Configure Inbound Security rules for Azure AD Sync

Question

Hi There,

Currently, I'm trying to set up an inbound rule (NSG) to restrict port 443 (TCP) on the local DC to only allow traffic used to synchronize with Azure AD

However, I'm not sure how can I restrict the source based on IP range or service Tag, Does anyone have an idea?

Many Thanks,

Answer 1

Hi there,

The below article will help you out in creating an inbound security rule on network security groups.
How to open ports to a virtual machine with the Azure portal https://learn.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal

You can also achieve this by Setting up Azure App Service access restrictions. By setting up access restrictions, you can define a priority-ordered allow/deny list that controls network access to your app.

The following document is a technical reference on the required ports and protocols for implementing a hybrid identity solution. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-ports

How to configure a firewall for Active Directory domains and trusts https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts

-----------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–