This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 33%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBZ%3C/text%3E%3C/svg%3E)
Hi, we have the following infrastructure - 3 on-prem AD forests isolated to one another (no forest trust) with one of them synced to Entra ID tenant (Windows 11 devices are Entra Hybrid Joined). Plan is to decommission that forest and leave Windows 11 devices "only" Entra Joined.
Is it technically feasible to "sync" other 2 AD forests to existing Entra ID tenant and use cloud-only accounts in Entra ID (previously synced from decommissioned on-prem AD forest) to access resources in these 2 AD forests (accounts must exist in both AD forests but with the same UPN? - what about passwords then)? Also, how Entra Private Access fits here (accessing resources in both AD forests from our Entra Joined Windows 11 devices without VPN), is that feasible as well?
Depending on answer, I might have more questions.
A cloud-based identity and access management service for securing user authentication and resource access
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Yes, you can sync multiple AD forests even if there is no trust to one Entra ID tenant using Azure AD Connect. Ensure users have the same UPN across forests to match identities correctly.
After decommissioning the current forest, users can stay as cloud-only in Entra ID. To access resources in the other forests, create matching AD accounts with the same UPN. Passwords won’t sync unless you enable password hash sync or writeback.
To avoid VPN, use Entra Private Access with connector agents in each forest. This lets Entra-joined Windows 11 devices securely access internal apps with Conditional Access and MFA.
You can also have Entra connect installed in one AD forest and the other AD forests use Cloud Sync and all sync into one tenant.
If I got it right:
Yes, you are right, you can set up just one Azure AD Connect on a server that can reach both forests or you can install a separate copy in each forest (in standby mode) if one server can’t access both. The forests don’t need to trust each other, but the server must be able to connect to each forest over the network.
So, everything I wrote (5 counts) is correct?
Ya but remember there is one limitation, as you have two user accounts (in both forests) and they are linked to one Entra ID account, only one of them can receive password writeback.
refer: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback
However, even with password writeback enabled to only one AD user object, you will have a single user identity in Entra ID that can be used to access resources in both on-prem AD forests through Entra Private Access. This works because Entra Private Access relies on the cloud identity and can map it to on-prem AD accounts via UPN, not passwords.
references:
Hi Bojan Zivkovic,
Just following up to see if the above comment is helpful. If you have any queries, please do let me know.
One important thing though (as a result of what you wrote above) - any password changes on-prem (in one of these 2 AD forests) would be immediately replicated to Entra ID, changing password of cloud-only user account as well, whereas password in other AD forest would not be changed.
This is a bit awkward definitely - not being able to change passwords in all locations from a single pane of glass (preferably Entra ID) but being able to use Entra ID account with Entra Private Access to access AD forest resources although its password is different than password of "corresponding" AD user in one of these 2 AD forests where password writeback won't work.
Yes, it's a bit of a limitation users will have one Entra ID account, but the password will only be updated in one forest. The other forest's AD account will keep the old password unless changed separately.