Azure AD test tenant

[NicolasHon]

Hello Community,

I'm stating this discussion because I likely wanted your input regarding the best way to build a test tenant in Azure.

We have a Prod tenant and for some feature testing or some wide tenant configuration changes, we wanted to have a test tenant. This test tenant need to have some users (synched from on-prem by AD Connect) and have the same configuration as our prod tenant.

Do you have any experiences, recommendations, processes in this type of configuration?

Thanks for sharing your knowledge :)

[#2]

Create an another tennant and associate a new subscription in a new Management group make sure role inherence doesn't take into affect

[#3]

This is everytime s big discussion;)
From my perspective a test tenant is needed, when you will evaluate services at Azure AD level.
It make sense to create a isolate AD domain in the same way like the production system and also use a domain name and use the same account sync solution.
When you start with a separate test tenant, please be aware of the additional management overhead and handle it like the same way as the prod system.
Define the scope and the goal for the rest tenant and who is responsible for it.

For testing Azure services they running inside subscriptions it can be a better way to use different subscriptions and group this with management groups and associate Azure policies.

[#4 · Accepted solution]

What I did is set up a parallel AD domain using our as-built documentation and then registered a new domain name used exclusively for this project. Then I created an Azure tenant with a pay-as-you-go subscription linked to a credit card. Then I used Azure AD Connect to connect the test domain with the test tenant. The AD DS domain is on a completely separate VLAN and the test tenant is completely separate from our production tenant.

What this does is keep the production environment completely separate from the test environment. I can try new things on the test domain and have a pretty good idea about how it's going to affect the production environment. The best part about this is that I can experiment with new services to deeply understand them before presenting them as potential projects. The idea is to be very thorough and build a deep understanding of a service before anyone else in the company (or our team) puts time into it.

[#5]

Thanks a lot for sharing your experience. It look to be good way to proceed and it is really close to ideas that I have in mind.
We already have a AD test domain, so we just need to add an AAD test tenant and an AD Connect to sync all testing stuffs! :)

[#6]

Another option, especially if it features testing you need to test is the M365 Developer program: https://developer.microsoft.com/en-us/microsoft-365/dev-program, you get a fully-fledged and licensed M365 environment with pre-staged users, for about 90 days but can be extended if you are continuously using it.

[#7]

Good to know. Thanks!
In my case I wanted to have a test environment that correspond to my productive tenant. So this is more than I need. But for sure this is a good point in case of need to test new stuffs :) !

[#8]

Hey Luke, if you work for a Microsoft partner, you can go to https://cdx.transform.microsoft.com/ and setup an annual tenant for testing with those same accounts. Clients can setup the same thing by registering at Fasttrack.microsoft.com and under getting started you'll see Sandbox tenant. That's the same as the dev & demo tenant with the same user personas you mentioned.

[#9]

Yes, having a separate test tenant can be useful for testing changes and new features before deploying them to production. To create a test tenant that is similar to your production tenant, you will need to set up a separate Azure AD tenant and configure it to match your production tenant as closely as possible. Here are some recommended steps to create a test tenant:

Create a separate Azure AD tenant: To create a separate Azure AD tenant, go to the Azure Portal and select the "Azure Active Directory" section. From there, you can create a new tenant by selecting "Create a tenant" and following the prompts to create a new tenant.

Configure the test tenant to match the production tenant: To make the test tenant similar to your production tenant, you will need to configure it with the same settings, policies, and permissions. This includes creating the same users and groups and configuring the same Azure AD Connect settings to sync the same users from your on-premises Active Directory. You can use Azure AD PowerShell or Azure AD Graph API to automate the creation of users, groups, and policies in the test tenant.

Here are some recommended steps to configure the test tenant:

Create the same users and groups: You can use Azure AD PowerShell or Azure AD Graph API to create the same users and groups in the test tenant as you have in your production tenant. This will ensure that the test tenant has the same user base as the production tenant.

Configure the same Azure AD Connect settings: You will need to configure Azure AD Connect to sync the same users from your on-premises Active Directory to the test tenant. This will ensure that the test tenant has the same user data as the production tenant. You can use the Azure AD Connect Configuration Wizard to configure the same settings in the test tenant.

Configure the same policies: You will need to configure the same policies in the test tenant as you have in your production tenant. This includes policies for password settings, device management, and access control. You can use Azure AD PowerShell or Azure AD Graph API to automate the creation of policies in the test tenant.

Test changes and new features in the test tenant: Once you have set up the test tenant, you can test changes and new features in the test tenant before deploying them to production. You can use the test tenant to perform functional testing, security testing, and load testing to ensure that the changes and new features work as expected.

Deploy changes and new features to production: After testing changes and new features in the test tenant, you can deploy them to production. It's important to note that any changes or new features that are deployed to production will not be reflected in the test tenant unless you manually configure them.

Keep the test tenant up-to-date: To ensure that the test tenant remains a reliable representation of the production tenant, you will need to keep it up-to-date with any changes or new features that are deployed to production. You can automate this process using Azure AD PowerShell or Azure AD Graph API to sync the changes from production to the test tenant.

Keep in mind that having a separate test tenant will incur additional costs, so you should plan and budget accordingly. Additionally, you should follow best practices for managing your test tenant, such as keeping it secure and up-to-date, to ensure that it remains an effective tool for testing changes and new features.

[#10]

Thanks a lot for your time answering my question.
This is really appreciated.

[#11]

You're very welcome! I'm glad that I could help you with your question. If you have any further questions or concerns, please don't hesitate to ask. I'm always here to assist you. Have a great day!

[#12]

Would we have access to our existing tenant licensing and MS Partner Benefits?

[#13]

Hi, I know it's been a while since you first asked this question... We recently released a training module that provides guidance on test tenants in Azure AD: https://learn.microsoft.com/training/modules/create-azure-active-directory-test-environment/
It discusses when you should use a separated tenant or a production tenant, creating test users, and creating policies to match your production environment.
Hope that helps.

[#14]

@NicolasHon 

In terms of test, would suggest creating a sandbox that is isolated enviroment with separate Domain 

[#15]

@StephenFeltmate do you know if this is possible to make without using credit card, but having azure consumption going to corporate enterprise enrollment?

[#16]

@MLoncar |
Yes, you can configure and run a sandbox test environment: 

More on that here: https://learn.microsoft.com/en-us/microsoft-365/enterprise/modern-desktop-deployment-and-management-...

 Here is the direct link : https://www.microsoft.com/en-us/evalcenter/download-lab-kit

Dont forget the download the guides too (ZIp download for lab env and guides on the page I linked above) 

Enjoy!