Instructor: Good day, Cloud Gurus and welcome back.
For this lesson what we're going to take a look at
integrating Active Directory Domain Services
with Azure Active Directory.
Let's take a look at what we're going to cover.
First up, we'll take a moment to understand
what exactly is Azure Active Directory.
Then we'll take a look at some of the advantages of Azure AD
and we'll take a look at how you can integrate Azure AD
with Active Directory Domain Services.
And then finally, we'll take a look at
the concept of writeback.
Let's get started.
So, what is Azure AD?
Well, Azure AD is a Cloud-based Platform-as-a-Service
directory service offered by Microsoft.
And Platform-as-a-Service means
that you don't need to manage the infrastructure,
like you do with Active Directory Domain Services,
and it shares some of the functionality
of Active Directory Domain Services,
including the ability to create and manage users, groups,
and perform authentication
and authorize access to resources.
But where it differs
is that Active Directory Domain Services
is designed to work on a trusted corporate network.
Whereas Azure AD is designed to work with cloud applications
across the internet,
and because of this,
Azure AD uses modern authentication mechanisms
like Security Assertion Markup Language, or SAML,
or OpenID Connect and OWA for authorization.
And I want to make one important distinction here.
Active Directory Domain Services, Azure Active Directory,
and Azure Active Directory Domain Services,
are all separate distinct services.
And we'll be covering the integration
between Active Directory Domain Services
and Azure AD in this section.
And we'll cover Azure Active Directory Domain Services
in a later section.
I know it's confusing,
but it's important to understand each of these services,
what they're called, and what purpose they serve.
Now, let's take a look at some
of the advantages of Azure AD.
Azure AD includes some features that are not native
to Active Directory Domain Services,
and these include things like, improved security features,
like built-in multi-factor authentication,
conditional access, and the ability to detect
irregular sign-ins.
Azure AD also includes the ability to integrate with
on-premises workloads, using Azure AD Application Proxy,
and for improved collaboration and sharing capabilities,
Azure AD supports Federation to allow users
from other organizations, and other identity providers
to authenticate with Azure AD.
And Azure AD also supports single sign-on,
and this is achieved using synchronization
between Active Directory Domain Services
and Azure AD to provide single sign-on
across multiple cloud applications.
Now, Azure AD is a multi-tenanted platform, meaning
that multiple Microsoft customers will all use Azure AD.
Your Azure AD Tenant is your individual
isolated Azure Active Directory instance.
It is the security boundary for your users
and groups that are stored in the Tenant.
And typically organizations will only have one
Azure AD Tenant, but they might have more
than one tenant for testing or due to company mergers
and acquisitions.
Like Active Directory Domain Services,
each tenant has a domain name,
and by default, this is a sub domain
of the onmicrosoft.com domain,
but you can add your own domains too.
Now, Azure AD can have its own set of users and groups,
and when configured like this, your users will have
two sets of credentials to access resources.
One for their on-premises access,
with Active Directory Domain Services,
and another set for the cloud,
but there are some better alternatives to this.
To enable your users to access cloud applications
using the same user name and password they use in ADDS,
you can synchronize your users and groups
from your Active Directory Domain Services domains
to your Azure AD Tenant,
and some objects and properties can be written back too.
And we'll take a look at this in just a moment.
And this synchronization and single sign-on functionality
is known as hybrid identity,
and you can synchronize your identities using one
of two methods.
The first is Azure AD Connect sync,
and the second is Azure AD Connect cloud sync,
and each of these methods has different advantages,
disadvantages, and implementations.
And we'll dive into each of these
in the following lessons in this section,
but regardless of which synchronization method you choose,
passwords are a problem.
Passwords are stored in the Active Directory database
using a one way hash.
This means that Active Directory can't read the passwords
to synchronize them to Azure AD.
To authenticate users, Azure AD needs to check
the password is correct, or it needs to hand off
that responsibility back on premises.
And there are three authentication options available
when using hybrid identity to help deal
with this password problem.
The first of these is password hash synchronization,
and this method involves sending a hash of the hash
to Azure AD, so it can verify the password.
It's important to note here that the actual password,
or even the hash of the password is not sent to Azure AD.
It's a hash of the hash.
So, your user's passwords remain on premises.
The second option is Pass-through Authentication.
With this method, Azure AD uses agents that you deploy
to verify the password against
the Active Directory Domain Services domain controllers.
And the final option is Federation,
and this method involves deploying Active Directory
Federation Services or an alternative on premises,
and having Azure AD hand off the responsibility
of authentication back to your Federation Service.
Later on in this section, we'll take a closer look
at each of these authentication methods,
and how you can implement them.
Now, as I mentioned most synchronization
occurs in one direction,
from Active Directory Domain Services to Azure AD,
but some objects and information can be written back too.
And this is referred to as writeback.
The first, and probably the most useful information to
writeback, is passwords.
Passwords can be set in Azure AD
and written back to Active Directory Domain Services
to ensure the passwords remain the same.
And this is extremely useful
with self-service password reset,
which allows users to reset their own password
in Azure AD without any assistance from IT.
And then we have group writeback.
Microsoft 365 groups are a special group type
that only exist in Azure AD,
and they cannot be created or managed
in Active Directory Domain Services.
Microsoft 365 groups can also be written back
to your Active Directory Domain Services domains.
They're created as distribution groups on premises,
and it's important to note that security groups
created in Azure AD cannot be written back,
and group write back requires
Microsoft Exchange on premises,
and it's most useful when you're migrating email
to Microsoft 365, or you have a hybrid Microsoft Exchange
configuration where some mailboxes still exist on premises.
And you can also write back device objects
from Azure AD back to ADDS,
and this is useful in a couple of scenarios,
including Active Directory Federation Services
conditional access and Windows Hello authentication.
Let's take a look at what we've covered.
Azure Active Directory is a cloud-based
identity service, designed to work with cloud applications
using modern authentication.
Azure AD Connect sync or Azure AD Connect cloud sync,
can be used to synchronize Active Directory Domain Services
with Azure AD.
And providing single sign-on requires either password
hash synchronization, Pass-through authentication,
or Federation to be implemented,
and passwords, groups, and devices can be written back
from Azure AD to Active Directory Domain Services.
All right, thanks for being with me in this lesson,
and I hope you found it useful,
and I look forward to seeing you in the next lesson.