Can the Azure AD Provisioning Service and Azure AD Connect Provisioning Agent provision to multiple ACtive Directory domains and forests?

Question

I recall some presentation from earlier in 2022 related to the SAP SuccessFactors to Active Directory provisioning solution would support multiple on-premises Active Directory domains and forests. However, when viewing the currently available documentation at https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-tutorial and https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/workday-inbound-tutorial , it appears that the agent can only be configured to a single domain endpoint.

Answer 1

Hello @Michael Liben ,

Thank you for the information provided, the success factors integration does allow to sync to multiple on-premises domains, the information on the specific multiple-forest topologies supported can be found on this link: https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/plan-cloud-hr-provision#single-cloud-hr-app-tenant---target-single-or-multiple-active-directory-child-domains-in-a-trusted-forest

For disjointed domains you can configure separate provisioning agent groups for each specific forest. As shown below:

Another option is to configure separate apps to provision distinct user sets from Cloud HR to multiple on-premises Active Directory domains:

Please let me know if the document provided includes the topology you're interested in and I'll gladly assist reviewing other questions you may have.

-Jessie

Answer 2

Hi @Michael Liben ,

From description above, I could understand that you are looking for AAD provisioning agent supported topology (please correct me if this is not the case).

As per https://learn.microsoft.com/en-us/azure/active-directory/cloud-sync/plan-cloud-sync-topologies the given topologies are supported and would be following for user provisioning.

• Single forest, single Azure AD tenant
• Multi-forest, single Azure AD tenant
• Existing forest with Azure AD Connect, new forest with cloud Provisioning
• Piloting Azure AD Connect cloud sync in an existing hybrid AD forest

Ref: https://learn.microsoft.com/en-us/azure/active-directory/cloud-sync/tutorial-existing-forest

Note: Please do accept the answer and rate your experience if the above-mentioned suggestion works as per your business need.