Forum Discussion

Ichwan's avatar
Ichwan
Copper Contributor
Sep 30, 2020
Solved

Multiple forest exhange hybrid without forest trust

Hi,   i have to make sure the requirement, I have two forest and want to deploy Exchange hybrid with single tenant. based on this article https://docs.microsoft.com/en-us/exchange/hybrid-deploymen...
hybrid
  • SeanMcAvinue's avatar
    SeanMcAvinue
    Oct 08, 2020

    Ichwan 

    Host file records should work but generally not recommended as they introduce complexity and manual configuration. Alternatively you could look at a dedicated non-AD integrated DNS server to manage just the AD Connect lookups, or update your public records in your internal DNS servers to point to public IP (This depends on if that will impact your internal users.. 

  • Ichwan's avatar
    Ichwan
    Copper Contributor
    Oct 08, 2020

    Hi, SeanMcAvinue 

     

    happy to hear there is no trust required :smile:

     

    if I already make azure ad connect and other forest dc ping each other, is there any other requirement like conditional dns forwarder ? because not all the resource/ip address is routable each domain. I just need to run sync user only.

     

    Thanks for your reply

    • SeanMcAvinue's avatar
      SeanMcAvinue
      MVP
      Oct 08, 2020
      As long as the AD Connect server can resolve both forests and can connect on the required ports as per the documentation AD Connect can sync your users. You can add OU filtering to the connectors to capture just the users you want. You can set up DNS conditional forwarders to ensure AD Connect can resolve both forests and all DCs.

      The topology you're looking for is in the documentation as "Multiple forests, single Azure AD tenant"

      https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies
      • Ichwan's avatar
        Ichwan
        Copper Contributor
        Oct 08, 2020

        Hi,SeanMcAvinue 

         

        I already test with conditional forwarders, but conditional forwarders is not suitable with my environment.

         

        lets give me example, i have two forest. contoso.com and fabrikam.com

         

        If i enable conditional forwarder fabrikam.com in contoso DNS, all record to fabrikam.com will route trough dns A record.  if contoso client try to ping http://www.fabrikam.com, it will resolve by internal ip, and the routing is not availble, the result is ping http://www.fabrikam.com is RTO. My requirement is when contoso client ping http://www.fabrikam.com, it will resolve by ip public

         

        i curious, is it any solution that suit to my requirement ? is it hostfile available to do that ?

         

        Thanks before

         

         

         

Resources