What happens when I put an Azure AD Connect staging server to the master, if it has no PTA Auth Agent installed?

Daniel Niccoli 196 Reputation points
2020-10-01T16:05:28.35+00:00

We use hybrid identity. We are planning to moving to the following topology:

Server 1: Azure AD Connect (master) + Azure AD Connect PTA Agent
Server 2: Azure AD Connect (staging)
Server 3: Azure AD Connect PTA Agent
Server 4: Azure AD Connect PTA Agent

Unfortunately, we must install the first PTA Agent on Server1. Separating those roles is not supported.

What happens if we must swap AAD Connect master and staging server? Will this break the topology, because now the AAD Connect master does not run a PTA Agent?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
    2020-10-01T16:15:38.513+00:00

    You can and should install additional agents on other servers other than on the AADConnect server, so there is no relationship between the AADConnect server that is set as "primary" and the ability to for the agent to work

    https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start#step-4-ensure-high-availability

    1 person found this answer helpful.

  2. Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
    2020-10-01T17:06:15.023+00:00

    The doc says the first installation of the agent has to be on an AADConnect server, it doesn't say it has to be installed on which ever one is the "Primary" server.

    That's the way I read it and since you can install the agents on any server after that, that tells me its not required to be installed on the AADConnect server doing the exports.

    I

    1 person found this answer helpful.
    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.