Azure AD Connect.
What is Azure AD Connect and what are its primary use cases?
Well, it's like this.
As you can see, the attribution, when I use a Microsoft docs image,
is in the lower corner of the slide.
We're assuming that you have an on‑premises Active Directory.
Now we could be talking single forest or multi forest,
single domain or multi domain.
It doesn't matter, but you've got your local Active Directory credentials.
Your users sign into their domain‑joined workstations with,
it could be their UPN, their User Principal Name,
which uniquely identifies their account in the forest and has
the same format as an SMTP email address.
That's going to be important when we're planning hybrid identity.
But then importantly, just as much, we have the local password.
We want to give our local Active Directory users single sign‑on into CloudApp.
Now CloudApp is an app that runs with Azure AD authentication.
We could be talking about Microsoft, first‑party SaaS,
or software as a service products like Microsoft 365,
we could be talking about your homegrown native desktop or web or mobile apps,
or we could be talking about SSO integrations to different providers,
as you see here, SAP, Dropbox Business, even AWS.
Azure Active Directory includes a whole bunch of programming already
done for you to help set up those SSO federations.
So long story short,
how can we give our on‑premises Active Directory users the ability to
sign into our cloud apps with their local credentials?
We want to avoid having to give or saddle our users with additional credentials.
When we're doing this AD Connect business,
you have to think about, are you going to allow self‑service password reset,
or SSPR?
This is called password writeback where you allow your user
to change their password in Azure AD.
And if you do want the password change to go back across
the Azure AD channel to on‑premises, this is something you have to think about,
plan for, and implement when you're doing your Azure AD Connect setup.
There are also a number of password sync options that we
need to review for our exam AZ‑800 success.
Azure AD Connect is a Windows service that runs on your local
domain controllers and/or member servers.
You'll want to install at least two of these Azure AD
Connect services for high availability, and they operate over the internet.
You don't have to have a site‑to‑site VPN or an ExpressRoute tunnel.
We're talking about TCP 443 with TLS/SSL encryption.
There are actually, as I alluded to at the overview part of this lesson,
two Azure AD Connect options.
In fact, this tool, this directory synchronization service,
has been around for many years under many different names.
It's just for the last few years, Microsoft has standardized on Azure AD Connect,
and they revise the service regularly.
It's still ongoing as of this recording in very early 2022.
So let's compare and contrast Azure AD Connect on the left and
Azure AD Connect cloud sync on the right.
Well, let me let the cat out of the bag.
AZ‑800 and 801 assume that you're using AAD Connect rather than cloud sync.
So that's what I'm going to demo in this lesson.
Azure AD Connect supports the synchronization of not only your
Active Directory user and group accounts,
but also device objects like computer accounts,
and you also can map custom schema extensions or attributes that you
might've added to your users and groups into Azure AD,
which is pretty cool.
Cloud sync can't do that, at least not yet, as of this recording.
Passthrough authentication,
which we'll formally define on the next slide is
supported only with AAD Connect, as is device and group membership writeback.
If you make a group change in Azure AD,
that change will go back across the channel.
You can't do that yet with cloud sync.
Now notice that I'm saying yet because I'm assuming
eventually the cloud sync option will be in full feature
parity with Azure AD Connect as it stands.
A significant issue for some customers who are running Exchange Server in
an Exchange Online/Exchange Server hybrid topology,
Exchange hybrid writebacks available at this point only
with AAD Connect cross‑domain references.
And then very importantly for our exam AZ‑800 success,
Azure AD Domain Services integration only works with
the full AAD Connect software.
Bottom line is, although cloud sync is a great idea,
it's going to be a little while before it's mature enough to where
you can migrate from the one method to the other,
or if you're greenfielding it where you're setting up
hybrid identity from scratch now, whether you would go for cloud sync.
Probably not, to be totally honest.
The biggest advantage of Azure AD Connect cloud sync is
instead of relying on client setup,
the way that AAD Connect works normally is that you
configure it completely on the client side,
that is in your local environment on your infrastructure servers.
And remember how I said you'll want to have two or more AAD Connect
boxes running the service for high availability?
Well, they don't talk to each other.
So you've got to do all this stuff with only one
instance that's actually running,
and then you basically put the other instances in what's called staging mode.
It's kind of a pain.
Cloud sync gives you centralized cloud‑based command control
over your synchronization, and you just deploy a more
lightweight agent to multiple systems,
and you do have that automatic failover and high availability.
So that's the biggest advantage to the cloud sync model.
Cloud sync also allows connectivity to disconnected forests,
which AAD Connect does not support.
That's really it at this point, as of this recording in very early 2022. Cloud sync is really still in its early days.