Preparing Identities for the Cloud Randy Robb 2016 Redmond Summit | Identity Without Boundaries May 24 th 2016 Senior Consultant

Introduction

Preparing Identities for the Cloud

Company IT Infrastructure

Generic System

Generic Cloud System

Azure AD

Supported Topologies Single forest, single Azure AD directory Multiple forests, single Azure AD directory (objects represented mutually exclusive)

Supported Topologies Multiple forests – separate topologies (objects represented mutually exclusive) Multiple forests – match users (Objects joined that represent identical objects) Resources Shared via Trusts Users matched by selected attribute

Supported Topologies Multiple forests – full mesh with optional GALSync Multiple Forests – Account-Resource Forest MIM on premises Users matched by address Exchange Org A Exchange Org B Users matched by msExchMasterAccountSID

Supported Topologies

GALsync with on-premises MIM sync server (Contact Objects Synchronized) Single Forest - Each object only once in an Azure AD directory

Supported Topologies Single Forest - Each object only once in an Azure AD directory

Supported Topologies Single Forest - Each object only once in an Azure AD directory

Supported Topologies Single Forest - Each object only once in an Azure AD directory The UPNs of the users in the on-premises AD must use separate namespaces. There must be a 1:1 correspondence between a namespace and an Azure AD instance. There is no GALsync between the Azure AD directory instances. The address book in Exchange Online and Skype for Business only shows users in the same directory. Only one of the Azure AD directories can enable Exchange hybrid with the on-premises Active Directory. Windows 10 devices can only be associated with one Azure AD directory. The requirement for mutually exclusive sets of objects also applies to writeback. Some writeback features are not supported with this topology since these features assume a single configuration on-premises: Group writeback with default configuration Device writeback

Source Anchor

The sourceAnchor attribute is defined as an attribute immutable during the lifetime of an object.

Source Anchor The sourceAnchor attribute is defined as an attribute immutable during the lifetime of an object. When a new sync engine server is built, or rebuilt after a disaster recovery scenario, this attribute will link existing objects in Azure AD with objects on-premises. If you move from a cloud-only identity to a synchronized identity model this attribute will allow objects to “hard match” existing objects in Azure AD with on-premises objects. If you use federation, this attribute together with the userPrincipalName is used in the claim to uniquely identify a user.

Source Anchor The sourceAnchor attribute is defined as an attribute immutable during the lifetime of an object. When a new sync engine server is built, or rebuilt after a disaster recovery scenario, this attribute will link existing objects in Azure AD with objects on-premises. If you move from a cloud-only identity to a synchronized identity model this attribute will allow objects to “hard match” existing objects in Azure AD with on-premises objects. If you use federation, this attribute together with the userPrincipalName is used in the claim to uniquely identify a user.

IDFix Free Download from Microsoft It doesn’t fix all issues, but it is good for most Originally created for Office 365 implementations

IDFix – What does it do?

“Provides customers the ability to identify and remediate the majority of object synchronization errors in their Active Directory forests in preparation for deployment to Office 365.”

IDFix – What does it do? Key Point – Remediate errors in preparation for Office 365 – In particular Exchange Online “Provides customers the ability to identify and remediate the majority of object synchronization errors in their Active Directory forests in preparation for deployment to Office 365.”

IDFix – Details Attribute mailNo white spaceRfc routable namespace No duplicatesLess than 256 characters mailnicknameNot blankInvalid characters: whitespace \ ! # $ % & * + / = ? ^ ` { } | ~ ( ) ' ; :, [ ] May not begin or end with a period Less than 64 characters proxyaddressesRfc routable namespace (SMTP only) No duplicatesLess than 256 characters samaccountnameInvalid characters: \ " |, / [ ] : + = ; ? * No duplicatesLess than 20 characters targetAddressNot blankRfc routable namespace (SMTP only) value = mail (contact and user [if no homeMdb]) Less than 256 characters userPrincipalNameRfc routable namespace - Invalid chars whitespace \ % & * + / = ? ` { } | ( ) ; :, [ ] " No duplicatesLess than 64 characters Less than 256 characters

IDFix – Details

AD Sync Health

Reporting – AD Sync Health

Preparing On-Premises AD Before installing / configuring Azure AD Sync: 1.Define a supported topology 2.Identify uniqueness of AD objects 3.Identify your Source Anchor 4.Clean up AD to ensure correct attribute formatting IDFix After installation and synchronization verification 1.Look at Synchronization Service 2.Review Azure AD Health Report

DEMO

2016 Redmond Summit Sponsors