (the test environment used before going live).
- The work in the 2 phases was taken on through a system integrator, so the scope of work was set by the contract for each phase, and each contract has its own requirements.
Why test the Connector in UAT before using it on the live system?
A Connector for Provisioning (automatically creating user accounts in the target system) writes data directly to Active Directory. Testing in a UAT environment separate from the live system therefore allows the account creation results to be checked without affecting real users' accounts. In this case, the 2021 Connector scope of work specifies development and testing in a UAT environment.
Deliverables
What was delivered in this case is contracted services, divided by year as follows.
- 2021: Consultancy on FIM Synchronization Service
- 2021: FIM 2010 R2 system administration under a 1-year contract
- 2021: Connector for creating user accounts in Active Directory (Provisioning), tested in a UAT environment
- 2023: Migration from FIM 2010 R2 to MIM 2016
How is the migration from FIM 2010 R2 to MIM 2016 separate from administering the existing system?
The migration was separate work in 2023, after the 3 parts of the 2021 work. The 2021 work was on the existing FIM 2010 R2 system, while the 2023 work was the migration to MIM 2016. The 2 phases were for the same end customer and were taken on through a system integrator.
Confirmed results
The confirmed result of this case is the contracted work status of each phase. In 2021, the 3 parts of the work for the FIM 2010 R2 system of the IT service provider within a banking group have the status of delivered according to the requirements. In 2023, the migration from FIM 2010 R2 to MIM 2016 has the status of completed in the same year.
This case has no measured figures, such as the number of accounts migrated or system downtime, so we report only the work statuses backed by documents.
What we learned
The contract structure of the work in this case points to 3 principles for Identity Management system administration and migration work.
- In work of this kind, a Connector that creates user accounts should first be tested in a separate environment, because the Connector writes data directly to Active Directory. The Connector scope of work in this case specifies testing in UAT.
- Administration of an existing system and migration work should be clearly scoped apart. The former keeps the existing system running, while the latter changes the system version. In this case, the two were in different years and were separate work items.
- Work taken on through a system integrator should be scoped by contract and have verifiable requirements. The 2021 work in this case was split into 3 items, and each item has a status measured against the requirements of its contract.
How can you apply this approach in your organisation?
If your organisation still uses FIM 2010 R2 to sync user accounts into Active Directory, you should survey the existing system and test the Connector in UAT before moving to MIM 2016. What needs adapting to your organisation is the list of connected systems and the scope of work after the migration.
Reusable parts and parts that need adapting
| Part of the work | Reusable | Needs adapting when |
|---|---|---|
| Existing system administration | Separating FIM 2010 R2 system administration into a contract with a clear duration | If your system is a different version or already has an administrator, the scope of work must be agreed anew |
| Connector | Developing a Connector that creates user accounts in Active Directory and testing it in UAT | If the target system is not Active Directory, or you do not yet have a UAT environment, preparation is needed first |
| Migration | Separating the migration from FIM 2010 R2 to MIM 2016 from the administration of the existing system | If the systems connected to FIM differ in number or type from this case, the existing systems must be surveyed before the work is assessed |
| Administration after migration | Defining administration work as a contract with verifiable requirements, like the FIM 2010 R2 administration under a 1-year contract | An administrator for the MIM 2016 system and a new administration scope must be defined to suit your system |
- Compile a list of the source and target systems currently connected to FIM, such as LDAP directories (user data stores that use the standard LDAP protocol) and Active Directory, along with the Connector used for each system.
- Prepare a UAT environment separate from the live system, to test Connectors and sync rules before go-live.
- Set the migration window together with the teams that look after Active Directory and other affected target systems.
- Agree clearly who will administer the MIM system after the migration and which tasks this covers.
Technology used
Frequently Asked Questions
What is the difference between FIM 2010 R2 and MIM 2016?
Both are Microsoft software for syncing and managing user accounts across multiple systems. MIM 2016 is the version developed as the successor to FIM 2010 R2. In this case, the customer migrated from FIM 2010 R2 to MIM 2016 in 2023.
What does the Connector in this scope of work do?
The Connector in the 2021 scope of work is used for Provisioning, that is, creating user accounts in Active Directory from data in the Identity Management system. This scope of work specifies development and testing in a UAT environment.
Was this work under a direct contract with the end customer?
No. The 2 phases were contracted work that we took on as a subcontractor to a system integrator. The system integrator holds the contract with the end customer. This page therefore summarises the scope and status of the contracted work in each phase.
How much does a migration or Connector development cost?
There is no standard price. The price depends on the number of connected systems, the number of Connectors and the testing scope. Contact us to request a quotation. We assess the work after reviewing your existing system.
Is an administration service available after the migration?
We offer annual system administration services. The scope of work, such as system check cycles and issue reporting channels, is set out in each contract.
