I'm working on porting my existing ILM FP1 solution to FIM. I've brought in my AD MA and my HR System MA and an now trying to add the FIM Service MA. Having successfully followed the documentation to create the FIM Service MA and run a Full Import, when I now run the Synchronization step, I get an error in my existing MVExtension. My MVExtension was based upon the original MIIS/ILM supplied code, which expects a CN for provisioning to AD. Since CN is not an available attribute for the FIM service MA, that throws an error. I guess the bottom line question here is, how do I modify my MVExtension Provision code such that, when the FIM Service MA is running, it skips over the AD MA section? Thanks.Ed Bell - Specialist, Network Services, Convergys

There is no need to modify your provisioning code. In FIM, non-declarative and declarative synchronization rules can coexist. Just add an inbound synchronization rule to your project and make sure that "Create Resource in FIM" is selected. You can find more details on this in Understanding Data Synchronization with External Systems and How Do I Synchronize Users from Active Directory Domain Services to FIM. Cheers, MarkusMarkus Vilcinskas, Knowledge Engineer, Microsoft Corporation

In a multi-domain, empty root forest, is there an "FIM Objects" OU per child domain or one per forest? And, if only one per forest, does it matter what domain the OU is in?Ed Bell - Specialist, Network Services, Convergys

You can create as many OUs as you need – there is no limit. Creating specific OU(s) for FIM is only necessary if you want to limit the capabilities of the FIM MA from a security perspective. Cheers, MarkusMarkus Vilcinskas, Knowledge Engineer, Microsoft Corporation

Markus, I have no inbound sync rules at all and whenever I project a user to the metaverse, it wants to create a FIM object. To me it looks like a bug in RTM.Joe Stepongzi - Identity Management Consultant - ILM MVP - www.microsoftIdM.com,ilmXframework.codeplex.com