Chapter 13. Reporting

One of the new features in Identity Manager 2016 is built-in reporting support. During installation, we discussed the need for System Center Service Manager 2010/2012 R2 in order for the Reporting feature to work.

Once you have managed to install and configure the SCSM environment, using the built-in Reporting feature is quite easy, similar to how we installed SCSM back in Chapter 2, Installation.

In this chapter, we will discuss the following topics:

• Verifying the SCSM setup

• Default reports

• The SCSM ETL process

• Looking at reports

• Modifying the reports

• Hybrid reporting

Verifying the SCSM setup

We usually start by looking at the SCSM Management console to verify that the MIM settings are there. In Chapter 2, Installation, we showed you how to install the SCSM infrastructure.

Follow these steps to verify your SCSM setup:

1. On the MIM Service server, where we will add the MIM Reporting feature, start the System Center Service Manager console. It will ask you to connect to your SCSM Management server:

   

2. What happens usually (but not all the time) is that you will find that the Reporting node is missing in the navigation pane, as shown in the following screenshot:

   

   Don't worry! It just takes some time. On some occasions, you may also need to restart the SCSM Management console for it to appear. We have not yet figured out what causes this issue. This issue may occur due to network timeouts or overall system health.

   However, we are now ready to set up MIM Reporting. Some of these steps may take time to run through the cycles, but the steps are similar to the ones at https...

Default reports

The MIM Reporting service automatically installs management packs to create a number of reports. At http://bit.ly/MIMMOOBReports, the default reports are described, but we have the information copied here for your convenience:

• The Group Membership Change report: This report provides key information about group membership modifications in MIM, including the user account that approved the group change, the type of change, and any related requests or policy rules related to this change.

• The Set Membership Change report: This report provides key information about set membership modifications in MIM, including account information about the user who joined or left a set, approvers (if any), and any related requests or policy rules related to this change.

• The Group History report: This report provides information about changes to key attributes on group resources in MIM, including the group filter, owner, type, domain, and membership.

• The Management Policy Rule History report: This...

The SCSM ETL process

The SCSM ETL process is broken into several steps, which we will outline here. To understand this, we will first start with the MIM service. As we have discussed previously in this chapter, we executed the initial job and watched this job get created in the portal. Now, we will explain what is happening under the hood so that it can help you troubleshoot and manage the reporting system.

The steps to move the data are defined as follows:

• Initial: This process reads data directly from the Service Objects database.

• Initial-Partial: This process allows for the movement and configuration of the schema attribute.

• Incremental: This process runs every 8 hours, or as set by the SQL agent job. This ETL job reads the export log table only.

When you first kick off reporting the Initial job, this job extracts data from the [fim].[Objects] table. So, if you're just turning on Reporting but you have had MIM up for a while and have a large set of data, your initial sync could take a bit...

Looking at reports

There are several ways of looking at MIM reports. You can use the SCSM Management console, but you can also use the web interface of SQL Reporting services.

Using the SCSM Management console (from the MIM Service server, for example) is a way for you, as an administrator, to verify that everything looks alright.

It is not uncommon for the reports to be empty, with the message There is no data available for this report. This is due to the fact that the reports show the data for the last three days by default:

What you need to do is expand the Parameter section at the top of the SSRS site and modify it to match your needs. Once you have done this, you can click on View Report in the Tasks pane to regenerate the report.

The following example shows a report filtered to show all the events regarding the Hunters group, with the display name Hunters:

The web interface is typically the way normal users would access the reports. However, if David (our manager) would like to look at...

Modifying reports

While MIM provides reports based on the default MIM schema, you can also extend MIM Reporting to accommodate custom resources and attributes that you have created in the MIM schema, or customize the way reports are displayed.

Note

For detailed guidance on extending MIM Reporting, take a look at http://aka.ms/FIMReporting.

As mentioned earlier, the MIM Reporting service automatically installs several SCSM management packs to define the default MIM schema and reports. Once you have modified the MIM schema with new resources or attributes, you will need to create another management pack so that SCSM is aware of the new resources.

The following is a summary of this process from the TechNet article at http://technet.microsoft.com/en-us/library/jj133861. It outlines the general process of extending MIM Reporting:

1. Create a new schema management pack for SCSM that contains definitions for the new schema elements.

2. Create a new MIM Reporting binding file. An MIM Reporting binding file...

Hybrid reporting in Azure

While Microsoft Identity Manager provides reports based on the default MIM schema, you can also take advantage of a new feature that provides another reporting option. Reporting in Azure is another simple solution.

The service currently requires the tenant to be a premium feature. This could change in the future, but as of right now it is the requirement:

1. To enable the service first, we need to log in to Azure and download the client:

   

2. Once we have the client, we need to install this on the MIM server that is hosting the MIM Server service. To install it, simply click on MIMHybridReportingAgent.msi and go through the prompts.

3. The agent uses a certificate-based authentication for the transfer of data. This is generated when clicking on the download of the agent, as you can see in the following screenshot:

   

4. While going through the install, you will get the license agreement dialog box. Click on Install.

   The install only takes a moment to complete:

   

5. Once installed, we need to...

Summary

The MIM Reporting and hybrid reporting features are a great way of tracking historical events related to your MIM objects. However, setting up dependency using the SCSM functionality for data warehousing and Reporting makes it hard to troubleshoot and get set up correctly the first time. The use of standard SQL Server Reporting services does, however, make it very easy to make your own custom reports and also to granularly define permissions around your reports. Hybrid reporting opens up the door for customers such as TFC to decide why this type of reporting would work for them.

In the next chapter, we will go into some of the basics of troubleshooting and common errors.