1. Directory Synchronization in Office 365
Bill Fiddes | Learning and Development Specialist
Rob Latino | Program Manager in Office 365 Support

2. Meet Bill Fiddes Learning & Development Specialist
Customer Support Services
Been with Microsoft for 7 years
“Professionally” in the computer industry for 10 years
Focus on Customer Support Readiness for Azure Active Directory and Office 365 Identity
Wife and three children living in Maple Valley, WA

3. Meet Rob Latino
Program Manager in Office 365 Support organization for over 4 years
Certified in Office 365 Administration
Involved in the Office 365 community and technical content management

4. Course Topics Directory Synchronization in Office 365
01 | What is Azure Active Directory?
06 | Hard and Soft User ID Matching
02 | Directory Synchronization Overview
07 | Configuring Alternate User ID
03 | Directory Synchronization Scenarios
08 | Configure Filtering
04 | Directory Synchronization Tool Comparison
09 | Azure Active Directory Subscriptions
05 | Source of Authority

5. Setting Expectations
This is for admins who want to do more advanced configuration options with directory synchronization
Changing source of authority
Mapping existing cloud users to local users
Signing in with something other than UPN
Syncing some objects instead of all objects
Extra value with Azure Active Directory subscriptions

6. Join the MVA Community! Microsoft Virtual Academy
Free online learning tailored for IT Pros and Developers
Over 2M registered users
Up-to-date, relevant training on variety of Microsoft products
“Earn while you learn!”
Get 50 MVA Points for this event!
C.O.

7. 01 | What is Azure Active Directory?

8. What is Azure AD and what does it have to do with me?
Azure Active Directory provides identity management and access control capabilities for cloud services such as Office 365.
Azure AD capabilities include a cloud-based store for directory data and a core set of identity services, including user logon processes, authentication services, and Federation Services.
The identity services that are included with Azure AD easily integrate with your on-premises Active Directory deployments and fully support third-party identity providers.

9. 02 | Directory Synchronization Overview

10. Directory Synchronization Overview
7/28/2018
Directory Synchronization Overview
Synchronize your directory to the Microsoft Cloud Services
Synchronizes users, passwords, security groups, distribution lists, contacts, and conference rooms.
Enables unified Global Address List with Exchange Online
Enables Exchange Hybrid and synchronizes some Exchange Online attributes back to on-premises
Synchronize passwords back to on-premises
Synchronization occurs every 3 hours
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Directory Synchronization Overview - continued
7/28/2018
Directory Synchronization Overview - continued
Synchronize from single or multiple forests
Directory Quota limits
Up to 50k objects with no verified domain
Up to 500k objects with a verified domain
Unlimited if you have Azure Active Directory Basic or Premium subscription
Lots of new features coming soon
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. 03 | Directory Synchronization Scenarios

13. Directory Synchronization Scenarios
7/28/2018
Directory Synchronization Scenarios
Directory Sync Scenario - Used to synchronize on-premises directory objects (users, groups, contacts) to the cloud to help reduce administrative overhead. Directory synchronization is also referred to as directory sync. Once directory sync has been set up, administrators can manage directory objects from your on-premises Active Directory and those changes will be synchronized to your tenant. In this scenario, your users will use different user name and passwords to access your cloud and on-premises resources.
Directory Sync with Password Sync Scenario – Used when you want to enable your users to sign in to Azure AD and other services using the same user name and password as they use to log onto your corporate network and resources. Password sync is a feature of the Directory Sync tool.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Directory Synchronization Scenarios - continued
7/28/2018
Directory Synchronization Scenarios - continued
Directory Sync with Single Sign-On Scenario - Used to provide users with the most seamless authentication experience as they access Microsoft cloud services while logged on to the corporate network. In order to set up single sign-on, organizations need to deploy a security token service on-premises, such as Active Directory Federation Services (AD FS). Once it has been set up, users can use their Active Directory corporate credentials (user name and password) to access the services in the cloud and their existing on-premises resources.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. 04 | Directory Synchronization Tool Comparison

16. Directory Synchronization Tool Comparison
Azure Active Directory Sync Tool (DirSync)
First appliance for Directory Synchronization to Azure AD
Supports only single forest synchronization
Password write back will remain in preview and not supported
Azure Active Directory Sync Services (AAD Sync)
Newest appliance and will eventually replace Directory Synchronization to Azure AD
Supports single and multi-forest synchronization
Password-write
Many new features coming soon
Azure Active Directory Connect
Includes Azure Active Directory Sync Services (AAD Sync)
Will also assist you to set up AD FS
Will also assist you to set up your Web Application Proxy

17. Directory Synchronization Tool Comparison
On-Premises to Cloud Synchronization
Feature
(DirSync)
(AAD Sync)
Connect to single on-premises AD forest X
Connect to multiple on-premises AD forests
Connect to single on-premises LDAP directory (no AD at all) CS
Connect to multiple on-premises LDAP directories
Connect to on-premises AD and on-premises LDAP directories
Connect to custom systems (i.e. SQL, Oracle, MySQL, etc.).
Synchronize customer defined attributes (directory extensions)
Password Hash Sync for single on-premises AD forest
Password Hash Sync for multiple on-premises AD forests
Cloud to On-Premises Synchronization
Feature
(DirSync)
(AAD Sync)
Write-back of devices X CS
Attribute write back (for Exchange hybrid deployment )
Write-back of users, groups objects
Write-back of passwords (from SSPR and password change)
 Preview
Write-back of customer defined attributes (directory extensions)

18. Directory Synchronization Tool Comparison
Set-up and Installation
Feature
(DirSync)
(AAD Sync)
Supports installation on a Domain Controller X
Supports installation using SQL Express
Step-up from DirSync to AADSync
Localization Windows Server languages CS
Support for Windows Server 2008 and Windows Server 2008 R2
Support for Windows Server 2012 and Windows Server 2012 R2
Filtering and Configuration
Feature
(DirSync)
(AAD Sync)
Filter on Domains and Organizational Units X
Filter on attribute values on objects
Allow minimal set of attributes to be synchronized "MinSync"
Allow different service templates to be applied for attribute flows
Allow removing attributes from flowing from AD to AAD
Allow advanced customization for attribute flows

19. 05 | Source of Authority

20. Source of Authority
There are three scenarios where you may change the source of authority for an object—when you activate, deactivate, or reactivate directory synchronization from within any account portal or with Windows PowerShell.
Source of authority is transferred after you perform the first synchronization.
Activate: When you activate directory synchronization and then synchronize directories, the source of authority for any cloud object that is matched to an on-premises object is transferred from the cloud to your on-premises Active Directory. Activating directory synchronization is a requirement for an Exchange hybrid deployment, an Active Directory Federation Services 2.0 (AD FS 2.0)/single sign-on (SSO), and the staged Exchange migration scenarios.

21. Source of Authority - continued
Deactivate: When you deactivate directory synchronization, the source of authority is transferred from the on-premises Active Directory to the cloud. Deactivating directory synchronization is a requirement if you want to transfer all user, group, contact, and mailbox management using Windows PowerShell and account portal tools to the cloud. For example, some organizations that used the staged Exchange migration tools to move their mailboxes to the cloud and no longer want to manage objects from on-premises can deactivate directory synchronization.
Reactivate: When you reactivate directory synchronization, the source of authority is transferred from the cloud back to your on-premises Active Directory (where it previously resided).

22. Activating directory synchronization
7/28/2018 7:58 AM
Demo
Demo activating Directory Synchronization
Demo downloading/installing appliances
Activating directory synchronization
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. 06 | Hard and Soft User ID Matching

24. Hard and Soft User ID Matching
Hard matching - GUID match logic. When you reactivate directory synchronization, objects in the on-premises Active Directory are matched with objects in the cloud according to previous directory synchronization GUID (objectGUID) on the cloud objects. When such a match is found, the directory synchronization process makes a GUID match and overwrites the target object data in the cloud objects with the data from the corresponding on-premises objects.

25. Hard and Soft User ID Matching - continued
Soft Matching - SMTP match logic. If directory synchronization does not find a GUID match in the cloud, a process called SMTP match is used. In this process, directory synchronization matches corresponding objects, according to the primary SMTP address. If a target (cloud) object’s primary SMTP address matches a primary SMTP address of an object in the on-premises organization, the data for the on-premises object is used to overwrite the data for the corresponding cloud object.

26. Demo User ID Matching 7/28/2018 7:58 AM Demo soft matching
Demo hard matching
Demo setting up Alternate Login ID
User ID Matching
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. 07 | Configure Alternate User ID

28. Configuring Alternate User ID
Alternate User ID is a feature that was introduced in Active Directory Federation Services (AD FS) in Windows Server 2012 R2 Update 1.
Alternate login ID facilitates logon to AD FS by using an administratively defined user attribute. After it is configured, AD FS will prefer to locate the user account by the defined attribute first instead of by the UPN. Users will still be able to log on by using previously allowed methods.
You can also use alternate login ID without single sign-on (SSO) and AD FS by using cloud-managed sign-in and directory synchronization.

29. Demo Alternate Login ID 7/28/2018 7:58 AM Demo soft matching
Demo hard matching
Demo setting up Alternate Login ID
Alternate Login ID
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. 08 | Configure Filtering

31. Configure Filtering
Organizational-unit (OU)–based: You can use this filtering type to manage the properties of the SourceAD Management Agent in the Directory Synchronization tool. This filtering type enables you to select which OUs are allowed to synchronize to the cloud.
Domain-based: You can use this filtering type to manage the properties of the SourceAD Management Agent in the directory synchronization tool. This type enables you to select which domains are allowed to synchronize to the cloud
User-attribute–based: You can use this filtering method to specify attribute-based filters for user objects. This enables you to control which objects should not be synchronized to the cloud

32. Demo Filtering 7/28/2018 7:58 AM Demo filtering
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

33. 09 | Azure Active Directory Subscriptions

34. Azure Active Directory Subscriptions
Built on top of a large set of free capabilities in Microsoft Azure Active Directory, Active Directory Premium and Azure Active Directory Basic editions provide a set of more advanced features to help empower enterprises with more demanding identity and access management needs.
Azure AD Premium Trial available for 30 days
Features
Free
Basic
Premium
Sync up to 500k objects X
Sync unlimited objects
Forefront Identity Manager (FIM) server licenses – For syncing between on- premises databases and/or directories and Azure AD
Self-service password change for cloud users
Self-service password reset for cloud users
Azure AD Sync bi-directional synchronization (Coming Soon)
Write-back of devices (Coming Soon)
Write-back of users, groups objects (Coming Soon)
Write-back of customer defined attributes (directory extensions)
Password reset with write-back to on-premises directories (Coming Soon)
Password change write-back to on-premises directories (Coming Soon)

35. Azure Active Directory Subscription
7/28/2018 7:58 AM
Demo
Demo how to trial Azure AD Premium
Azure Active Directory Subscription
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. Configuration resources
Feature
DirSync
AAD Sync
Enable Directory Synchronization
Can be enabled using the Office 365 admin center…
Password Hash Sync
Password Write-back
Alternate Login ID
Filtering
Soft Matching
Hard Matching

37. Summary Directory Synchronization in Office 365
01 | What is Azure Active Directory?
06 | Hard and Soft User ID Matching
02 | Directory Synchronization Overview
07 | Configuring Alternate User ID
03 | Directory Synchronization Scenarios
08 | Configure Filtering
04 | Directory Synchronization Tool Comparison
09 | Azure Active Directory Subscriptions
05 | Source of Authority

38. © 2013 Microsoft Corporation. All rights reserved
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.