Microsoft Identity Manager 2016 Handbook

Allowing MIM Service to set passwords

The MIM Service account will be the account that calls the MIM Synchronization service, and tells it to reset the password in AD. But in order for the MIM Service account to be able to do that, we need to assign it some permissions with the following steps:

1. We need to add the account to a couple of groups created during installation of the MIM Synchronization service.
2. Add the MIM Service account to the MIMSyncBrowse group, as shown in the following screenshot:
   

   Note

   By default, this is a local group on the MIM Synchronization server, but you might have chosen to use groups in Active Directory instead, and is recommended. ...