Clarification on Password Writeback

[user456902]

HI,

So I'm trying to get a better understanding of SSPR and Password Writeback, spceficically if there is any failover recommendations similar to running three agents for Pass-through Authentication.

It is my understanding that Password Writeback is ran as a service bus relay in the Azure AD tenant. Does this use WCF under the hood somehow? I wasn't able to find the "PasswordResetService" in my services window like I can the pass-through Authentication agent service.

If it uses WCF, how does that work, and how is reliability taken into consideration? Does the reset service run in the cloud somehow, and only the AD Sync service on the on-prem server get the messages? What happens if that on-prem server goes down, does password writeback still work?

Thank you!

[#2]

Hi,
from my perspective, the password will be changed in the Azure AD and this inform the Azure AD Connect service about the password change. The AAD connect inform the DC about the password change. When the AAD connect isn't available, the password cannot write back to the domain. The service needs AAD connect.

[#3 · Accepted solution]

Azure Active Directory (Azure AD) self-service password reset (SSPR) lets users reset their passwords in the cloud, Password writeback is a feature enabled with Azure AD Connect that allows password changes in the cloud to be written back to an existing on-premises directory in real-time.

Password Writeback will support below cloud authentication method-

1) Password Hash synchronization (PHS)
2) Password through Authentication (PTA)
3) ADFS

Once the Password wite back feature is enabled, the sync engine calls the writeback library to perform the configuration (onboarding) by communicating to the cloud onboarding service. Any errors encountered during onboarding or while starting the Windows Communication Foundation (WCF) endpoint for password writeback results in errors in the event log, on your Azure AD Connect the machine

[#4]

@SeshadrrThank you! That clarifies a lot for me. I understand now that the writeback service runs in the cloud as a WCF service. That was the main point of clarification I was looking for.