Hybrid IAM with O365 and AWS

[MS Expert]

Hi Team,

I have a below scenario to discuss and looking for a single IAM solution.

- Business units ( 3 :(
- A, B & C

- 200 employees in each business unit i.e around 600 users

- Users email accounts are Microsoft O365 accounts

- No local AD currently and no ADFC in place

- 3 different tenants on 0365. 1 for each business unit i.e A, B & C

- users machines are in a workgroup

- Business Applications are hosted in AWS (SaaS services mostly)

**Solution required:**

- Single IAM solution for the company as its difficult to manage and control the distributed IDs all over the place
- Machines/laptops need to be domain joined and local workgroup profiles need to me migrated to target domain

**My thought process:**
- Setup local AD from A domain/business unit (Have separate OU to manage other business units). Local AD will become single source of Identities and can be managed centrally
- Make it hybrid using Azure AD Connect. Sync IDs to O365 Azure AD tenenats with UPN
- Setup SSO using federation between AWS SaaS applications with local AD.
- Bring workgroup machines into the domain and migrate local profiles to domain profiles on the machines using 3rd party tools

**Challenges:**
- Is it possible to sync single AD source through Azure AD connect to multiple O365 Azure AD tenants (as we have 3 in the scenario)? And with UPN
- If I create new IDs in local AD and sync them, what will actually happen to the existing O365 IDs for users in Azure AD? and how these IDs will be merged as users already have an email account with emails, calendar, etc.?
- Is it possible to set up a Federation between AWS SaaS Services and local AD using ADFS or is there any way to probably create a Federation between Azure AD and AWS Saas application?

Any pointers will be helpful to achieve IAM for the above scenario

Thanks in advance

Regards,

[#2]

Hey mate,

You have an interesting scenario. I am not an SME on the subject but here are some suggestions:

Yes, you can sync a single AD source through Azure AD Connect to multiple O365 Azure AD tenants. However, each user must have a unique User Principal Name (UPN) across all the tenants. You can achieve this by using a different domain suffix for each tenant in the UPN. For example, email address removed for privacy reasons, email address removed for privacy reasons, email address removed for privacy reasons.

If you create new IDs in the local AD and sync them, existing O365 IDs for users in Azure AD will remain as they are. The new IDs will be created in Azure AD as new user accounts. If you want to merge the existing O365 IDs with the new IDs, you can use a tool like Azure AD Connect to match them based on a common attribute, such as the email address.

Yes, you can set up a federation between AWS SaaS services and local AD using ADFS. You can also use Azure AD as the identity provider for AWS SaaS applications. To achieve this, you need to configure AWS SaaS applications to trust Azure AD as the identity provider and configure Azure AD to federate with your local AD using ADFS.

I hope this helps. Let me know if you have any further questions.

Kind regards,

Luke Madden

[#3]

@MS Expert 

Yes, it is possible to synchronize a single Active Directory (AD) source through Azure AD Connect to multiple Office 365 Azure AD tenants. This is achieved by configuring Azure AD Connect to connect to each of the Azure AD tenants and selecting the relevant directory to synchronize.

When synchronizing multiple tenants with a single AD source, it is important to ensure that the user principal name (UPN) is unique across all tenants. This can be achieved by using a unique domain name for the UPN suffix in each tenant. For example, if the UPN for a user is email address removed for privacy reasons, and you have three tenants, you could configure the UPN suffixes as email address removed for privacy reasons, email address removed for privacy reasons, and email address removed for privacy reasons for each tenant respectively.

Note that when syncing multiple tenants from a single AD source, the configuration can become more complex, and careful planning and testing is required to ensure that the synchronization works as expected. 

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.