• The things that are better left unspoken

25 Responses to Ten things you should know about Azure AD Connect and Azure AD Sync

1. 
   

   You mention the Global admin account but I would also mention that Azure AD Connect requires Enterprise Admin.

   from Brian Grant October 22, 2015 at 9:27 AM
   • 

     Azure AD Connect requires an Enterprise Admin account in multi-forest and multi-domain environments. Where a Domain Admin would be able to create the necessary (service) accounts and user rights in a single domain environment, in multi-forest and multi-domain environments, an account with membership to the Enterprise admins group is required.

     One big difference between the Global Administrator in Azure AD account requirement for Azure AD Connect and the Enterprise Admin in the on-premises Windows Server Active Directory requirement is that Microsoft actively communicates to make the first account an account without password expiration and without Multi-Factor Authentication (MFA) (since Azure AD Connect does not, currently, support MFA). Microsoft does not actively communicates these practices for the latter account.

     One of the big problems I thought customers might have with an Enterprise Admin account is that it would be used for an interactive logon. With corporate policies restricting these types of logons on systems to avoid lateral movement and privilege escalation, as well as Windows Server 2012 R2's Authentication Policies (restricting Enterprise admins purely to Domain Controllers, for instance), this might have been a real issue. However, Azure AD Connect asks for the credentials every time it is started and does not store or cache the credentials of the Enterprise admin account.

     from Sander Berkouwer October 24, 2015 at 5:10 PM
     
2. 
   

   Hello. I'm a MS Partner and I write implementation docs on technologies such as this, in a way that small businesses can easily understand them. This is for companies that generally do not have full-time IT staff. Do you think there is a place for this with clients/customers that have <50 seats and have a very simple environment (1-2 servers, 1 location, using Office 365, etc.)? I'm having a hard time understanding the real value of this software for those situations. Perhaps I'm missing something.

   from Ryan March 3, 2016 at 3:14 PM
   • 

     Hi Ryan,

     Thanks for your reply.

     The above information is now almost six months old, and a lot has happened in this space.
     While not all points have been adressed (strictly speaking merely points 7 and 8 have), most of these don't affect the designs you write for the organizations with the size you describe.

     Azure AD Connect, either with or without AD FS, offers object synchronization and, as such, offer hybrid identity.
     Without hybrid identity, Office 365 would needlesly offer an awful user experience and admins would have a tough time controlling access to their organizations data both on-premises and 'in the cloud': Yet another username/password combination would be the vocal feedback from both employees and admins.

     With 1 or 2 servers, the organizations you speak of ,fall in one of two categories:
     1. They don't have redundant Domain Controllers, or
     2. All servers are Domain Controllers.

     Luckily, Azure AD Connect can be installed on Domain Controllers and, in that case, can be used with 'Express Settings', offering automatic upgrades and automatic scheduling of syncs. In environments with these kinds of IT environments, mostly, security and availability are not top priorities. Most of the points above, in that case, don't apply. The 'Express Settings' won't give you a hard time ('tyranny of the default'), yet offer the advantages of hybrid identity to end users and the level of control and unambiguity to admins. Since the Domain Controllers will likely already be misused for other purposes, adding Azure AD Connect won't add an awful lot of complexity to disaster recovery: You had to restore the entire box, already.

     from Sander Berkouwer March 3, 2016 at 4:15 PM
     
3. 
   

   Is it mandatory to sync passwords to Azure AD? Can I have a null/no value for password field in AD? How to set this up? Also, on a side note, is it possible to authenticate users with on-premise directory without having an ADFS?

   from Surya Chirravuri September 30, 2016 at 8:46 AM
   • 

     Hi Surya,

     It is not mandatory to synchronize passwords to Azure AD, but then you will need to implement an alternative authentication method. AD FS is the most common authentication method, but other federation solutions will also work, of course.

     Last week, at Ignite, a new feature was announced for Azure AD Connect, labeled 'Passthrough Authentication'. This feature might also prove to become a valid alternative authentication method, by redirecting authentication traffic to on-premises Domain Controllers but without federation of any kind.

     from Sander Berkouwer September 30, 2016 at 9:03 AM
     
4. 
   

   Thank you for this article. However, I wonder if latest version on Azure AD Connect supports Failover Clustering? Otherwise, for a company with big AD DS relying synchronization only one instance of Azure AD connect is not reliable solution. Or is there any other solutions to address this concern?

   from Jahongir Abdurahmonov October 4, 2016 at 5:57 PM
   • 

     Hi Jahongir,

     Installing Azure AD Connect on a failover cluster is still not supported.
     (as of version 1.1.654.0, December 12th, 2017)

     from Sander Berkouwer January 10, 2018 at 5:37 PM
     
5. 
   

   Hi ,

   We run Active Directory on Windows Server 2012 . I want to synchronize all users, groups and service accounts to Microsoft Azure.

   Does Microsoft Azure support service accounts ?

   from Koti November 19, 2016 at 2:36 PM
   • 

     Hi Koti,

     Azure AD Connect will synchronize all objects you mentioned, except for objects that have the adminCount attribute set to 1. This typically excludes the built-in administrator account and members of well-known groups like Account Operators, Print Operators, etc.
     Azure AD has its own service accounts, in the form of service principals.

     from Sander Berkouwer November 20, 2016 at 5:40 PM
     
6. 
   

   Are you saying its OK to install Azure AD connect on multiple domain controllers in your domain? I know this isnt perfect redundancy but that would be great for us.

   Can someone verify that if you make sure you match the settings manually then you can install it on multple machines.

   We would like to to install one in each AD site.

   thanks

   from storm December 7, 2016 at 7:22 AM
   • 

     Installing Azure AD Connect on Domain Controllers is supported.
     However, it might not be the most brilliant of ideas.

     Only one Azure AD Connect installation can be the active installation. All other Azure AD Connect installations will need to be configured as Staging Mode servers. Settings need to be synchronized manually between Azure AD Connect installations.

     from Sander Berkouwer January 10, 2018 at 5:43 PM
     
7. 
   

   Are Group Managed Service Accounts anywhere on the road map for future releases of AADConnect?

   We'd prefer that the service use gMSAs to connect to AD, but it seems that doing so is currently not supported.

   from Jake February 24, 2017 at 12:22 AM
   • 

     Yes and no.

     Azure AD Connect uses three service accounts:

     • A local account on the Windows Server installation running Azure AD Connect, used to run the he Microsoft Azure AD Sync service
     • An account in the Azure Active Directory tenant
     • One account per Active Directory Domain Services environment in scope for Azure AD Connect.

     You can use a group Managed Service Account (gMSA) for the first account since Azure AD Connect version 1.1.443.0 (March 2017).
     To configure Azure AD Connect with a gMSA, read this blogpost.

     from Sander Berkouwer January 10, 2018 at 10:05 PM
     
8. 
   

   Hi Team,

   We are planning to upgrade the Azure AD connect from 1.1.180.0 to Latest version. We have not enabled the Auto-upgrade, also password sync.

   so, need some help to upgrade guidance and challenges, risks and impacts

   Note: We have one Azure AD connect server as if now. No staging mode available.

   Thank you

   from Hosamani SB September 25, 2017 at 7:25 AM
9. 
   

   My SQL Express is suddenly saying the logdisk is full (event ID 6073 and 6323). All Operations now are "stopped-database-disk-full" except for the Delta Import for the azure domain. "Clearing all runs" did not help. My adsync.mdf is 300MB and the ldf is 60MB. Any ideas why this is happening?

   from sometechstuff November 8, 2017 at 7:22 PM
10. 
    

    Do I need separate service accounts for parallel deployment. One for old AAD Connect Server and one for Staging server

    from Rajiv April 30, 2018 at 8:03 PM
    • 

      Hi Rajiv,

      Azure AD Connect uses up to three service accounts: One account for communicating with Azure AD, one account for communicating with Active Directory and one account for running the service (optional). The first account is always self-generated per Azure AD Connect installation. For the second account you can have Azure AD Connect generate the account or specify an account of your own. For the third account, by default, Azure AD Connect uses a VSA, but you can specify a user account or gMSA from Active Directory.

      When you specify your own accounts, I recommend to use separate accounts per Azure AD Connect installation. It's not strictly needed, but there's a couple of big benefits:

      • In recent versions of Azure AD Connect, the way service accounts are given permissions have changed. By using a new account, you benefit from these new security insights. Be sure to delete obsolete service accounts, belonging to decommissioned Azure AD Connect installations, though.
      • When you migrate from one (or more) Azure AD Connect installation(s) to another (or more) Azure AD Connect installation(s), you want to delete the accounts associated with obsolete Azure AD Connect installations. Using a naming convention and/or filling description attributes will give you clues on what accounts and/or gMSAs may be decommissioned.
      • When you use SQL as the database for multiple Azure AD Connect installations, all databases will be named ADSync. In this case, only the SQL listener and the service account that has permissions in the database will give you clues to what Azure AD Connect installation the database belongs.

      from Sander Berkouwer May 1, 2018 at 9:06 PM
      
11. 
    

    Why AD sync service is consuming more physical memory in DC physical server?

    from Ravi shankar July 12, 2018 at 12:11 PM
12. 
    

    Hi Sander, thanks to this article, we went 'full cloud' a few years back (so no on-prem exchange to maintain – yipeee!). Our organization has 200 people and we've been using a 3rd party solution to sync user domain passwords with their O365 accounts, but I'd like to save some pennies by using Azure AD Connect for free.

    Can you tell me if it is possible to use Azure AD Connect, so that it only synchronizess the passwords but leaves everything else 'as is' and all the admin still takes place in the O365 Admin portal (after the user has been created in on-prem AD)?

    The only reason we have our on-premises Active Directory at all now is for our aging legacy ERP system, which is soon to be moved onto Dynamics FO (at which point I'll be taking the legacy ERP server out into the carpark to beat it to death with a sledgehammer).

    from Jim October 16, 2018 at 4:16 PM
    • 

      Hi Jim,

      Azure AD Connect does not support synchronizing merely the passwords.
      When Azure AD Connect matches an object between the on-premises Active Directory Domain Services (AD DS) environment(s) and Azure AD, then Azure AD Connect assumes control over it. This process includes the attribute CloudMastered for these object to be set to false. This in turn, disables changes to the attributes that are synchronized and makes them non-editable through the Azure Portal.

      from Sander Berkouwer October 17, 2018 at 12:00 PM
      
13. 
    

    What we have to do to change Ad sync service account from the default to something we prefer?

    I changed the service account and got log on failure.

    Is it something allowed?

    from John February 20, 2021 at 10:20 PM
    • 

      Hi John,

      Follow the steps outlined here.
      The specific steps mentioned there help you overcome the logon error for the service.

      from Sander Berkouwer February 21, 2021 at 8:20 AM
      
14. 
    

    Does Entra Connect Sync support AlwaysOn Availability Groups (SQL Clustering)?

    from Thanny Lopez February 11, 2024 at 7:08 PM
    • 

      Yes.

      You can deploy Entra Connect Sync (previously known as Azure AD Connect) with SQL Server Always On Availability.
      The trick here is that the database should become part of the Availability Group after you've initially configured Entra Connect Sync.

      Don't forget to properly encrypt traffic between the servers running Entra Connect Sync and SQL Servers hosting their databases.

      from Sander Berkouwer February 12, 2024 at 9:09 AM