Good day, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at implementing Azure AD Connect Cloud sync.
Let's take a look at what we're going to cover.
First up, we'll do a bit of an introduction
to Azure AD Connect Cloud sync.
And then we'll do a comparison
between Azure AD Connect Cloud sync and Azure AD Connect,
so you can understand the differences
between these two solutions,
and when you might choose one over the other.
And then finally, we'll do a demo
where we will implement and manage
Azure AD Connect Cloud sync.
Let's jump in.
So we've already taken a look at Azure AD Connect sync.
Now Microsoft has a new offering
called Azure AD Connect Cloud sync.
It works a little differently.
Instead of deploying an Azure AD Connect sync server,
you deploy lightweight agents on your servers
and all of the configuration, management,
and synchronization orchestration is done
in the cloud by Azure AD,
and you can deploy multiple provisioning agents
to any servers that are supported.
The lightweight agent has similar requirements
to Azure AD Connect sync.
It requires Windows Server 2016 with a desktop experience
and .NET 4.7 or later.
But it's not yet a complete replacement
for Azure AD Connect sync,
but it does solve a few problems
that Azure AD Connect sync had.
Let's take look at some of the advantages
and disadvantages of Azure AD Connect Cloud sync.
One of the big advantages of Azure AD Connect Cloud sync
is that you can deploy multiple agents
to synchronize your users and groups to Azure AD,
and that means that a single agent can fail
and you'll still get updated identity information
in Azure AD.
And for high availability,
Microsoft recommends you deploy at least 3 agents,
and these agents are quite lightweight.
There's no database to manage
and you can deploy them to an existing server if you wish.
And if you have quite a small number of servers,
you can even deploy them to your domain controllers.
And with support for disconnected forests,
there's no need to have network connectivity
or trust relationships to have them all sync
to the same Azure AD tenant.
And finally, it's important to point out
that you can deploy cloud sync alongside Azure AD Connect,
and they'll operate in parallel,
as long as they're not synchronizing
the exact same identities.
There are some disadvantages though.
The first is that you cannot sync device objects.
So any requirements that you have
to provision devices in Azure AD
isn't supported with cloud sync.
Cloud sync also cannot sync user-defined attributes.
So if you've extended the Active Directory schema
by adding custom attributes,
these won't be synced to Azure AD.
It also doesn't support Pass-through Authentication
and there's no device or group writeback.
And you also can't use cloud sync
with Azure AD Domain Services,
and Azure AD Domain Services
is that platform-as-a-service offering
for Active Directory Domain Services
that we'll cover in an upcoming section.
But despite these disadvantages,
Azure AD Connect Cloud sync
supports the most common scenarios
and removes some of the limitations of Azure AD Connect,
like high availability.
So you should definitely consider
Azure AD Connect Cloud sync
when you're choosing how to synchronize your identities
to Azure AD.
All right, let's take a look at a demo
of installing and configuring Azure AD Connect Cloud sync.
We already have 2 forests deployed,
one for barrierreefaudio
and the other for rivercityai.
And barrierreefaudio
is currently synchronizing their identities
using Azure AD Connect sync.
We're going to configure the dev.rivercityai.com domain
to sync their identities using
Azure AD Connect Cloud sync,
and I've gone ahead in the background
and prepared the Azure AD tenant
by adding and verifying the rivercityai.com domain.
And as you've seen the process in the previous lesson,
I've gone ahead and prepared the rivercityai
Active Directory Domain Services environment
by configuring the user principle name suffix
and running IDFix to verify the configuration.
In this demo, we'll deploy the Azure AD provisioning agent
on the domain controller and the rivercityai domain.
And then we will manage Azure AD Connect Cloud sync
using Azure AD.
Let's take a look.
All right, so here we are on the Azure portal
and I've gone ahead and navigated
into Azure Active Directory.
Now let's go ahead and navigate into Azure AD Connect.
And because we're configuring Azure AD Connect Cloud sync,
we're going to go ahead and select the option
to manage Azure AD Connect Cloud sync.
And the first step
in configuring Azure AD Connect cloud sync
is to download and install a Synchronization Agent.
So we're going to go ahead and select Download Agent
and then we'll accept the terms and download.
All right, with the Azure AD Connect provisioning agent
now downloading, I'm going to jump over
to our domain controller in the rivercityai domain
and we'll go ahead and install the agent.
So here I am on the rivercityai domain controller.
We're going to go ahead
and run the Azure ADConnectProvisioningAgentSetup.
We need to accept the license terms and conditions
and then we can go ahead and click Install.
It'll just take a moment to install.
So we'll come back when that's done.
All right, the installation is now complete
and it's launched the Configuration Wizard.
We'll go ahead and select Next.
And then we need to connect to Azure AD.
So I'll go ahead and click Authenticate
and then we need to log in
with a member of the hybrid identity administrator role
or the global administrator role.
So I'll go ahead and log in as a global admin.
And now we're connected to Azure AD.
We need to go ahead and configure
our group managed service account
to manage your synchronization from Active Directory
to Azure Active Directory.
So we're going to go ahead
and create a group managed service account,
and we need to provide credentials
of a user that is a member of the account operators group
or the domain admins group.
So we'll go ahead and enter in the credentials
for our domain administrator.
And then we can go ahead and select Next.
And it's gone ahead and automatically added
our dev.rivercityai Active Directory domain,
so we can go ahead and click Next.
And then we can go ahead and click Confirm.
This will just take a moment to complete
so we'll come back when this is done.
All right,
with the provisioning agent configuration now complete,
we can complete the rest of the configuration
in the Azure AD portal.
So we'll go ahead and exit the Configuration Wizard
and then we'll jump over to the Azure AD portal.
All right, so here we are back in the Azure AD portal.
I'm going to go ahead and refresh this page
and now with our agent deployed,
we can now configure Azure AD Connect cloud sync.
So we'll go ahead and select New Configuration.
and we'll go ahead and use the default options here
to enable password hash sync,
and use our dev.rivercityai.com domain.
So I'll go ahead and click Create.
This will just take a moment to complete.
So we'll come back when this is done.
All right, and now we can go ahead
and complete our clouds sync configuration.
By default it's going to synchronize
all the users in the domain,
but we can edit the scope if required
to selectively synchronize specific security groups
or organizational units.
We're okay to synchronize all users,
so I'll go ahead and click Close.
And you can also edit the mapping of attributes
for your users if you need to.
And then you can validate your configuration
by provisioning a test user.
And then finally you need to configure a notification email.
So I'm going to go ahead and provide that.
And then finally we need to enable the synchronization.
So I'll go ahead and select Enable
and then we can go ahead and click Save
to complete the configuration.
It'll ask us to confirm,
so we'll click Yes.
And it'll just take a moment to save that configuration.
So we'll come back when that's done.
All right,
with the cloud sync configuration now successfully saved,
we can go ahead
and navigate back to Azure AD Connect Cloud sync,
and we can see that we have our configuration deployed
and the status is currently healthy.
All right. That concludes this demo.
Let's go and wrap up with a bit of a summary
of what we've covered in this lesson.
All right. So what have we covered in this lesson?
Azure AD Connect cloud sync is a new offering from Microsoft
used to synchronize hybrid identities.
And cloud sync provides high availability
through multiple synchronized agents
and support for multiple disconnected AD DS forests.
But it's important to know
that cloud sync cannot be used
with Pass-through Authentication, and it does not provide
group or device writeback capabilities.
It's also important to remember that cloud sync
cannot be used with Azure AD Domain Services.
All right. That wraps up this lesson.
Thanks for being with me.
And I hope you found this lesson useful.
And I look forward to seeing you in the next lesson.