User names and passwords are the most common way of controlling access to applications. Nowadays we use more and more applications. These applications can be from on-premises or cloud. Unless there is a central identity management system, users will have to maintain different usernames, passwords to access these applications.
Azure Active Directory is a powerful, reliable cloud-based identity and access management service. It can use to manage identities and access for cloud applications as well as on-premises applications. If we already have a Windows Active Directory environment, using Azure AD connect we can sync on-premises identities to Azure AD. Azure AD Connect supports various Windows Active Directory topologies. More information about these supported topologies can be found here.
However, In Azure AD connect, synchronization and provisioning from AD are managed in the on-premises level. This can be a complex task especially if you have multiple AD forests. To simplify the hybrid identity synchronization process, Microsoft now has Azure AD Connect cloud provisioning. With this solution, Microsoft will manage provisioning from AD and synchronization as part of the service. In on-premises we only need to install light-weight agents which will act as a bridge between Azure AD and Windows AD.
Apart from the simplicity, Azure AD Connect cloud provisioning gives the following benefits,
• Allow Azure AD synchronization from multiple disconnected on-premises AD forests.
• Multiple agents will provide high availability for password hash synchronization.
What are the differences between Azure AD Connect and Azure AD Connect cloud provisioning?
Feature | Azure AD Connect | Azure AD Connect cloud provisioning |
Synchronize multiple disconnected on-premises AD forests | NO | YES |
Synchronize single on-premises AD forest | YES | YES |
Synchronize multiple on-premises AD forests | YES | YES |
Synchronization Based on Agents | NO | YES |
Multiple Agents for High Availability | NO | YES |
Synchronize with LDAP | YES | NO |
Synchronize Users, Groups, Contacts | YES | YES |
Synchronize device objects | YES | NO |
Synchronize Exchange online attributes | YES | YES |
Synchronize extension attributes 1-15 | YES | YES |
Synchronize customer defined AD attributes | YES | NO |
Support for federation | YES | YES |
Seamless Single Sign-on | YES | YES |
Support for Pass-Through Authentication | YES | NO |
Support for Password Hash Sync | YES | YES |
Support for writeback (passwords, devices, groups) | YES | NO |
Azure AD Domain Services support | YES | NO |
Exchange hybrid writeback | YES | NO |
Azure AD Connect cloud provisioning Setup
In this blog post, I am going to demonstrate how to set up Azure AD Connect cloud provisioning with Windows AD. In my demo environment, I already have Windows AD configured with domain M365x620957.onmicrosoft.com
Let’s go ahead and start the configuration process by installing the Azure AD Connect provisioning agent. [Read more…] about How to setup Azure AD Connect cloud provisioning?