How to link Active Directory on-premises with Microsoft Azure AD using Redmond's new connector.
As the number of Microsoft Azure services and users expand, the need for a foundational, shared identity platform is clear. Microsoft is putting significant emphasis on Azure Active Directory (Azure AD) as that shared identity platform.
The challenge for countless IT pros implementing Azure is rooted in the fact migration isn't an instantaneous event. Most organizations won't move 100 percent to the cloud anytime soon. Transitions of this scope occur over many months and often years. In many organizations, computing architectures will always consist of a combination of on-premises and cloud compute and storage resources. The challenge that has emerged is integrating the local, on-premises Active Directory with Azure AD running in the cloud.
Microsoft has supported federation between local Active Directory and Azure AD since the release of the cloud-based version more than two years ago. Unfortunately, Azure AD is complex to implement, fraught with problems and limited in functionality. With the recent release of Azure AD Connect, linking the two is now easier. For most implementations, connecting on-premises Active Directory with Azure AD is now a simple, wizard-based process. With just a handful of clicks, local Active Directory accounts and passwords are synchronized into Azure AD for use by all Azure services. These accounts can then be used for signing into Office 365, Azure Site Recovery and even Azure RemoteApp.
In addition to installing these products, the Express Wizard automatically configures password synchronization from the local Active Directory server to Azure AD, defines synchronizing all local AD object attributes and kicks off an initial synchronization (see Figure 1). The Express Wizard can only be used to synchronize a single local AD Forest with Azure AD.
[Click on image for larger view.] Figure 1. The Azure AD Connect Express Wizard is ready to run.
Azure AD Connect, like any software, does have a few prerequisites. First, Azure AD Connect must be installed on Windows Server 2008 or later. Unlike previous versions of the DirSync tool, Azure AD Connect is supported when installed on a domain controller. Still, I recommend running the tool on a member server and leaving the DC to focus on being a DC.
Additionally, the Azure AD Connect Express Wizard supports 100,000 local AD objects using SQL Express. More than 100,000 objects requires using a full version of SQL Server. Finally, the local AD domain and forest functional levels must be Windows Server 2003 or later.
After the Azure AD Connect Express Wizard completes an initial synchronization, a scheduled task is created to synchronize the directories every three hours. Running an on-demand synchronization isn't a problem, though. The scheduled task can be kicked off manually. Another option is to run the Azure AD Connect tool again, select the Customize synchronization options task when prompted, Click Next, enter the Azure AD admin credentials, click Next, enter the local AD enterprise admin credentials, click Next, leave the default Optional Features checked, click Next, ensure the box for Start the synchronization process as soon as the initial configuration completes is checked, and click Install (see Figure 2). The tool will quickly prompt that configuration to complete so the synchronization process will be initiated.
[Click on image for larger view.] Figure 2. Manual synchronization in Azure AD Connect.
[Click on image for larger view.] Figure 3. Adding a Domain.
In cases where multiple DNS servers exist, ensure replication occurs before moving forward.
If hosted DNS is used, Microsoft offers a resource on how to manage those records at various providers.
Once the DNS changes have been made and replicated to all DNS servers, return to the Azure Management Portal and Click Verify. If all is well, "Successfully verified the domain" will display and then click the checkmark to continue.
[Click on image for larger view.] Figure 4. Enabling downloads in Internet Explorer.
Once the Azure AD Connect setup starts, it's only a few clicks to have it running!
[Click on image for larger view.] Figure 5. Local AD users in Azure AD.
[Click on image for larger view.] Figure 6. The Premium Reports available in Azure AD Premium.
John O'Neill Sr. will demonstrate how to link Active Directory and Azure AD with Azure AD Connector at TechMentor/Live! 360 next month in Orlando, Fla.
It's taken Microsoft a few iterations, but connecting local AD and Azure AD is now a simple point-and-click affair. As Azure services are in the plans for more and more organizations, connecting these directories early on makes perfect sense. If you're using Office 365, Azure Site Recovery or any other Azure service, give Azure AD Connect a go. Odds are, you won't regret it.