User names and passwords are the most common way of controlling access to applications. Nowadays we use more and more applications. These applications can be from on-premises or cloud. Unless there is a central identity management system, users will have to maintain different usernames, passwords to access these applications.
Azure Active Directory is a powerful, reliable cloud-based identity and access management service. It can use to manage identities and access for cloud applications as well as on-premises applications. If we already have a Windows Active Directory environment, using Azure AD connect we can sync on-premises identities to Azure AD. Azure AD Connect supports various Windows Active Directory topologies. More information about these supported topologies can be found here.
However, In Azure AD connect, synchronization and provisioning from AD are managed in the on-premises level. This can be a complex task especially if you have multiple AD forests. To simplify the hybrid identity synchronization process, Microsoft now has Azure AD Connect cloud provisioning. With this solution, Microsoft will manage provisioning from AD and synchronization as part of the service. In on-premises we only need to install light-weight agents which will act as a bridge between Azure AD and Windows AD.
Apart from the simplicity, Azure AD Connect cloud provisioning gives the following benefits,
• Allow Azure AD synchronization from multiple disconnected on-premises AD forests.
• Multiple agents will provide high availability for password hash synchronization.
What are the differences between Azure AD Connect and Azure AD Connect cloud provisioning?
| Feature | Azure AD Connect | Azure AD Connect cloud provisioning |
| Synchronize multiple disconnected on-premises AD forests | NO | YES |
| Synchronize single on-premises AD forest | YES | YES |
| Synchronize multiple on-premises AD forests | YES | YES |
| Synchronization Based on Agents | NO | YES |
| Multiple Agents for High Availability | NO | YES |
| Synchronize with LDAP | YES | NO |
| Synchronize Users, Groups, Contacts | YES | YES |
| Synchronize device objects | YES | NO |
| Synchronize Exchange online attributes | YES | YES |
| Synchronize extension attributes 1-15 | YES | YES |
| Synchronize customer defined AD attributes | YES | NO |
| Support for federation | YES | YES |
| Seamless Single Sign-on | YES | YES |
| Support for Pass-Through Authentication | YES | NO |
| Support for Password Hash Sync | YES | YES |
| Support for writeback (passwords, devices, groups) | YES | NO |
| Azure AD Domain Services support | YES | NO |
| Exchange hybrid writeback | YES | NO |
Azure AD Connect cloud provisioning Setup
In this blog post, I am going to demonstrate how to set up Azure AD Connect cloud provisioning with Windows AD. In my demo environment, I already have Windows AD configured with domain M365x620957.onmicrosoft.com
Let’s go ahead and start the configuration process by installing the Azure AD Connect provisioning agent.
Installing Azure AD Connect cloud provisioning agents
1. Before Installing agents, make sure you have outbound access with TCP port 80 and 443 to Azure AD.
2. Log in to the server as Domain Admin
3. Go to Azure portal (https://portal.azure.com)
4. Then search for Azure Active Directory and click on it
5. In Azure Active Directory service page, click on Azure AD Connect
6. Then click on Manage provisioning (Preview) option
Note: At the time this article was written, this feature is in the preview stage
7. In the next page, click on Download agent
8. It will open up a new window, click on Accept terms & download to begin agent download.
9. Once the agent is downloaded, run it as Administrator. Click to accept terms and conditions. Then click on Install to begin agent installation.
10. Once the installation is completed, the configuration wizard will open. On the first page, log in to Azure as a global administrator.
11. In connect Active Directory page, click on Add Directory
12. Then in the new window, provide domain admin account login details and click on OK.
13. Once account verification is completed, click on Next to proceed.
14. Finally, click on Confirm to complete the configuration.
15. Make sure the configuration process completes without errors.
16. To verify the health of the agent, go to Azure AD Provisioning (Preview) page and click on Review all agents
Configure Azure AD Connect cloud provisioning
Now we have an agent in place, the next step is to apply a new configuration to it. To do that,
1. Go to the Azure AD Provisioning (Preview) page and click on + New configuration
2. In the new page select the relevant domain under Active Directory Domain
3. Under Scope users, filter the users you like to sync. In this demo, I am going to sync all users.
4. Also, make sure you have the password synchronization option is enabled.
5. In the Notification Email field, define the email address you like to receive notifications
6. In Deploy section click on enable to apply this provisioning configuration to users and groups assigned.
7. In the end, click on the Save button to apply the configuration.
8. After a few minutes, I can see the users are syncing from Windows AD
Testing
1. For testing, I have selected a one user account which is sync from Windows AD
2. Then I try to login to https://office.com using this selected account. As expected, I was able to login to the portal successfully.
This marks the end of this blog post. Hope now you have a better understanding of using Azure AD Connect cloud provisioning to simplify identity synchronization. If you have any further questions about this feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.