Azure AD Connect setup Questions

Question

Azure AD Connect setup Questions

Mike Murphy 41

Hello Everyone,
This is my first attempt at trying to do an Azure AD Connect sync and I'm not sure if i'm failing miserably or just not gone far enough.

First, I need to confirm a couple things;

Azure AD Connect is a "one way" sync (as long as write back is off) correct? If I just wholesale delete the azure domain, nothing happens to my on prem domain, is that right?

2) I think I created problems by adding a second custom domain to a single tenant that was already setup for about 70 office 365 users. Is this okay or should I have created a second tenant?

Background:

We need to configure this because a 3rd party application uses this method to authenticate its user base. They told us to follow this doc:
https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-password-hash-sync

After reviewing a couple docs it wasn't clear to me to create a second tenant, because I thought I read you can have only one tenant per subscription. Whoever set up the initial domain and added the first custom name set up the office 365. My intent was to create a second custom domain name and set it to primary in the same tenant with our actual full domain name. I setup a server and installed the Azure AD Connect tool to it. The domain was verified and the sync completed successfully, however, it appears accounts that were associated with the original custom office 365 domain can no longer authenticate to azure portal, The accounts from the new synced domain can not auth either. It looks like that's because the idenity issuer is the default domain name and not the actual domain name that was synced. so if I do a test login to the portal, ******@ourdomain.com does not work, but mike@azure .defaultdomain.com does.

Any guidance here is much appreciated.

Mike Murphy 41 Reputation points

2021-01-12T00:26:38.887+00:00

A third question would be ; what does changing the primary domain do within a tenant? I assumed I needed to change the primary domain to the one I wanted to sync, which I did but I don't know what effects positive or negative that had.

Accepted answer

0 additional answers

Your answer

Mike Murphy 41 Reputation points

2021-01-12T00:26:38.887+00:00

A third question would be ; what does changing the primary domain do within a tenant? I assumed I needed to change the primary domain to the one I wanted to sync, which I did but I don't know what effects positive or negative that had.

Answer 1

Marilee Turscak-MSFT 37,206 Microsoft Employee Moderator

Yes. User writeback is not possible with Azure AD. You can write back groups and passwords if you set those up, but the users can only sync from on-premises to Azure AD and not the other way around.
It depends on your use case. It is possible to have multiple domains in a single tenant but having more than one Azure AD Connect sync server connected to a single Azure AD tenant is not supported. Refer to multiple-forests-multiple-sync-servers-to-one-azure-ad-tenant for more details.

Since there can be only one Azure AD Connect instance for a single Azure tenant you would have to use one AAD Connect instance for all of the users if you want to have a single tenant. If all of these users are from the same company that shouldn't be a problem, but if they are from different companies or organizations I would not recommend it as they would share the same tenant.

Azure AD Connect does support connecting multiple forests to a single Azure AD tenant.

https://learn.microsoft.com/en-us/azure/active-directory/cloud-provisioning/what-is-cloud-provisioning

Mike Murphy 41 Reputation points

2021-01-12T16:19:06.15+00:00

Thanks for responding;

This is one school district with a single forest and a single domain. I believe the initial domain was set up manually with only 70 users for Office 365 licenses. The domain was created to match the email address format of the district, so that anyone attempting to log into the portal in that group should have authenticated. I then went into the same temant and created a custom domain that actually matches our actual Active Directory domain name. I then installed Azure AD Connect on a dedicated server and once the config tool fount the newly created domain, The tool indicated it setup successfully.

The problem now is that you can not authenticate to the portal using the actual domain name, or the original manually created domain. It only authenticates to the made up Microsoft domain name. I'm wondering if I should stop the sync, and delete the domain and start over.

Share via

Azure AD Connect setup Questions

0 additional answers

Your answer