Provision user accounts from Azure Active Directory to local Active Directory

Question

Provision user accounts from Azure Active Directory to local Active Directory

Tor André Solbakken 45

Hi All,

I have been banging my head for many days now and can't find a solution.

What we want to achieve is the possibility to provision users from Azure AD to local Active Directory.

We need a tool/service/App or whatever that can take all the user accounts that exist in our tenant and provision those users to the local Active Directory, new users will never be created locally (but we will soft match those who already exist).

Azure AD Connect, Azure AD Cloud sync will not work for the provisioning part, maybe we will use those later to delete the cloud user, but if Azure AD can be the big boss that is the preferred approach.

The reason why we need local AD is because we already have a lot of apps/files etc that is not in scope for the project, maybe it can be in another project later.

I had a look at https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/sync-scim , maybe this can work, but I am not sure, and it is time consuming to read a lot and find out that this is the wrong approach.

What about MIM 2016 (extended support to 2029) can that software achieve this?

Danny Zollner 10,801 Reputation points Microsoft Employee Moderator

2023-03-09T14:30:10.38+00:00

From the first few lines of the documentation Sreejukg linked:

Provisioning users into Active Directory Domain Services through this solution is not supported.
Sreeju Nair 12,666 Reputation points

2023-03-09T15:33:20.4666667+00:00

Azure AD support provisioning users into LDAP directories, and using this feature you will be able to provision users from Azure AD to On Prem AD.

Refer the following Video and see whether it helps.

https://youtu.be/QdfdpaFolys

For more information read

https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/on-premises-ldap-connector-configure
Sreeju Nair 12,666 Reputation points

2023-03-09T18:37:54.8866667+00:00

Danny Zollner - Yes. I missed that part. Thank you for pointing out.
Noel Simela 0 Reputation points

2023-09-17T14:49:13.27+00:00

Microsoft should seriously consider addressing this requirement out of the box. I had a similar requirement in 2019, My solution was based on the referred below link, however, you will be forced to prompt existing users on 365 to update their passwords from the default. https://scatteredtech.com/2019/05/01/syncing-existing-office-365-users-to-newly-created-ad-domain/

1 answer

Your answer

Danny Zollner 10,801 Reputation points Microsoft Employee Moderator

2023-03-09T14:30:10.38+00:00

From the first few lines of the documentation Sreejukg linked:

Provisioning users into Active Directory Domain Services through this solution is not supported.
Sreeju Nair 12,666 Reputation points

2023-03-09T15:33:20.4666667+00:00

Azure AD support provisioning users into LDAP directories, and using this feature you will be able to provision users from Azure AD to On Prem AD.

Refer the following Video and see whether it helps.

https://youtu.be/QdfdpaFolys

For more information read

https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/on-premises-ldap-connector-configure
Sreeju Nair 12,666 Reputation points

2023-03-09T18:37:54.8866667+00:00

Danny Zollner - Yes. I missed that part. Thank you for pointing out.
Noel Simela 0 Reputation points

2023-09-17T14:49:13.27+00:00

Microsoft should seriously consider addressing this requirement out of the box. I had a similar requirement in 2019, My solution was based on the referred below link, however, you will be forced to prompt existing users on 365 to update their passwords from the default. https://scatteredtech.com/2019/05/01/syncing-existing-office-365-users-to-newly-created-ad-domain/

Answer 1

Danny Zollner 10,801 Microsoft Employee Moderator

There isn't a Microsoft-provided solution to this at this time. It is recommended to create accounts in on-premises AD first and have them sync to Azure AD. For the current set of users you have, I'd recommend using PowerShell or some other scripting language to pull the list of them and then use that data as a seed to create any accounts missing in on-prem AD.

Standing up MIM to do this sort of backsync from AAD -> AD also is not recommended.

Another alternative, depending on the exact footprint of your tech that is reliant on on-prem AD, would be to use Azure AD Domain Services, which is a managed ADDS instance where user objects are synced from AAD -> AADDS. AADDS can be joined by servers requiring legacy/on-prem auth protocols like LDAP, NTLM and Kerberos, and potentially to file servers as well. I'm not as familiar with the file server scenario with AADDS, so I'd recommend looking into documentation on that one.

Tor André Solbakken 45 Reputation points

2023-03-10T07:09:34.1733333+00:00

Thank you for the feedback, I will rethink the approach a little and see if there exist any showstoppers for using Azure AD Domain Services.

But what about the SCIM process, this is an open standard and not a Microsoft product, can this be a possible route? I don't find a lot of documentation about this, sees like a custom setup.

I have previously setup Apple Business Manager (Enterprise APP) to provision users to Intune/Azure AD, but then again I assume apple and Microsoft collaborated to develop the implementation between the 2 environments.
Tor André Solbakken 45 Reputation points

2023-03-21T09:21:42.6766667+00:00

Hi again,

I did read about this and saw that user accounts will be synchronized from AAD to AAD DS, will that also work on guest users so that they also will be synchronized?

Does it matter if the guest user have membertype = guest vs member?

Share via

Provision user accounts from Azure Active Directory to local Active Directory

1 answer

Your answer