Office 365 authentication with single tenant and multiple forests without AD trusts

[Patrick B]

Hi,

We have the following situation:

- 3 dedicated forests

- 1 Office 365 tenant

- AD trusts are not possible because of duplicated NETBIOS names

I know that we can use Azure AD Connect (1 instance) for alle 3 domains without trusts but what is about authentication? As far as I know AD FS and Pass-Through Authentication need AD trusts between the forests? What possible authentication scenarios are available for that environment (without AD trusts)?

Kind regards
Patrick

[#2 · Accepted solution]

If you cannot establish trusts between your forests then you will have to federate them separately, deploying different ADFS for each forest. After that you can establish different trusts with Azure AD:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-multiple...

[#3]

Hi,

Thanks for your reply. That sounds good. Do you know if it is also working with Pass-Through Authentication?

Kind regards

Patrick

[#4]

No, sorry. Pass-through authentication requires Trust between your forests.

[#5]

You could try Seamless Single Sign-On with a different authentication method

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso

[#6]

Ok thanks. Than we have to use password sync but I think this is not an option. Than ADFS is the only option.

I thought the article you posted was just about setting up different top-level domains (or sub-domains). But that doesn't say anything about multiple ADFS servers in different forests?

Kind regards

Patrick

[#7]

If you want federation, you need ADFS, but you have several forests with no trusts between them, that's why you need separate ADFS for each forest.

[#8]

Yeay, i understand that but I dont understand the context to the article you posted because its about multiple root-level-domains with ADFS. There is no info if it relevant for one ADFS farm and trusts or multiple ADFS farms without trusts.

Kind regards

Patrick

[#9]

the article is just a guide for single ADFS farm, you will have to perform those steps in your multiple ADFS

[#10]

now i got it. thanks.