Azure AD Connect is a tool for connecting on-premises identity infrastructure to Microsoft Entra ID. The wizard deploys and configures prerequisites and components required for the connection, including synchronization scheduling and authentication methods. [1] Azure AD Connect encompasses functionality that was previously released as Dirsync and AAD Sync. These tools are no longer being released individually, and all future improvements will be included in updates to Azure AD Connect. [2] [3]
Azure AD Connect synchronizes on-premises objects present in Active Directory to a corresponding Azure AD service within a Microsoft 365 tenant. [4] Supported on-premise objects include user accounts, group memberships, and credential hashes. [5] Synchronization can be configured to operate in two directional flow configurations. In a one-way configuration changes to an object on-premise updates the corresponding object in Azure AD. Two-way or bidirectional synchronization configurations allow for object changes to be made either on-premise or within Azure AD/Microsoft 365 and update the corresponding object on the opposite end. [6]
Azure AD Connect GA was released to the public on 24 June 2015 [7] and is currently on Version 2.1.16.0. [8] On 31 August 2022 all 1.x versions of Azure AD Connect were retired. On 15 March 2023 Versions 2.0.3.0 through 2.0.91.0 will be retired.
The current release offers the following high level options: [9]
Organizations with an existing Dirsync deployment can upgrade in place (for directories with less than 50,000 objects) or otherwise migrate their Dirsync settings to Azure AD Connect.
Express Settings is the default option and deploys sync with the password hash sync option for a single-domain, single-forest on-premise Active Directory domain. This allows for authentication and authorization to resources in Azure/Microsoft 365 based on Active Directory passwords.
With custom settings, the administrator can connect one or multiple Active Directory domains and forests and choose between password hash sync, pass-through authentication, and Active Directory Federation Services (AD FS) for authentication. Custom settings also allows the administrator to choose sync options such as password reset write back and Exchange hybrid deployments.
Feature | Description |
---|---|
Password Writeback | In bidirectional synchronization configurations passwords changed in the Azure/Microsoft 365 cloud will apply to corresponding on-premise users when the next synchronization takes place [10] |
Bidirectional Synchronization | Bidirectional synchronization configurations allow for certain object changes in the cloud to apply to the corresponding on-premise object. With one-way synchronizations object changes in Azure AD/Microsoft 365 such as Full Name and proxyAddresses can not take place and instead require the changes to be made on-premise first. |
Simplifying Identity Management | Without Azure AD Connect the user accounts and groups located on-premise will be separate objects from ones in the Azure AD/Microsoft 365 cloud even if the cloud objects were configured similarly. By synchronizing objects between on-premise and the cloud, Azure AD Connect allows administrators to maintain less separate user identities. When used in combination with SSO, such as with Azure Enterprise Applications, user identities can be centralized further. [11] |
When an administrator installs and runs the Azure AD connect wizard, it performs the following steps:
The Azure AD PowerShell module allows administrators granular control over synchronization behaviors. [12] To begin working with the Azure AD PowerShell module it must be imported:
Import-ModuleAzureAD
To manually run a synchronization with current configurations:
#Specify Delta to only synchronize objects that have been updated since the most recent synchronizationStart-AADSyncSyncCycle-PolicyTypeDelta#Specify Initial to synchronize all objectsStart-AADSyncSyncCycle-PolicyTypeInitial
To retrieve current synchronization schedule settings:
#Display synchronization schedule configuration settingsGet-ADSyncScheduler<#AllowedSyncCycleInterval : hh:mm:ssCurrentlyEffectiveSyncCycleInterval : hh:mm:ssCustomizedSyncCycleInterval : hh:mm:ssNextSyncCyclePolicyType : Delta/InitialNextSyncCycleStartTimeInUTC : MM/DD/YYY hh:mm:ss AM/PMPurgeRunHistoryInterval : DD:hh:mm:ssSyncCycleEnabled : True/FalseMaintenanceEnabled : True/FalseStagingModeEnabled: : True/FalseSchedulerSuspended: : True/False#>
To change the current synchronization schedule settings:
Set-ADSyncScheduler-$Setting$Value
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. Windows Server operating systems include it as a set of processes and services. Originally, only centralized domain management used Active Directory. However, it ultimately became an umbrella title for various directory-based identity-related services.
Kerberos is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed it primarily at a client–server model, and it provides mutual authentication—both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks.
passwd is a command on Unix, Plan 9, Inferno, and most Unix-like operating systems used to change a user's password. The password entered by the user is run through a key derivation function to create a hashed version of the new password, which is saved. Only the hashed version is stored; the entered password is not saved for security reasons.
The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1, 10 and 11 that stores users' passwords. It can be used to authenticate local and remote users. Beginning with Windows 2000 SP4, Active Directory authenticates remote users. SAM uses cryptographic measures to prevent unauthenticated users accessing the system.
Integrated Windows Authentication (IWA) is a term associated with Microsoft products that refers to the SPNEGO, Kerberos, and NTLMSSP authentication protocols with respect to SSPI functionality introduced with Microsoft Windows 2000 and included with later Windows NT-based operating systems. The term is used more commonly for the automatically authenticated connections between Microsoft Internet Information Services, Internet Explorer, and other Active Directory aware applications.
The Encrypting File System (EFS) on Microsoft Windows is a feature introduced in version 3.0 of NTFS that provides filesystem-level encryption. The technology enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer.
On Microsoft Servers, a domain controller (DC) is a server computer that responds to security authentication requests within a Windows domain. A domain is a concept introduced in Windows NT whereby a user may be granted access to a number of computer resources with the use of a single username and password combination.
LAN Manager is a discontinued network operating system (NOS) available from multiple vendors and developed by Microsoft in cooperation with 3Com Corporation. It was designed to succeed 3Com's 3+Share network server software which ran atop a heavily modified version of MS-DOS.
Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. Group Policy provides centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. A set of Group Policy configurations is called a Group Policy Object (GPO). A version of Group Policy called Local Group Policy allows Group Policy Object management without Active Directory on standalone computers.
Windows Services for UNIX (SFU) is a discontinued software package produced by Microsoft which provided a Unix environment on Windows NT and some of its immediate successor operating-systems.
In a Windows network, NT LAN Manager (NTLM) is a suite of Microsoft security protocols intended to provide authentication, integrity, and confidentiality to users. NTLM is the successor to the authentication protocol in Microsoft LAN Manager (LANMAN), an older Microsoft product. The NTLM protocol suite is implemented in a Security Support Provider, which combines the LAN Manager authentication protocol, NTLMv1, NTLMv2 and NTLM2 Session protocols in a single package. Whether these protocols are used or can be used on a system which is governed by Group Policy settings, for which different versions of Windows have different default settings.
Windows Vista contains a range of new technologies and features that are intended to help network administrators and power users better manage their systems. Notable changes include a complete replacement of both the Windows Setup and the Windows startup processes, completely rewritten deployment mechanisms, new diagnostic and health monitoring tools such as random access memory diagnostic program, support for per-application Remote Desktop sessions, a completely new Task Scheduler, and a range of new Group Policy settings covering many of the features new to Windows Vista. Subsystem for UNIX Applications, which provides a POSIX-compatible environment is also introduced.
CrushFTP is a proprietary multi-protocol, multi-platform file transfer server originally developed in 1999. CrushFTP is shareware with a tiered pricing model. It is targeted at home users on up to enterprise users.
SharePoint is a collection of enterprise content management and knowledge management tools Microsoft. Launched in 2001, it was initially bundled with Windows Server as Windows SharePoint Server, then renamed to Microsoft Office SharePoint Server, and then finally renamed to SharePoint. It is provided as part of Microsoft 365, but can also be configured as to run as On-premises software.
A roaming user profile is a file synchronization concept in the Windows NT family of operating systems that allows users with a computer joined to a Windows domain to log on to any computer on the same domain and access their documents and have a consistent desktop experience, such as applications remembering toolbar positions and preferences, or the desktop appearance staying the same, while keeping all related files stored locally, to not continuously depend on a fast and reliable network connection to a file server.
Exchange ActiveSync is a proprietary protocol designed for the synchronization of email, contacts, calendar, tasks, and notes from a messaging server to a smartphone or other mobile devices. The protocol also provides mobile device management and policy controls. The protocol is based on XML. The mobile device communicates over HTTP or HTTPS.
SAP Logon Tickets represent user credentials in SAP systems. When enabled, users can access multiple SAP applications and services through SAP GUI and web browsers without further username and password inputs from the user. SAP Logon Tickets can also be a vehicle for enabling single sign-on across SAP boundaries; in some cases, logon tickets can be used to authenticate into 3rd party applications such as Microsoft-based web applications.
In computer security, pass the hash is a hacking technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LanMan hash of a user's password, instead of requiring the associated plaintext password as is normally the case. It replaces the need for stealing the plaintext password to gain access with stealing the hash.
Netwrix is a Frisco, Texas-based private IT security software company that develops software to help companies identify and secure sensitive data and assist with compliance auditing. After eight acquisitions the company's team geographically expanded to Latin America, UK, Germany, France, Asia, USA as well as other countries. The company's flagship products are Netwrix Auditor and StealthAUDIT that help information security and governance professionals manage sensitive, regulated and business-critical data.
Microsoft Entra ID is a cloud-based identity and access management (IAM) solution. It is a directory and identity management service that operates in the cloud and offers authentication and authorization services to various Microsoft services, such as Microsoft 365, Dynamics 365, Microsoft Azure and third-party services. Entra ID provides users with single sign-on experience, regardless of whether their applications are cloud-based or on-premises.