Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look at Implementing
and Managing Azure AD Connect Synchronization.
Let's take a look at what we're going to cover.
First up, we'll understand some of the supported
synchronization topologies for Azure AD Connect,
then we'll take a look at how you can prepare
for Azure AD Connect Synchronization.
And we'll take a look at the process
for deploying Azure AD Connect.
And then finally, we'll do a demo where we will implement
and manage Azure AD Connect sync.
Let's get started.
It's important to know what you can deploy
to support synchronizing
your Active Directory Domain Services environment
with Azure AD.
Let's take a look at some of the supported
deployment topologies.
The first supported and perhaps most common topology
is where you have one forest
and you deploy a single Azure AD Connect sync server
to synchronize your identities to a single Azure AD tenant.
The second supported option
is to synchronize multiple AD DS forests
to a single Azure AD tenant.
But it's important to know with this configuration
that you can only have one Azure AD Connect sync server
per Azure AD tenant.
But as you can imagine,
this can result in a single point of failure.
But you can deploy a staging server
for disaster recovery purposes.
In the event that your primary Azure AD Connect Server fails
and is unrecoverable,
you can failover to the staging server.
But it's important to note,
that the failover process is manual
by running the Azure AD Connect Sync Wizard,
and there are some more advanced deployment topologies
such as synchronizing a single
Active Directory Domain Service forest
to multiple Azure AD Tenants.
But we won't be covering this as it's quite uncommon
and you don't need to know how to do it
to prepare for the exam.
All right, let's take a look at the steps required
to prepare for synchronization.
The first step is to prepare your Azure AD Tenant.
Once you've registered your Tenant,
you will receive a company name .onmicrosoft.com domain.
You'll need to add at least one custom domain,
and this is likely going to be your company's externally
facing domain.
You'll also need to verify that domain.
And verification involves creating an MX or TXT record
in your public facing DNS zone to verify ownership.
You'll also need to ensure
that you have a User Principal Name or UPN suffix configured
that matches the domain you wish to use
in your Azure AD Tenant.
And your users must be configured
to use this User Principal Name.
And you also need to ensure that you don't have any issues
that would prevent synchronization.
And there are quite a few issues
that could affect synchronization.
Instead of memorizing all of the issues,
you can use a tool like IDFix to identify and fix issues.
And finally, you need to prepare a server
for Azure AD Connect.
You need to configure a domain-joined Window Server,
running Windows Server 2016 or later,
and the server must be installed
using the desktop experience.
And you'll need to install .NET Framework 4.6.2 or later.
And if you plan to use federation,
you'll also need additional servers.
And we'll cover that in more detail in an upcoming lesson.
And if you have a larger environment
say more than 100,000 Active Directory objects,
you'll need to deploy a dedicated SQL Server
for the Azure AD Connect sync database.
All right, now let's take a look at the steps required
to deploy Azure AD Connect.
First you'll need to have the required Azure AD role.
And these roles include the Global Administrator
or Hybrid Identity Administrator roles.
And then you'll need to choose an installation option,
and there are 2 to choose from.
The express option is recommended for most scenarios.
It supports configuring a single AD DS forest
using the built-in database
and configures password hash sync.
And you'll need to be an Enterprise Admin
if you want to use this option.
Or you can choose the custom installation option,
and it supports configuring multiple AD DS forests
using a Microsoft SQL Server database
and other advanced scenarios
like importing existing settings.
All right, let's take a look at a demo
of installing and configuring Azure AD Connect.
We already have 2 AD DS forest deployed:
one for Barrier Reef Audio and another for River City AI.
And a 2-way forest trust exists between these 2 forests,
and they want to synchronize their identities
to a single Azure AD tenant.
We'll start by preparing the Azure AD tenant.
We will add and verify the domains, barrierreefaudio.com
and rivercityai.com.
And then we will prepare AD DS,
by configuring a User Principal Name Suffix
and using IDFix and PowerShell to fix any issues.
And as our Domain Controller is running the server core
installation option,
we'll use our Administrative Server for this.
And then we will deploy Azure AD Connect sync
on the new Azure AD Connect Synchronization server.
And we'll do this using the express installation option.
And then finally,
I will show you how you can manage Azure AD Connect
to sync additional domains.
All right, let's jump into the demo.
All right, here we are in the Azure portal
and we've gone ahead
and navigated to Azure Active Directory.
Our first step is to configure a custom domain.
So we're going to navigate to custom domain names.
And we can see we have our default
onmicrosoft.com domain here.
We're going to go ahead and add a custom domain.
So we'll select Add Custom Domain.
And then we need to provide our domain name,
and our domain name is barrierreefaudio.com.
And now we need to verify our domain.
And this involves creating a text or MX record
in your public facing DNS zone
to verify ownership of that domain.
We're going to use a text record for this purpose.
So I'm going to go ahead and copy
the value that we need for this text record.
And we'll navigate over to our public facing DNS zone
for barrierreefaudio.com.
Now, I'm going to use an Azure Public DNS zone for this,
but your public facing DNS zone
might be managed by a completely different DNS provider.
But if you are interested in using Azure Public DNS,
we'll take a closer look at Azure Public DNS zones
in a later lesson.
And we need to create a text record.
So let's go ahead and create a record set
and we need to create a record for the parent domain.
So we're going to use the @ symbol
for the name of this record.
And we need to create a text record,
so I'm going to go ahead and select TXT.
We can lead the default time to live,
and we need to provide the value from Azure AD.
And then we can go ahead and click OK.
All right, and then we can navigate back to Azure AD
and verify ownership of this domain.
So we'll go ahead and select Verify.
If you are completing this process
and the verification fails on the first attempt,
just give it a little bit longer and then verify again.
All right, now that our domain is verified,
I'm going to complete these steps
for the rivercityai.com domain as well.
Now, I'm going to switch over
to our Internal Administrative Server,
and prepare Active Directory Domain Services.
All right, so here we are on ADM 01,
our Internal Administrative Server.
I'm going to launch Active Directory Domains and Trusts
and create a new User Principal Name for our custom domain.
We're going to right click Active Directory Domains and
Trusts and select Properties.
Let's go ahead and add the barrierreefaudio.com UPN suffix.
We'll go ahead and click Add and then OK.
All right, and now I'm going to go ahead and use PowerShell
to update all of the User Principal Name suffixes
for the user in our domain.
So I'm going to go ahead and launch the Windows PowerShell
Integrated Scripting Environment, or ISE.
And here's a PowerShell script that I've prepared
to update the User Principal Name
for all of the users in our domain.
And you might use a PowerShell script similar to this
to reconfigure the users in your domain.
But you might filter out some user accounts
or your service accounts.
First, we're going to import the Active Directory
PowerShell module,
and then we'll get all of our Active Directory users
in the domain using the Get_ADUser PowerShell cmdlet.
And now we'll update all of our users
to use the new barrierreef.com UserPrincipleName.
Now, let's go ahead and run IDFix
to confirm that there's no other issues
with our user accounts.
I've downloaded IDFix, let's go ahead and run it,
open our downloads folder,
and then we'll launch the setup for IDFix.
Just select OK on the Privacy Statement.
And then we can run query to query
our Active Directory database.
And we can see here, there's a couple of issues
with our Active Directory user objects.
And IDFix has recommended some suggested updates
to resolve of these issues.
The first issue is that we have a blank display name.
And the second issue
is that we have an invalid userPrincipalName.
And it's suggesting that we add a display name for this user
and update this userPrincipalName for this user.
But you can notice here that it's actually dropped
the last character for this user's name.
We're going to go ahead and re-add a valid character,
and then we'll go ahead and click Accept
to accept all the suggested changes,
and then it's just reminding us
that we need to verify all of the changes
that are being made.
And that's all right, so we'll click Accept.
And now we can go ahead and click Apply
to resolve the issues with these 2 users.
Just providing us with a warning
that we're going to apply all of the changes
and that's fine, so we'll go ahead and select Yes.
And those users are now all updated,
and all of the issues have been resolved.
Let's jump over to our Azure AD Connect server now,
and install and configure Azure AD Connect.
All right, so here we are,
on our Active Directory Connect Server
and I've gone ahead and downloaded Azure AD Connect.
We'll go ahead and launch the installer
for Azure AD Connect.
This will just take a moment to install,
so we'll come back when this install is complete.
All right, Azure AD Connect is now installed,
and it's automatically launched
the Azure AD Connect Configuration Wizard.
We're going to go ahead and configure Azure AD Connect.
So we'll agree to the license terms and privacy notice.
And then also like Continue.
Now, as we mentioned in the lessons,
you can use custom install if you'd like
to use an existing SQL Server
or import synchronization settings for example.
We're not going to use that,
we're going to use an express install.
So we'll select Previous
and then we'll select Use Express Settings.
Now, to connect to Azure AD,
we need to provide the credentials
of a Global Administrator.
I'm going to go ahead and provide the credentials
of a user that is an Azure AD Global Administrator,
but you can also use the Hybrid Identity Administrator role.
And then I'll go ahead and select Next.
It'll connect to Azure AD to verify the credentials.
This will just take a moment.
And then we need to provide Enterprise
Administrator credentials
for our Active Directory forest,
so I'm going to go ahead and provide that.
And then I'll provide the password,
and then go ahead and select Next.
And now we're receiving a bit of a warning here,
just indicating that we need to add
and verify our domains in Azure AD
and configure our UPN suffixes, we're aware of this.
So we're going to go ahead and select Continue,
and then select Next.
All right, and now it's going to go ahead
and complete the installation process,
configure synchronization,
and start the synchronization process.
So I'm going to go ahead and click Install,
and we'll come back when this is done.
All right, and the configuration of Azure AD Connect
is now complete.
So I'm going to go ahead and select Exit.
And once you've configured Azure AD Connect,
you can go ahead and run the Azure AD Connect
Configuration Wizard any time
to update the Azure AD Connect Sync Configuration.
So if I go ahead and launch Azure AD Connect.
And it's important to note that synchronization is paused
while you're running the Configuration Wizard,
let's go ahead and click Configure.
And from here, you can ahead
and modify the Active Directory Connect
Synchronization Configuration.
Let's go ahead and customize the synchronization options.
We'll go ahead and select Next.
And from here, you can synchronize additional directories,
modify your filtering, and modify additional options.
We'll just go ahead and go back.
And I just want to show you that you can also user sign-in.
So I'll go ahead and select Change User Sign-in
and then select Next.
I'll go ahead and log in as the global admin.
We'll go ahead and select Next.
And from here, you can modify
the user sign-in configuration.
And I just want to jump back
to our Internal Administrative Server
and show you one more thing before we wrap up.
You can see here in Active Directory Users and Computers,
an MSOL user account has been created.
And this user account is created
and managed by Azure AD Connect.
And it's important to know,
that you should never rename this user account
or change the password for this user account.
All right, that wraps up this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered in this lesson?
Azure AD Connect sync
can be deployed to support multiple forests
and a single Azure AD Tenant.
And you can use a staging server
to provide disaster recovery for Azure AD Connect sync.
And to prepare for Azure AD Connect,
you must configure and verify a domain in Azure AD
and then create a matching
User Principal Name suffix in AD DS.
And you can use IDFix to find and resolve issues
with Active Directory Domain Services identities
prior to synchronization.
And it's important to know,
that Azure AD Connect can be installed using the express
or the custom installation option.
And you'll choose the custom installation option
when you have a large number of AD objects
and need to use your own SQL Server Database.
All right, that concludes this lesson.
Thanks for being with me, and I hope you found it useful.
And I look forward to seeing you in the next lesson.