Implementing Azure ADConnect in a live environment
I have been tasked with implementing Azure ADConnect for my company. We currently have 2 locally virtualized domain controllers and are already utilizing Office365 for mail. What would be the easiest way to implement ADConnect while having the least amount of downtime/user interruptions.
Issue with Azure AD Connect synchronization for DistributionGroup SamAccountName
Created new with DistributionGroup with Exchange Server 2016 CU21 using following command: New-DistributionGroup -Name "bsHyb'G7564" -DisplayName "bsHyb.G7564" -SamAccountName "bsHyb-G7564" -PrimarySmtpAddress "bsHybG7564@mydomain2345.com" Then have checked results by: Get-DistributionGroup bsHyb* | select Name, DisplayName, SamAccountName, Alias, RecipientTypeDetails, PrimarySmtpAddress, Guid, LegacyExchangeDN Name : bsHyb'G7564 DisplayName : bsHyb.G7564 SamAccountName : bsHyb-G7564 Alias : bsHyb_G7564 RecipientTypeDetails : MailUniversalDistributionGroup PrimarySmtpAddress : bsHybG7564@mydomain2345.com Guid : 73711cc8-ad1c-43cd-8747-d98095871f44 LegacyExchangeDN : /o=SourceDomain org/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=34e7147922ad4366bfff6947c209d8a7-bsHyb'G Issue that Azure AD Connect sync is auto-generating SamAccountName with o365 tenant: Get-DistributionGroup bsHyb* | Format-Table -Auto Name,DisplayName,SamAccountName,mailNickname,Alias,GroupType,RecipientTypeDetails Name : bsHyb'G7564 DisplayName : bsHyb.G7564 SamAccountName : $U1ME60-Q1PUBMRD1F98 mailNickname : Alias : bsHyb_G7564 GroupType : Universal RecipientTypeDetails : MailUniversalDistributionGroup How to sync SamAccountName?Local Network Share with Azure AD Users
We're a small business of about 15 people, and have just moved to Microsoft 365 for email, and with it has come AAD user management which makes my life simple. We have some simple file shares that are managed with local accounts. I'd like to move to on-prem AD with AAD Connect, and then assign these AAD users ("email accounts") to the various folders to handle permissions. My current understanding is that AAD cant do user write back to on-prem, at all, and doing password and group writeback to on-prem requires the 'premium' tier of AAD, at $8/user/mo? This seems both very convoluted (I am doing up a PS script to pull users back from AAD) and also incredibly expensive to simple have AAD users assigned to on-prem file shares. I'm hoping occam's razor applies here, and I've missed something simple?
Azure AD Design
Hi, I'm trying to learn as much as I can about Azure AD design and I want to make sure I am thinking/approaching the topic correctly. When it comes to AAD design I didn't find anything specific using those terms and I'm trying to make sure I am covering everything. I read the topologies for AD connect https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies. I'm familiar with on prem AD design. Is there anything else I should consider for AAD Design? thank you, -PD
Azure AD Connect in Multi-forest scenerio
Hi Team, Running through an curious implementation in development infra. i have a M365 tenant and two on-prem directory forest abc.com and xyz.com. i want to sync both directory to M365 tenant and use pass through authentication. so far good for implementing first forest - abc.com (where i have installed AAD connect and configured both forest abc.com and xyz.com to sync to azure ad) now when i access any application for abc.com user its authenticating without any issue but when i do access any apps using xyz.com it doesn't authenticate. for more information - i have done nothing in respect to AAD connect configuration on xyz.com (assuming it must have taken care while running wizard) and there is no forest trust or anything between both forest. what i am missing here, quick answer is really appreciated. Thank you Please feel free to ask any information regarding the same.Azure AD Connect in Multi-forest scenerio
Hi Team, Running through an curious implementation in development infra. i have a M365 tenant and two on-prem directory forest abc.com and xyz.com. i want to sync both directory to M365 tenant and use pass through authentication. so far good for implementing first forest - abc.com (where i have installed AAD connect and configured both forest abc.com and xyz.com to sync to azure ad) now when i access any application for abc.com user its authenticating without any issue but when i do access any apps using xyz.com it doesn't authenticate. for more information - i have done nothing in respect to AAD connect configuration on xyz.com (assuming it must have taken care while running wizard) and there is no forest trust or anything between both forest. what i am missing here, quick answer is really appreciated. Thank you Please feel free to ask any information regarding the same.
