Share via

In hybrid architecture is it possible to manage from azure?

N D 1 Reputation point
2019-12-01T18:32:52.097+00:00

Hi,
I have an azure active directory where all my objects had been created, I want to deploy an on prem AD/DS and connect the two in a way that the sync will be from cloud to on prem so that all the management will happen in the cloud and not from on prem.

I managed to find azure ad connect and articles describing how to connect the two and make the on prem AD/DS the management unit and this is not what I want.

is there a way to accomplish my desires?

Thanks! :]

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,205 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. soumi-MSFT 11,786 Reputation points Microsoft Employee
    2019-12-01T18:43:59.177+00:00

    @N D

    No, you cannot sync down objects from Azure AD to On-Prem AD using the AD Connect tool. This feature is not available yet.

    As a workaround, we can use powershell to export Azure AD users' information to local file, then use that file to create users in on premise AD.

    You can refer to the details mentioned here.

    Hope this helps.

    ---------------------------------------------------------------------------------------------------------------------------------------

    Please take a moment to "Mark as Answer" and/or "Vote as Helpful" wherever applicable. Thanks!

    1 person found this answer helpful.
    0 comments
  2. N D 1 Reputation point
    2019-12-02T10:25:37.473+00:00

    Yes it helps, thanks.
    following on that maybe I can get another pointer. my situation and goal is:

    • my users, objects, etc are in azure
    • I want for these users and objects in azure to have permissions over resources in my on prem
    • I do not want to maintain split identities with a different AD on prem
    • I do not want to concolidate identities if the management unit AD is on prem

    any best practices for this?

    0 comments
  3. Sam Cogan 10,752 Reputation points MVP
    2019-12-02T20:37:31.39+00:00

    The only option you have for AAD being the source of truth, rather than AD, is to use Azure AD Domain Services, which provides domain controllers as a PaaS service. However, AAD DS has some fairly significant limitations, so may not work for you.

    Other than that, AD will always be the source of truth.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.