You can and should install additional agents on other servers other than on the AADConnect server, so there is no relationship between the AADConnect server that is set as "primary" and the ability to for the agent to work
What happens when I put an Azure AD Connect staging server to the master, if it has no PTA Auth Agent installed?

We use hybrid identity. We are planning to moving to the following topology:
Server 1: Azure AD Connect (master) + Azure AD Connect PTA Agent
Server 2: Azure AD Connect (staging)
Server 3: Azure AD Connect PTA Agent
Server 4: Azure AD Connect PTA Agent
Unfortunately, we must install the first PTA Agent on Server1. Separating those roles is not supported.
What happens if we must swap AAD Connect master and staging server? Will this break the topology, because now the AAD Connect master does not run a PTA Agent?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
2 answers
Sort by: Most helpful
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2020-10-01T16:15:38.513+00:00 -
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2020-10-01T17:06:15.023+00:00 The doc says the first installation of the agent has to be on an AADConnect server, it doesn't say it has to be installed on which ever one is the "Primary" server.
That's the way I read it and since you can install the agents on any server after that, that tells me its not required to be installed on the AADConnect server doing the exports.
I