ARS (Active Roles Server) FAQ

ARS Website: https://ars-prod.isc.upenn.edu/

Login with pennkey-kadm@upenn.edu and your KADM password.

If you need access, please open a ticket with Client Care.

There are two options for searching.

1. Locate the user's account by entering their PennKey in the search bar at the top
2. Navigate through your school/center's Managed Unit (MU) (This may take more time to populate.)

By default, the search bar searches for an account by the PennKey username. If you would like to search for other parts of the email address, follow the steps below to adjust the filters.

1. Under the Filter bar, click on the "Add criteria" button.  If you don't see the "Add criteria", click on the down arrow to the right of the filter bar.
2. Click "Other Properties".
3. In the "Find Property field, type "proxy" (without quotes).  In the "Properties:" box, select "proxyAddresses".  Check the "Show all possible properties" option.
4. A new search/filter bar called "proxyAddresses" will show up under the existing Filter bar. Use that filter field to search for parts of email addresses that may be different than the PennKey.

1. To save the current view, click the button with the three horizontal lines next to the Filter field and click "Save the current view."
2. The saved view will show up in the Views pane under the "Personal" section.

Note: If you do not see the Views pane, look for a small grey arrow at the top of the section to the left of the filter section.

1. Click [School/Center]-PennO365 MU.
2. Click [School/Center]UsersFunctional Group.
3. Click Members in the right pane.

1. Check the Manged Unit (MU) called "Penn People - All" and then search for the user in the Search bar.
2. Clicking on the username will pull up the General Properties.  If you want to see other properties, check the box next to the name and select from the list in the right-hand pane.

1. Click the Manged Unit (MU) called "[School/Center]-PennO365".
2. Click "[School/Center]-PennO365Reporting".
3. Check the box next to "[School/Center] PennO365 Report - Mailboxes" and click "PennO365 Mailboxes Report" in the right pane.
4. Enter a start and end date if desired.  The report will automatically go to your email, but enter any other addresses that you would like to receive the report.
5. Check "Run this Report" and click Save.

You will get an email that the report request was made and an email of the report when it is complete.

Adding the account to UsersFunctional will allow an account that was previously ineligible for email (based on its affiliation with Penn) to be eligible for email. This was called an Override in the previous system. 

1. Click "[School/Center]-PennO365" MU.
2. Click "[School/Center]UsersFunctional" Group.
3. Click "Members" in the right pane.
4. Click "Add" and search for the user.
5. Check the box next to the user and click Okay. 

To take over an account that is in a different center, add it to your center's UsersFunctional group.

1. Click "[School/Center]-PennO365" MU.
2. Click "[School/Center]UsersFunctional" Group.
3. Click "Members" in the right pane.
4. Click "Add" and search for the user.
5. Check the box next to the user and click Okay. 

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Azure Properties" > "Licenses (AD Group Sync)".
3. If the license listed under "Current Licensing" has "Mailbox" in it, the account has email.  (If it says ProPlus, it only includes the O365 applications.)

To mailbox-enable a PennKey account, you must assign the user an appropriate PennO365 license.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Azure Properties" > "Licenses (AD Group Sync)" and select the appropriate license (student or faculty/staff) with "Mailbox" at the end. (Do NOT select the license labeled PennO365_Student_Mailbox-PSTN.)  Then click the "Save" button.

Note: Azure Properties will be available 15 minutes after the user account has been created. It can take up to an hour for the mailbox to appear after the license is applied. 

Will there be different license type options?

1. In Filter Pane, click on your school/center's MU.
2. Check your school/center's "Bulk Operations Menu" and click the "UPenn Bulk Operations (doc)" that appears on the right.
3. Enter Pennkeys separated by a return, comma, or semicolon and the billing code if you have it. 
   Note: If you do not enter a budget code, it will use the default one for your school/center.  There is no charge for O365 accounts; the budget code is only used for auditing.

You will receive an email when the bulk job is complete.

Note: There are is no charge for O365 accounts; the budget code is only used for auditing. If no code is entered, the default one for your school/center will be used.

1. Search for the user's PennKey account and either click on the username or click the checkmark and click the "General Properties" link.
2. Click on "Organization" and enter/change the budget code.

In the ARS system, Org Changes are not possible. When the user's account changes in PennCommunity/Workday, the change will propagate over to the PennO365 system and automatically update and move the account. 

If the account needs to be administered by a different school/center before the automatic process is complete, the LSP of the new school/center (this cannot be done by the LSP of the previous school/center) can add the user to their UsersFunctional group (See "How do I add an Override?" above for instructions.). Since the user will eventually be added as part of the automatic process, it is recommended that the account is added to UsersFunctional with an expiration date to prevent future problems with transfers. To add an expiration date, before clicking the final OK, click the "Temporary Access" button and change "Remove from the Group" to a date in the future after the official transfer.

NOTE: When accounts are moved to Perelman School of Medicine, the user will immediately lose access to their previous email. The email is recoverable, if desired, for 30 days by means of submitting a ticket.

To mailbox-disable a PennKey account, you must assign the user a ProPlus license. The ProPlus license will override the Mailbox license.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Azure Properties" > "Licenses (AD Group Sync)" and select "PennO365_ProPlus" from the license drop-down menu.

Note: Do NOT apply a license with PSTN in the name.

1. In Filter Pane, click on your school/center's MU.
2. Check your school/center's "Bulk Operations Menu" and click the "UPenn Bulk Operations (doc)" that appears on the right.
3. Click on "UPenn Bulk Operations".
4. Select the License type you are removing.
5. Change "Mailbox Operations" to "Disable".
6. Enter Pennkeys separated by a space or return.

You will receive an email when the bulk job is complete.

Note: Only those LSPs who manage their third-level domains have access to add email aliases.  If you do not have a third-level domain that you manage, please submit a ticket.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "General Properties" > "Email Addresses".
3. Select the address type and domain and the address will be automatically generated.

Note: Only those LSPs who manage their third-level domains have access to remove email aliases.  If you do not have a third-level domain that you manage, please submit a ticket.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "General Properties" > "Email Addresses".
3. Remove the email alias.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "General Properties" > "Email Addresses - Set Primary".
3. Select the address you want to be the Primary SMTP and click the "Set As Primary" checkmark.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Exchange Online Properties" > "Delegation"
3. In the "ForwardingAddress" field enter the address.  

Note: You have the option to check the box regarding whether you want to keep a copy of emails in the mailbox.   It is checked by default.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Exchange Online Properties" > "Delegation"
3. Under the "Send As" box, click "Add"
4. Type in PennKey and press enter or click Magnifying Glass to search.
5. Click the username or check the box next to the username to add them to the field at the bottom of the screen.

Note: If you want to confirm the change, wait 10-15 minutes for it to show up in ARS.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Exchange Online Properties" > "Delegation"
3. Under the "Send On Behalf" box, click "Add"
4. Type in PennKey and press enter or click Magnifying Glass to search.
5. Click the username or check the box next to the username to add them to the field at the bottom of the screen.

Note: If you want to confirm the change, wait 10-15 minutes for it to show up in ARS.

SendOnBehalf settings can be configured via the Outlook client. Note that send-on-behalf permissions cannot be set up via Outlook on the Web.

1. Click File > Info > Account Settings > Delegate Access.
2. Click Add.
3. Choose the mailbox from the Address Book.
4. If you need the user to have partial access to your mailbox, you can specify the access level on the next screen. If you only need to give "Send On-Behalf" permissions to the user, choose None for each folder.
5. Click OK.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Exchange Online Properties" > "Delegation"
3. Under the "Full Access" box, click "Add"
4. Type in PennKey and press enter or click Magnifying Glass to search.
5. Click the username or check the box next to the username to add them to the field at the bottom of the screen.

Note: If you want to confirm the change, wait 10-15 minutes for it to show up in ARS.

1. Search for the user's PennKey account and click on the checkbox next to their username.
2. Click on "Exchange Online Properties" > "Calendar (Delegation)".  Existing permissions will be shown here, including those set at the client level.
3. To add a new account for permissions, click "Add" under the "Select user(s)" box. To change permissions on an existing account, click "Add", "Remove", or "Set"(to modify existing permissions).
4. Click "Save". 

Note: It may take up to a minute to apply the permissions.  The button will show "Please wait" until it is complete. If you want to confirm the change afterward, wait 10-15 minutes for it to show up in ARS.

LSPs cannot create non-PennKey accounts at this time.  If you would like a non-PennKey account created, please submit a ticket.

1. Click on your school/center's Managed Unit (MU).
2. Click "Groups", "Resources", or "Rooms" depending on the type of account.
3. Check the box next to the account name and click on "General Properties."

1. Search for the account.
2. Click the checkmark next to the account and click "Reset Password".

Note: This only works for non-pennkey O365 accounts. PennKey O365 passwords are synced to the PennKey password.

1. Click on your school/center's Managed Unit (MU).
2. Click "Groups", "Resources", or "Rooms" depending on the type of account.
3. Click on "Exchange Online Properties" > "Delegation"
4. Under the appropriate access box, click "Add"
5. Type in PennKey and press enter or click Magnifying Glass to search.
6. Click the username or check the box next to the username to add them to the field at the bottom of the screen.