Planning for Special Situations in SDS

Planning for Multiple Domains

Your domain configuration may greatly impact the number of sync profiles needed to configure identity matching for all students and teachers. Often, school districts will need to append a domain to one of the three available source directory values to match students and teachers from the source directory to the user object in O365/Azure AD. A sync profile in SDS allows you to use one domain for student identity matching and one domain for teacher identity matching. If your teachers and students in Azure AD have several different domains for the target identity matching attribute, specifically for the UserPrincipalName or Mail attribute, you may need to create multiple sync profiles to effectively match all your users. If you have a single domain in use for the UserPrincipalName or Mail attribute across your teachers and students, you may be able to configure only a single sync profile for identity matching all teachers and students.

Recommendations

Configure your users in O365/Azure AD to use a minimum number of domains for their domain suffix value specifically with the UserPrincipalName and Mail attributes, to ensure your identity matching configuration can occur within a single sync profile, or small number of sync profiles. Remember, as your sync profile count exceeds the recommended three, you may see delays in sync processing due to performance limits discussed earlier in this article. You can only configure 2 domains per sync profile, one for students and one for teachers.

Planning for Large Districts

When enabling sync for large or very large districts (100K+ users), you may need to configure extra sync profiles to accommodate the two million row limit per CSV file. As stated earlier in this article, if you have 250,000 students, and each student has 8 sections each, your student enrollment.csv will hit the two million row limit.

Recommendations

  1. For any districts that plans to sync more than 200,000 students, you should plan to split your users across multiple sync profiles, to ensure you don’t exceed the limit for rows within a CSV file. Ensure that the split of CSV files is along school lines, so that half of the students, teachers, sections, and roster data for your schools goes into the first sync profile while the second half of teachers, sections, and roster data goes into the second sync profile. All school-based relational data should be maintained within the same sync profile, so plan your SIS/MIS export accordingly.
  2. If importing CSV files, consider a unique naming convention for your sections, to ensure each section is unique and identifiable to your users as they work with and search for those sections across various applications and services.

Planning for Intune for Education

When configuring an SDS profile, you will have the opportunity to enable integration with Intune for Education. This checkbox will:

  1. Create All Students and All Teachers groups
  2. Create a “Students of each school” group and a “Teachers of each school” group
  3. Assign a license to all users within the profile

Ensure you want all 3 features enabled for the sync profile when selecting this checkbox.

Recommendations

Only check this box if you have enough Intune for Education licenses available within your tenant, to be able to apply one to each student and teacher being synced within that profile. If you don’t have enough licenses, you will receive an error for each student and teacher that can’t have a license applied. These errors will count against your limit for processing data, so plan accordingly. Also, you may create a separate and dedicated Intune for Education sync profile with the box checked. In this separate profile, don’t include students and teachers. This will allow for the basic group creation to occur but will not attempt to license users beyond what you have available, as there will be no users (or fewer users) contained within this sync profile.