Forum Discussion
Multiple forest exhange hybrid without forest trust
Hi,
i have to make sure the requirement,
I have two forest and want to deploy Exchange hybrid with single tenant. based on this article https://docs.microsoft.com/en-us/exchange/hybrid-deployment/hybrid-with-multiple-forests
there is no requirement to configure forest trust to deploy Exchange hybrid
is it correct we can do without trust ?
how azure AD Connect recognize the other domain without trust ?
thanks
Host file records should work but generally not recommended as they introduce complexity and manual configuration. Alternatively you could look at a dedicated non-AD integrated DNS server to manage just the AD Connect lookups, or update your public records in your internal DNS servers to point to public IP (This depends on if that will impact your internal users..
5 Replies
- AD connect can use a service account, it doesn't need to be in the domain. You'll essentially be setting up two forest connectors and one AAD connector.
Supported topology is at this link: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies#multiple-forests-single-azure-ad-tenantHi, SeanMcAvinue
happy to hear there is no trust required
if I already make azure ad connect and other forest dc ping each other, is there any other requirement like conditional dns forwarder ? because not all the resource/ip address is routable each domain. I just need to run sync user only.
Thanks for your reply
- As long as the AD Connect server can resolve both forests and can connect on the required ports as per the documentation AD Connect can sync your users. You can add OU filtering to the connectors to capture just the users you want. You can set up DNS conditional forwarders to ensure AD Connect can resolve both forests and all DCs.
The topology you're looking for is in the documentation as "Multiple forests, single Azure AD tenant"
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies
