What are the best options, ADMT or MIM Sync, for password synchronization in a live production environment?

Question

Hi,

I just want to know what will be the best to use, either ADMT or MIM Sync, for password synchronization in a live production environment with two different forest/tenants. And are there any security changes there?

Answer 1

Hello Khushboo Kumari,

Thank you for posting in Q&A forum.

ADMT is a tool dedicated to Active Directory (AD) domain migration, including the migration of users, groups, computers, and other objects, as well as associated password synchronization. In cross-forest password synchronization scenarios, ADMT is often used to migrate passwords in bulk at one time or at regular intervals, especially when doing a migration project for an entire domain or a subset of users.

MIM is a comprehensive identity and access management solution that provides more advanced synchronization, management, and automation capabilities, including real-time password synchronization. In cross-forest or cross-tenant scenarios, MIM is often used as part of an enterprise-grade identity management system to continuously synchronize passwords and other identity information in real time.

Best Practices:

If your scenario is primarily a one-time or recurring domain migration project that doesn't require real-time password synchronization, password migration with ADMT may be a better fit. In this case, the security changes are mainly focused on encryption key management, network isolation, and account permission control during migration.

If you need long-term, real-time password synchronization between two forests or tenants to support day-to-day business operations and user experience, then password synchronization with MIM is a better fit.

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.