Azure AD Connect Permissions

Question

Hello Team,

Could you please confirm, if the Azure AD Connect Service Account created on AD On-premise need to be Domain Admin to be used for the sync between AD On-prem and Entra ID (Azure AD)?

Or just needed during the installation? After that, can be removed from Domain Admin group? If so, what permissions need to be added to this service account?

Thank you very much.

Answer 1

Hi @Pedro Osório ,

the accounts and permissions used by Azure Entra Connect are listed here:

Accounts used for Microsoft Entra Connect

There is a difference for installation and sync tasks of Azure Entra Connect.

AD DS Connector account: Used to read and write information to Windows Server AD by using Active Directory Domain Services (AD DS)

AD DS Enterprise Administrator account: Optionally used to create the required AD DS Connector account

For the sync task of Azure Entra Connect you need the permission to read and write in your on-premises AD. That doesn't mean an on-premises Domain Admin is required.

---

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Answer 2

Hi @Pedro Osório •

You don't to need to use a domain admin account when you install Entra connect service.

You can prepare create the service account and use a Powershell command as described in the article below:

Microsoft Entra Connect: Configure AD DS Connector Account Permissions

---

Please don't forget to accept helpful answer