Elastic Desktop Service:Implement SSO with AD FS and Elastic Desktop Service convenience accounts

Prepare the CSV file for batch import

If you use batch import, perform the following steps to prepare a CSV file that meets the format requirements for convenience accounts. If you use manual entry, skip this section.

1. On the AD domain server, create a CSV file that contains the AD user information.

   1. Check whether the existing AD user information meets the requirements.

      AD usernames must meet the username format requirements for convenience accounts. If a username does not meet the requirements, modify it first. Otherwise, you cannot create the corresponding convenience account. For more information, see Username requirements for convenience accounts.

   2. In PowerShell, run the Get-ADUser command to export a CSV file that contains the AD user information.

      Adjust the command parameters to export the CSV file that you need. For example, to export the information of all AD users to a CSV file and save the file to a specific path, run the following command:

      Get-ADUser -filter * |export-csv <file_path> -Encoding utf8

      C:\Users directory, run the following command:

      Get-ADUser -filter * |export-csv C:\Users\test.csv -Encoding utf8

      When you adjust the user information, take note of the following items:

2. The required format for the import file is as follows:

   • For user-activated convenience accounts: The first column is the username (required), the second is the email address (required), and the third is the phone number (optional).

   • For administrator-activated convenience accounts: The first column is the username (required), the second is the email address (optional), the third is the phone number (optional), and the fourth is the password (required).

The required format for the import file is as follows:

• For user-activated convenience accounts: The first column is the username (required), the second is the email address (required), and the third is the phone number (optional).

• For administrator-activated convenience accounts: The first column is the username (required), the second is the email address (optional), the third is the phone number (optional), and the fourth is the password (required).

• In the exported CSV file, you can use the SamAccountName column as the username column of the convenience account and the UserPrincipalName column as the email address column. If the actual email address of a user differs from the UserPrincipalName value, enter the email address manually.

Create the convenience accounts

Create the accounts in the EDS console. If you use batch import, import the CSV file that you prepared.

1. Log on to the EDS enterprise console.

2. In the left-side navigation pane, choose User Center > User Management.

3. On the User Management page, click the User tab, and then click Create User. You can create convenience accounts by using one of the following methods:

   Manual entry

   Click the Manual Entry tab, configure the parameters, and then click Manual Entry.

   Parameter	Required	Description
   User Type	Yes	The type of the convenience account. Valid values: User-activated and Administrator-activated.
   Username	Yes	The username used to log on to the Alibaba Cloud Workspace terminal. The username must be 3 to 25 characters long and start with a lowercase letter or a digit. It can contain lowercase letters, digits, hyphens (-), and underscores (_). The username cannot consist only of digits or be a reserved account name of the operating system. For more information, see Convenience user naming conventions.
   Display Name	No	A display name for identification purposes. This name is not visible to the end user.
   Contact Info (Email Address)	Yes	The email address is used to receive notifications, such as cloud computer assignment details, logon information, initial passwords, and password reset alerts. Make sure that you enter a valid email address.
   Parent Organization	No	Defines the user's position within your business's organizational structure, which is hierarchical. A user can belong to only one organization. You can assign the user to an organization during creation or add the user to an organization later as needed.
   User Group	No	A collection of users. A user can belong to multiple user groups, and a user group can contain users from different organizations. User groups have no hierarchy. You can use user groups to bulk-assign permissions for shared cloud computers, cloud browsers, and cloud applications. You can also apply different logon policies and file approval permissions to different user groups for fine-grained access control.
   Password	Yes	This parameter is required for Administrator-activated users. The password must be at least 10 characters long and contain characters from at least three of the following types: uppercase letters, lowercase letters, digits, and special characters (excluding spaces).
   Password Validity	No	By default, passwords never expire. You can also set a validity period from 7 to 365 days. When a password expires, the user must reset it to log on again.
   Account Lock Time	No	This option is available only for Administrator-activated users. You can set a time to lock the account. After an account is locked, the end user cannot use this convenience account to log on to an Alibaba Cloud Workspace terminal.
   Grant Local Admin Permission	No	By default, new convenience accounts have Grant Admin Permission permission. Note A user with local admin permission can install software or modify system settings on a cloud computer. Changes to local admin permissions take effect after you restart the cloud computer.
   Remarks	No	Enter supplementary information about the account as needed.

   Batch entry

   Click the Batch Entry tab, configure the parameters, and then click Disable.

   Parameter	Required	Description
   User Type	Yes	The type of the convenience account. Valid values: User-activated and Administrator-activated.
   Password Validity	No	By default, passwords never expire. You can also set a validity period from 7 to 365 days. When a password expires, the user must reset it to log on again.
   Account Lock Time	No	This option is available only for Administrator-activated users. You can set a time to lock the account. After an account is locked, the end user cannot use this convenience account to log on to an Alibaba Cloud Workspace terminal.
   Grant Local Admin Permission	No	By default, new convenience accounts have Grant Admin Permission permission. Note A user with local admin permission can install software or modify system settings on a cloud computer. Changes to local admin permissions take effect after you restart the cloud computer.
   Upload File	Yes	Click Download, open the downloaded template, enter the user information in the specified format, and then save the file. For user-activated scenarios, when you enter user information, the first column Username is the username, the second column Email is the user's email address, and both are required fields. If the user is administrator-activated, the first column Username is the username, and the fourth column Password is the password. Both are required fields. If you want to assign a new convenience account to an organizational structure, you can enter the ID of the target organizational structure in the last column of the template, OrgId. To find the OrgId, hover your mouse pointer over the organizational structure and view the ID in the tooltip. Click Upload Local File, select the template file that contains the user information, and follow the on-screen instructions. The system automatically imports the user information from the file. After the import is complete, a Created. message appears in the Create User panel. You can click View Account to view the import status of each user's data. If the import fails, check whether the user information in the file is in the correct format.

   Note

   The system does not send a notification when a convenience account is created. Notifications are sent only after a cloud computer or a shared cloud computer is assigned to the user.

In the left-side navigation pane, choose User Center > User Management.

On the User Management page, click the User tab, and then click Create User. You can create convenience accounts by using one of the following methods: