Blog Post

Microsoft Entra Blog
2 MIN READ

Bring identities from disconnected ADs into Azure AD with just a few clicks!

Alex Simons (AZURE)'s avatar
Alex Simons (AZURE)
Icon for Microsoft rankMicrosoft
Dec 05, 2019

Howdy folks,

 

Today we’ve got some amazingly cool news to share.

 

If you work in a large enterprise, you probably already know how big the challenges can be when your company makes an acquisition and you suddenly get asked to provide cloud identity services to an entirely new business group, usually one with their own set of Active Directory domains and forests.

 

If this is a challenge you face, I’m excited to let you know about the public preview of Azure AD Connect cloud provisioning!

 

With cloud provisioning, customers can easily provision identities from multiple disconnected AD forest to Azure AD. Azure AD Connect cloud provisioning moves the heavy lifting for provisioning from AD to Azure AD to the cloud with lightweight agents on-premises and provides the following benefits:

  • Helps with provisioning from disconnected AD forests to Azure AD—Organizations may have disconnected AD forests due to mergers and acquisitions or remote office locations. Whatever the reason may be, cloud provisioning allows you to quickly integrate these multiple disconnected AD forests into an Azure AD tenant.
  • Reduces on-premises footprint—The provisioning agent is a lightweight agent with the sync complexity (configuration and processing) in the cloud.
  • Enterprise grade high availability—Multiple provisioning agents can be deployed to ensure high availability for provisioning especially for password hash sync.

Give cloud provisioning a try

Setting up cloud provisioning is a two-step process. The first step is to install the lightweight provisioning agent on a domain joined server (or server VM). The second step is to configure cloud provisioning in the Azure portal.

Step 1: Install the provisioning agent

Before you install the Azure AD Provisioning agent, complete the prerequisites.

  1. In the Azure AD Connect experience, click Manage provisioning (preview).



  2.  On a domain joined Windows server, click the Download agent button to download the Azure AD provisioning agent.  

  3.  Follow the wizard steps to install the provisioning agent package.

4. Once the agent is installed, you’re ready to configure provisioning in the Azure portal. 


Step 2: Configure cloud provisioning

  1. In the Azure AD Connect experience, click Manage provisioning (preview).


     
  2. Click + New configuration.



  3. Click Enable to apply the configuration.



  4. Save the configuration. The AD changes are now provisioned to Azure AD every two minutes. For more guidance on how to get started, checkout the Azure AD Connect cloud provisioning tutorials.

 

Now that you’re familiar with cloud provisioning, let’s take a look at what features are currently supported.

Azure AD Connect cloud provisioning capabilities

Azure AD Connect cloud provisioning public preview supports the following capabilities:

 

To learn more, check out the Azure AD Connect cloud provisioning documentation.

Let us know what you think

We’re just getting started and would love to get your feedback on the current set of capabilities and what more you need. Please give us your feedback in our Azure AD UserVoice feedback forum or in the comments below. We look forward to hearing from you!

Best regards,

Alex Simons ( @Alex_A_Simons )

Corporate VP of Program Management

Microsoft Identity Division

Updated Jul 24, 2020
Version 7.0
Product Announcements
  • Peter Stapf's avatar
    Peter Stapf
    Brass Contributor
    Dec 06, 2019
    Great work for the early stage. I see two pain point that should be addressed very quickly in order implement that at customers: 1. Support Sync of devices, otherwise we are not able to do hybrid AAD join of devices when using PHS/SSO 2. Support writeback of passwords, otherwise we cannot user Azure SSPR which is an requirement also to go password-less a smaller pain point is the support of synchronize nested groups because lot of customer have nested groups as they followed the good old onPrem AD "rules" and do AGDLP (or AGLP) 😉
  • Ron Argame's avatar
    Ron Argame
    Copper Contributor
    Dec 05, 2019

    Can we use this as another Azure AD connect as our HA strategy?

  • Ron Argame's avatar
    Ron Argame
    Copper Contributor
    Dec 06, 2019

    Nitika Gupta  Thanks for the reply. Will there be an option to have HA on Azure AD Connect? Having 300K+ objects to sync from on premise AD to Azure AD is really a big down time if you only have one Azure AD Connect (excluding the staging).

     

    Can we replace Azure AD Connect with this?

  • Peter Stapf's avatar
    Peter Stapf
    Brass Contributor
    Dec 06, 2019

    I also get this error, but if I tried it again (save again), it worked.

  • Peter Stapf's avatar
    Peter Stapf
    Brass Contributor
    Dec 06, 2019

    Would be great to have some technical deep dive documentation on this, so mainly how does the Connector work exactly, how does (if) the connector get the config on what to do. How does it read AD data and how is that written to AAD (seams to be SCIM from the binaries I found in the install folder)

  • namor38's avatar
    namor38
    Copper Contributor
    Jan 29, 2020

    I am currently testing the installation and configuration.

     

    Install the Azure AD Connect cloud provisioning agent

    Step 8 : "On the Connect Active Directory screen, select Add Directory. Then sign in with your Active Directory administrator account. This operation adds your on-premises directory. Select Next"

     

    Question:  What are the smallest on-prem AD permissions that work? (With Password hash sync)