On-prem AD account creation in a Hybrid Enivornment

Hi Syed Rabbani ,

I assume you are aware that the synchronization between on-prem AD (source) and Azure AD (target) using AAD Connect is (predominantly) a one-way sync. You still have a possibility to create identities directly in AAD (Portal, PowerShell, API), but these are "cloud-only", and they won't show up in your on-prem AD.

Most enterprises have some 'Identity and Access Management' system on-prem, where typically an HR system is a source of user information and the IAM system is creating respective user accounts (and groups) in AD, which in turn is synced to AAD (should you choose to configure it this way).

If your question was about creating those "source" identities in AD, then apart from some integration with another source system (as I mentioned above) you have traditional options like MMC console, and Active Directory PowerShell.

You could use Azure Automation with Hybrid Runbook Worker and have a runbook in place that would (pending it has appropriate rights in your AD) create new accounts in AD (and AADC would sync it afterwards to AAD), but the remaining question is: what would be the data source for such automation? The runbook would need some input about user properties that you would need to provide. 

How are you planning to handle this part?