Forum Discussion
(Re)moving students from Groups via SDS
Hi,
Today I've been testing the School Data Sync with manual SDS files. I'm wondering if there's an option to facilitate a scenario where students should be removed from a certain section, and added into a new section.
This might for example happen when a students enrolls into a new year and have switched education path.
I've tried to test this scenario by first adding students via SDS to a section, and then removing the users with another SDS import from that same section. The result is that the student is still member of the Group (section) in Office 365.
Also, i'ts very unclear to my what the "Active" / "Inactive" paramaters in the CSV should be doing. There are present in the Students, Teachers and Sections CSV files.
Many thanks in advance.
Regards,
Remy
10 Replies
- Deleted
Thanks for your interest in SDS.
When you create CSV files from your SIS and upload those into SDS, SDS does update the properties in Azure Active Directory and Office 365 so that a user who moved from one section to another would no longer appear in the first group but would be part of the new group. For example, if STUDENT1 started the term in Math 101, but part way through the term was moved up to MATH 102 in you SIS, then the CSV uploaded to SDS would reflect that change in the SDS admin center as well as in AAD and Office 365.
If you are not seeing this, there could be a few explanations. The first question is, how quickly are you looking for the change to be made? Sometimes it takes a while for changes made via SDS to show up in the tenant depending on other updates and the load on the datacenters. Next, where are you looking to see if the user is still a member of a group? If you are looking in the Office 365 Admin center, it should be reflected. If you are looking somewhere else, such as in Exchange, then it might not have the changes reflected yet. Finally, SDS does not actually ever delete users or groups from AAD. So if you are expecting a group that no longer exists to be removed, or a user who is no longer enrolled in the school to be removed, then SDS will not do that. This is by design, since we do not want SDS to remove a user, their files, their mailbox, etc. just because they are no longer enrolled in a school, which might be a temporary situation. Removing users and groups needs to be a more intentional administrative task. If you want to remove users or sections, here is some more information on that:
- Here is a SOC article which walks through removing users - https://support.office.com/en-us/article/Delete-a-user-from-your-organization-D5155593-3BAC-4D8D-9D8B-F4513A81479E
- If you want to remove users in bulk, PowerShell is the way to go. Use the https://go.microsoft.com/fwlink/?linkid=842230 PowerShell cmdlet
To your other question about active/inactive status, SDS and AAD do not really use that today. When originally designing the schema we envisioned the status would be useful in certain scenarios, but right now it is not used.
Please let me know if this answers your question and if you are now seeing users moved from one section to another as expected. If not, please give as many specific details as you can about whixh SIS you are using, timing, and where yo uare looking for the changes, and I will either help you troubleshoot or get you to the right people who can help.
thanks,
Matt McGinnis
- Rémy BosmanBrass Contributor
Thanks Matt,
I'm currently checking if the changes on the Groups works as you described. I'll let you if it works.I see that the internal Group names are having a fixed format like "11003_section@suffix.com". Do you know if it's possible to change this internal name? We'd like to define these names by ourselves.
Thanks,
Remy- Deleted
Typically the group name created in AAD inherits the "section name" from your CSV file, and the email address combines the SIS Id of the section with "section" to ensure a unique email address. So you can ensure the name displayed is how you want it either by editing the SIS so the section name is the way you want it, or you can change the name in the admin center if you are an administrator (though it looks like that would have to be one at a time, which would be tedious). I don't think there is a way to do it with a script, but I am looking into it. Also, I don't think there is a way to change the email alias, but I am looking into that as well. I'll reply on this thread as soon as I have more information.
Thanks!
Matt
- Deleted
DeletedAt the moment I'm using the Active/Inactive attribute (from our Powerschool sync) in an Azure AD dynamic group. Do you think that will be a problem going forward?
- Deleted
Hi Grant-
there is no problem using the status (active/inactive) attribute. There are no plans to change or remove it, I just don't know of any app that uses it currently. Are you actually using it, or have an apps that does? If so, please let me know so I can educate myself.
Thanks
Matt