SOLVED

Office 365 authentication with single tenant and multiple forests without AD trusts

%3CLINGO-SUB%20id%3D%22lingo-sub-165683%22%20slang%3D%22en-US%22%3EOffice%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165683%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EWe%20have%20the%20following%20situation%3A%3C%2FP%3E%0A%3CP%3E-%203%20dedicated%20forests%3C%2FP%3E%0A%3CP%3E-%201%20Office%20365%20tenant%3C%2FP%3E%0A%3CP%3E-%20AD%20trusts%20are%20not%20possible%20because%20of%20duplicated%20NETBIOS%20names%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20know%20that%20we%20can%20use%20Azure%20AD%20Connect%20(1%20instance)%20for%20alle%203%20domains%20without%20trusts%20but%20what%20is%20about%20authentication%3F%20As%20far%20as%20I%20know%20AD%20FS%20and%20Pass-Through%20Authentication%20need%20AD%20trusts%20between%20the%20forests%3F%20What%20possible%20authentication%20scenarios%20are%20available%20for%20that%20environment%20(without%20AD%20trusts)%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EKind%20regards%3CBR%20%2F%3EPatrick%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-165683%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eadfs%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAuthentication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMulti-Forest%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPass-Through%20Authentication%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165755%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165755%22%20slang%3D%22en-US%22%3Enow%20i%20got%20it.%20thanks.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165733%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165733%22%20slang%3D%22en-US%22%3E%3CP%3Ethe%20article%20is%20just%20a%20guide%20for%20single%20ADFS%20farm%2C%20you%20will%20have%20to%20perform%20those%20steps%20in%20your%20multiple%20ADFS%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165728%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165728%22%20slang%3D%22en-US%22%3E%3CP%3EYeay%2C%20i%20understand%20that%20but%20I%20dont%20understand%20the%20context%20to%20the%20article%20you%20posted%20because%20its%20about%20multiple%20root-level-domains%20with%20ADFS.%20There%20is%20no%20info%20if%20it%20relevant%20for%20one%20ADFS%20farm%20and%20trusts%20or%20multiple%20ADFS%20farms%20without%20trusts.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EKind%20regards%3C%2FP%3E%0A%3CP%3EPatrick%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165719%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165719%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20want%20federation%2C%20you%20need%20ADFS%2C%20but%20you%20have%20several%20forests%20with%20no%20trusts%20between%20them%2C%20that's%20why%20you%20need%20separate%20ADFS%20for%20each%20forest.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165717%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165717%22%20slang%3D%22en-US%22%3E%3CP%3EOk%20thanks.%20Than%20we%20have%20to%20use%20password%20sync%20but%20I%20think%20this%20is%20not%20an%20option.%20Than%20ADFS%20is%20the%20only%20option.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20thought%20the%20article%20you%20posted%20was%20just%20about%20setting%20up%20different%20top-level%20domains%20(or%20sub-domains).%20But%20that%20doesn't%20say%20anything%20about%20multiple%20ADFS%20servers%20in%20different%20forests%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EKind%20regards%3C%2FP%3E%0A%3CP%3EPatrick%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165714%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165714%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20could%20try%20Seamless%20Single%20Sign-On%20with%20a%20different%20authentication%20method%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fconnect%2Factive-directory-aadconnect-sso%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fconnect%2Factive-directory-aadconnect-sso%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165710%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165710%22%20slang%3D%22en-US%22%3E%3CP%3ENo%2C%20sorry.%20Pass-through%20authentication%20requires%20Trust%20between%20your%20forests.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165702%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165702%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EThanks%20for%20your%20reply.%20That%20sounds%20good.%20Do%20you%20know%20if%20it%20is%20also%20working%20with%20Pass-Through%20Authentication%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EKind%20regards%3C%2FP%3E%0A%3CP%3EPatrick%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-165696%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20authentication%20with%20single%20tenant%20and%20multiple%20forests%20without%20AD%20trusts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-165696%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20cannot%20establish%20trusts%20between%20your%20forests%20then%20you%20will%20have%20to%20federate%20them%20separately%2C%20deploying%20different%20ADFS%20for%20each%20forest.%20After%20that%20you%20can%20establish%20different%20trusts%20with%20Azure%20AD%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fconnect%2Factive-directory-aadconnect-multiple-domains%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fconnect%2Factive-directory-aadconnect-multiple-domains%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Hi,

We have the following situation:

- 3 dedicated forests

- 1 Office 365 tenant

- AD trusts are not possible because of duplicated NETBIOS names

 

I know that we can use Azure AD Connect (1 instance) for alle 3 domains without trusts but what is about authentication? As far as I know AD FS and Pass-Through Authentication need AD trusts between the forests? What possible authentication scenarios are available for that environment (without AD trusts)?

 

Kind regards
Patrick

9 Replies
Highlighted
Solution

If you cannot establish trusts between your forests then you will have to federate them separately, deploying different ADFS for each forest. After that you can establish different trusts with Azure AD:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-multiple...

Highlighted

Hi,

Thanks for your reply. That sounds good. Do you know if it is also working with Pass-Through Authentication?

 

Kind regards

Patrick

Highlighted

No, sorry. Pass-through authentication requires Trust between your forests.

Highlighted
Highlighted

Ok thanks. Than we have to use password sync but I think this is not an option. Than ADFS is the only option.

 

I thought the article you posted was just about setting up different top-level domains (or sub-domains). But that doesn't say anything about multiple ADFS servers in different forests?

 

Kind regards

Patrick

Highlighted

If you want federation, you need ADFS, but you have several forests with no trusts between them, that's why you need separate ADFS for each forest.

Highlighted

Yeay, i understand that but I dont understand the context to the article you posted because its about multiple root-level-domains with ADFS. There is no info if it relevant for one ADFS farm and trusts or multiple ADFS farms without trusts.

 

Kind regards

Patrick

Highlighted

the article is just a guide for single ADFS farm, you will have to perform those steps in your multiple ADFS

Highlighted