How To Add Trust for Azure AD or Azure AD DS to on-prem AD

Zack W 41 Reputation points
2022-05-04T18:32:56.33+00:00

We have a bunch of Azure users that need access to on-prem AD resources.
I.e. we want user@mathieu.company .com to be able to access company.local resources without a separate company\user login.

Both our Azure AD and our on-prem are stable and I would like to avoid combining them with Azure AD Connect. Doubly so because we're planning on phasing out on-prem entirely within the next couple of years and it seems like there isn't an option to make Azure the master instead of on-prem. It seemed like the requirement was very simple, but I'm having a tough time creating an architecture in which our on-prem trusts Azure users.

I thought Azure AD DS would solve this because it creates a separate domain that our Azure users are automatically synced to, which could then be trusted by our on-prem.

This article
https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/
mentions creating an Azure AD DS domain and joining it to an on prem forest. Linked to this architecture: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain

The first article also recommends creating a separate forest and letting on prem forest trust the Azure AD DS forest: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-forest

However, digging deeper into these resources, they usually all discuss your Azure AD DS forest having a one-way outbound trust to the on-prem AD. I believe I would need the opposite (a one-way inbound trust to the on-prem). Is there a stable and reliable way to trust my Azure domain so I can let these cloud-only users access on-prem AD resources?

Microsoft Entra
{count} votes

1 answer

Sort by: Most helpful
  1. Mohammad Abu-Zaid 0 Reputation points
    2023-09-16T14:47:55.3366667+00:00

    It looks like that AADDS supports only outbound trusts. You can't have AADDS users access on-prem resources.

    0 comments No comments