Installing and Configuring Azure Active Directory Connect

Real-world use case

You need to sync your on-premises AD with Azure AD: here's how to install and configure Azure AD Connect.

Table of contents

• Azure Active Directory
• Installing Azure Active Directory Connect

Azure Active Directory

Service platforms now act as an extension of the information system. Many of them are becoming increasingly sophisticated and are true service orchestrators. The Azure platform enables interoperability and management of Microsoft's existing systems and software. Let's discover how to use the Azure Active Directory service by syncing our Active Directory.

Getting started with Azure AD integration

1. Sign up on the Azure platform (registration is free): Azure Microsoft Sign-up.
2. You need to verify your domain (e.g., kassianoff.fr) for Azure AD: domain verification.
3. An Azure AD tenant supports 50,000 objects. If you verify your domain, the limit goes up to 300,000 objects.
4. The Active Directory schema and forest functional level must be at least version 2003.
5. The domain controller must be at least version 2008 to use password writeback.
6. Check the consistency of your Active Directory: UPN, attributes (essential O365 recommendation).
7. The domain controller used by Azure AD must be writable.
8. Using forests/domains with dotted NetBIOS names is not supported.
9. It's recommended to enable the Active Directory Recycle Bin.
10. You can't install Azure AD Connect on SBS or on Windows Server Essentials versions earlier than 2019.
11. The agent (the so-called Azure AD Connect server) can only be installed on a graphical user interface.
12. Azure AD Connect must be installed on Windows Server 2008 R2 or later. This server must be joined to a domain and can be a domain controller (not recommended) or a member server (recommended).
13. .NET Framework 4.5.1 (or later) and Microsoft PowerShell 3.0 (or later) must be installed on the Azure AD Connect server.
14. The Azure AD global admin account for the Azure AD tenant must be a school or organizational account, not a Microsoft account.

More information on the prerequisites:
https://docs.microsoft.com/fr-fr/azure/active-directory/hybrid/how-to-connect-install-prerequisites

Installing Azure Active Directory Connect

I'm working on a 2012 R2 member server; I've verified my domain and added and modified my UPNs in my AD directory.
I'm now ready to go through the installation steps one by one. To start the installation, you need to download Microsoft Azure Active Directory Connect: https://www.microsoft.com/en-us/download/details.aspx?id=47594

The installation is fairly quick, here are the step-by-step details:

The terms of use for the Azure AD Connect service:

The tool detects the existing local domain and lets us know about it (highlighted in red):

We use the quick configuration, and add our Azure account (Azure Active Directory):

We now connect our local domain account, a member of the Enterprise Admins group:

The next step checks the local domain information to sync it with AD Connect:

Once the configuration is complete, the sync is in progress:

To do this, we need to launch the tool again: AD Connect, then click Configure, then Customize synchronization options:

We'll start our change by choosing our forest:

Next, we simply select the OUs to sync:

The optional features are displayed; for my part, I leave the default choice, which is free:

The configuration is ready to update the connector:

Once validation is complete, the sync is in progress:

The resulting difference is visible on the Azure platform:

Our local domain is now synced with Azure Active Directory.

Conclusion