Optimize AD Groups for Contact Lists
By Vernon Weitzman
Smartphones, Contact Collections and the Global Address List
There are many elegant things about Active Directory. One thing that has always impressed me is the simplicity, reliability and scalability of AD Groups. When constructing groups, it is trivial to insert mailboxes, contacts or domain users as members of a group. We also have the flexibility to nest groups inside of groups. When we ultimately send an email to a distribution group, the expansion happens on the server and can recursively include dozens or even hundreds of groups and thousands of recipient objects.
Using AD Groups in Applications
For the last decade, itrezzo has leveraged Active Directory Distribution Groups to sync smartphone contacts. For example, AD Groups can be used to easily define Outlook contact lists. The contact lists determine which users receive the GAL or a subset of the Global Address List. The platform also uses groups for rights management, licensing, reporting and creating a custom view of the Employee Directory.
One of the common challenges is to find an existing group which appears to be perfect, but we can’t use it to sync a smartphone contact list. For example, the All New York group has 300 members, but there are 20 mailboxes for the training room, there are another five test mailboxes and five conference rooms. When pushing the All New York contacts to the CEO’s smartphone, we just don’t want him asking why we are cluttering his address book with training room and test mailboxes.
itrezzo Contact Collections
In this case, the All New York group was almost perfect. Along those lines, here are some other examples where AD objects are almost what we need for smartphone contact management:
-
You want to use all OU’s in the GAL, except that if you display the entire GAL in the Employee Directory, you will have vendor contacts, conference rooms, test mailboxes, and student training mailboxes.
-
You don't want all OU's ... just a few specific ones.
-
There is a distribution group defining everyone on the sales team. The CEO is also a member of this group. You want to push a list with 500 reseller and partner contacts to everyone on the sales team. The CEO does not want these contacts.
In the normal scenario, someone else in the organization owns or manages the Distribution Groups and the OU’s and there is not an opportunity to modify these objects.
One solution is to use a Collection object from the itrezzo ECO Web Administrator. An itrezzo Contact Collection allows you to leverage groups or OU’s that are close to what you need with a unique capability to add exclusions.
First pick a name for the collection1. Next, select the dropdown to choose the type of object you wish to add to the collection2. Type a few characters in the search box3 and move those objects to the inclusion list. Note that you can also nest collections and build compound collections.
Note that you can exclude any objects you don’t need or want in your collection. For example, if you see several unwanted mailboxes in the expansion, you can exclude Mailboxes, AD Contacts, AD Groups, and also exclusions. In this example, we have previously created a collection called Unwanted Mailboxes and that entire collection is an exclusion list5.
Once the contact collection is saved, you can enumerate the members of the collection. The Members button will display a hierarchy and allow you expand and collapse any branch of the tree. Branches can be AD Distribution Groups, or other collections.
Note that in the snapshot shown above, the AOLTest6 mailbox has a line drawn through it. This visual indicator makes it easier analyze and configure collections.
Reusable Contact Collections
Another benefit is that collections can be shared among numerous contact lists. For example, when several Mandatory Contact Lists (MCL) or Custom Contact Lists (CCL) share common targets, it is repetitive to enumerate a set of targets for each list. Now when the targets change, only the collection need be modified. Here are some examples of the way that ECO Contact Collections can be used:
-
As the source, or the target of a contact list. Create several Mandatory Contact Lists without creating redundant source or targets.
-
ECO administrative rights can use collections.
-
The ECO Scheduler can use collections as way to define tasks for specific users.
-
Employee Contact Portal view can use collections. For example, you need a filtered GAL to display an Employee Directory that is free of unwanted mailboxes and contacts.
-
Self Service Update can leverage collections to determine which users get reminder messages.
Future Collections
Much like query based distribution groups, contact collections will eventually be extended to allow an LDAP query to define the members. A SQL Table with a list of SMTP addresses might also data-drive a contact collection. These two mechanisms can deliver even greater flexibility in order to sync smartphone contacts.
Collections could ultimately be wired to create and maintain new AD Distribution Groups. This would allow the creation of special groups that leverage exclusions and allow a greater degree of automation in the maintenance of groups.
If you are an Office 365 user, check out Creating Contact Collections from Office 365 Dynamic Distribution Groups on CiraSync, a secure Azure-based SaaS platform.
No comments:
Post a Comment