How To Add Trust for Azure AD or Azure AD DS to on-prem AD

Zack W 41 Reputation points

We have a bunch of Azure users that need access to on-prem AD resources.
I.e. we want .com to be able to access company.local resources without a separate company\user login.

Both our Azure AD and our on-prem are stable and I would like to avoid combining them with Azure AD Connect. Doubly so because we're planning on phasing out on-prem entirely within the next couple of years and it seems like there isn't an option to make Azure the master instead of on-prem. It seemed like the requirement was very simple, but I'm having a tough time creating an architecture in which our on-prem trusts Azure users.

I thought Azure AD DS would solve this because it creates a separate domain that our Azure users are automatically synced to, which could then be trusted by our on-prem.

This article
mentions creating an Azure AD DS domain and joining it to an on prem forest. Linked to this architecture:

The first article also recommends creating a separate forest and letting on prem forest trust the Azure AD DS forest:

However, digging deeper into these resources, they usually all discuss your Azure AD DS forest having a one-way outbound trust to the on-prem AD. I believe I would need the opposite (a one-way inbound trust to the on-prem). Is there a stable and reliable way to trust my Azure domain so I can let these cloud-only users access on-prem AD resources?

Microsoft Entra
{count} votes

1 answer

Sort by: Most helpful
  1. Mohammad Abu-Zaid 0 Reputation points

    It looks like that AADDS supports only outbound trusts. You can't have AADDS users access on-prem resources.

    0 comments No comments