Sync On-Premises AD with Azure AD using Azure AD Connect

Microsoft has had an evolution of tools over the past few years that allows syncing on-premises Active Directory users with their Azure AD cloud directory service. This has include the legacy Forefront Identity Management product, DirSync, and others. Now, the tool is Azure AD Connect which is a locally installed tool that you install on-premises on a Windows Server and have Azure AD Connect sync with on-premises AD. This is fairly straightforward to configure, however, let’s take a look at how to sync on-premises AD with Azure AD using Azure AD Connect. We will see how this tool is loaded and configured to synchronize your local Active Directory environment with Azure AD.

Why Synchronize On-Premises AD with Azure AD?

You may wonder why you would want to synchronize your on-premises Active Directory environment with Azure AD. There are many reasons to do this in this day and time.
Cloud is becoming the central focal point for most businesses today. If you don’t already have a cloud presence of some type, most likely you are currently looking at migrating to the cloud, or already have a migration underway.
One of the popular reasons driving the configuration of Active Directory synchronization is a migration to Microsoft Office 365 for cloud email and storage.
Synchronizing your directory service on-premises with Azure AD allows you to configure hybrid identity which allows your end users to have a seamless experience between using on-premises resources and those resources that are located in the cloud.
This includes at a very basic level, being able to use the same password in the cloud as they do on-premises. This is an important basis requirement for most businesses. Configuring the directory synchronization between on-premises Active Directory and Azure AD is the mechanism that makes this possible.

Configure Azure AD and Download Azure AD Connect

Before configuring Azure Ad Connect, you need to actually have an Azure AD environment configured. In the lab environment, I simply have an Azure AD free subscription along with my Visual Studio subscription for testing. You need to start the free subscription or one of the paid directory services with your Azure environment.
You will notice there is an entire “blade” underneath Azure AD dedicated to Azure AD Connect. If you click on this blade, you will see the option to download Azure AD Connect as well as the configuration information regarding any current synchronization services configured.
Download-Azure-AD-Connect-from-Azure-AD-portal Sync On-Premises AD with Azure AD using Azure AD Connect
Download Azure AD Connect from Azure AD portal

Azure AD Connect Requirements

The Azure AD Connect utility is a service that you run on-premises. So, you will need a server/VM to run the service. What are the requirements for installing the Azure AD Connect synchronization utility?
Server OSOther software
Windows Server 2012 R2 and later– PowerShell is installed by default, no action is required.
– Net 4.5.1 and later releases are offered through Windows Update. Make sure you have installed the latest updates to Windows Server in the Control Panel.
Windows Server 2008 R2 with Service Pack 1 (SP1)** or Windows Server 2012– The latest version of PowerShell is available in Windows Management Framework 4.0. Search for it on Microsoft Download Center.
– .Net 4.5.1 and later releases are available on Microsoft Download Center.
Windows Server 2008– The latest supported version of PowerShell is available in Windows Management Framework 3.0, available on Microsoft Download Center.
– .Net 4.5.1 and later releases are available on Microsoft Download Center.

Azure AD Connect Installation

Once you have downloaded the Microsoft Azure AD Connect setup file, run the setup. Click Next.
Beginning-the-Azure-AD-Connect-setup Sync On-Premises AD with Azure AD using Azure AD Connect
Beginning the Azure AD Connect setup
You are presented with the Azure AD Connect Welcome screen. The screen gives you an overview of the Azure AD Connect tool and also the EULA checkbox.
Overview-of-Azure-AD-Connect-and-EULA Sync On-Premises AD with Azure AD using Azure AD Connect
Overview of Azure AD Connect and EULA
For many the Express Settings will be what they want to configure. The page gives you an overview of what the Express Settings actually do. This includes:
  • Configure synchronization of identities in the current AD forest
  • Configure password hash synchronization from on-premises AD to Azure AD
  • Start an initial synchronization
  • Synchronize all attributes
  • Enable Auto Upgrade
You may also see a warning about a routable domain if you are using a .local or some other domain as I am in the lab environment. Keep in mind you will need to be able to synchronize a domain with the same UPN suffix both on-premises and in your Azure AD environment or the synchronization between them will not work.
Azure-AD-Connect-Express-settings Sync On-Premises AD with Azure AD using Azure AD Connect
Azure AD Connect Express settings
Provide your Azure AD global administrator credentials.
Enter-your-Azure-AD-global-administrator-credentials Sync On-Premises AD with Azure AD using Azure AD Connect
Enter your Azure AD global administrator credentials
Provide your local on-premises Active Directory credentials.
Enter-your-On-Premises-Enterprise-Administrator-credentials Sync On-Premises AD with Azure AD using Azure AD Connect
Enter your On-Premises Enterprise Administrator credentials
As mentioned above, you will need to have the same UPN suffixes between on-premises and your Azure AD environment.
Note-about-UPN-suffixes-if-these-differ-between-on-premises-and-verified-custom-domains Sync On-Premises AD with Azure AD using Azure AD Connect
Note about UPN suffixes if these differ between on-premises and verified custom domains
Ready to begin the configuration of the synchronization between on-premises and Azure AD. You can check the box to Start the synchronization process when configuration completes as well as you have the option to select the Exchange hybrid deployment if you are setting up hybrid mailflow between on-premises and Office 365.
Ready-to-configure-Azure-AD-Connect Sync On-Premises AD with Azure AD using Azure AD Connect
Ready to configure Azure AD Connect
Configuration finishes. You will see a few checks and warning on certain things such as AD Recycle Bin, synchronization status, etc, depending on settings you chose in the configuration as well as the current settings of your on-premises Active Directory environment.
Configuration-of-Azure-AD-Connect-completed Sync On-Premises AD with Azure AD using Azure AD Connect
Configuration of Azure AD Connect completed

Sync On-Premises AD with Azure AD using Azure AD Connect

If you want to reconfigure any of the settings you may have chosen in the initial setup and configuration, just relaunch the Azure Active Directory Connect tool and choose to Configure. Here I am configuring the Domain/OU Filtering options. This allows you to scope down the OUs/users that you want to synchronize between on-premises and Azure AD.
Filtering-the-OUs-that-will-be-synced-with-Azure-AD-Connect Sync On-Premises AD with Azure AD using Azure AD Connect
Filtering the OUs that will be synced with Azure AD Connect
Optional features screen allows you to select other options as relevant to your particular environment.
Configuring-Azure-AD-Connect-Optional-synchronization-features Sync On-Premises AD with Azure AD using Azure AD Connect
Configuring Azure AD Connect Optional synchronization features
I am selecting the Start the synchronization process when configuration completes option so the initial sync will begin as soon as you click the Configure button.
Ready-to-Configure-sync-azure-ad-with-on-premises-ad Sync On-Premises AD with Azure AD using Azure AD Connect
Ready to Configure – sync azure ad with on-premises ad
The configuration begins and processes through the synchronization of user objects. I also launched the Synchronization Service Manager utility which is installed in the program group for Azure AD Connect.
I have it overlaid on top of the Azure Active Directory Connect tool. As you can see, you can click the Operations button and see the current operations as they complete in the process.
For those that may be familiar with the previous tools, this looks very familiar (identical) with FIM and other tools.
Azure-AD-Connect-synchronization-finishes-and-monitoring-progress-under-operations Sync On-Premises AD with Azure AD using Azure AD Connect
Sure enough, I navigate to the Default Directory, All Users area and I see the two “testusers” that I had housed in the OU I targeted for the synchronization process.
Verifying-the-on-premises-users-are-created-in-Azure-AD Sync On-Premises AD with Azure AD using Azure AD Connect
Verifying the on-premises users are created in Azure AD

Azure AD PowerShell Tools

It is worth mentioned and noting here that PowerShell is a great way to interact with Azure AD. You can install the Azure AD PowerShell module by typing in the following:
  1. install-module -Name MSOnline
Additionally, you then connect to your Azure AD environment by the cmdlet:
  1. connect-msolservice
Installing-the-MSOnline-Azure-AD-PowerShell-Module Sync On-Premises AD with Azure AD using Azure AD Connect
Installing the MSOnline Azure AD PowerShell Module

Wrapping Up

If you are looking to Sync On-Premises AD with Azure AD using Azure AD Connect, the process is fairly straightforward. I think Microsoft has made strides in making this process easier and better than it used to be with some of the older tools.
Most likely if you are not already doing this, you will be required to synchronize your on-premises environment with the cloud at some point to support hybrid identity initiatives like Office 365 and others.

Post a Comment

3 Comments

  1. The best Article that I have never seen before with useful content and very informative.Thanks for sharing info. MS-100: Microsoft 365 Identity and Services

    ReplyDelete
  2. Hi, This is a great article. Loved your efforts on it buddy. Thanks for sharing this with us. MS-040T00-A: Manage SharePoint and OneDrive in Microsoft 365

    ReplyDelete
  3. Thank you very much for sharing such a useful article. Will definitely saved and revisit your site best SC-300: Identity and Access Administrator Associate

    ReplyDelete