Must you migrate from Azure AD Connect with Cloud Sync?

Although loads of the functionality of domain controllers can be moved to the cloud, most organizations that use Energetic Listing want a hybrid infrastructure that offers customers entry to cloud sources (like OneDrive and Microsoft 365) by means of Azure Energetic Listing in addition to on-premises file shares, printers and functions that also want native credentials.

Through the years, Microsoft has had a number of instruments for managing hybrid identification and syncing cloud and on-premises customers and teams.

SEE: Discover TechRepublic’s hybrid cloud cheat sheet.

Microsoft Identity Manager, which changed Forefront Identification Supervisor, is supported till January 9, 2029, however its Azure AD Connector is deprecated. Azure AD Multi-Issue Authentication Server can also be deprecated and can cease dealing with MFA requests after September 30, 2024. When you’re nonetheless utilizing these instruments, you have to to maneuver to a more recent possibility.

Soar to:

Azure AD Join and its limitations

Azure AD Connect changed the older DirSync and Azure AD Sync choices for syncing customers, teams and different listing objects to Azure AD. It helps:

• Password hash synchronization: Syncing a hash of every person’s AD password into Azure AD.
• Pass-through authentication: Sending customers to Azure AD to check in after which validating towards AD, to allow them to use the identical password within the cloud and for native sources while not having to arrange federation.
• Energetic Listing Federation Providers use.

However, Azure AD Join requires organising and sustaining a server in your community, and a few of the requirements for operating it don’t work for each group, particularly in case you have a number of AD “forests,” which makes working with Azure AD complicated.

“To make use of it, you’ll want to be in a linked forest; you’ll want to have put in a database,” mentioned Joseph Dadzie, a director within the Microsoft identification group. “That’s costly to handle and deploy.

“We began getting suggestions from loads of prospects round the price of a deploying AD Join sync and of sustaining it, and a few function gaps round if you’re in a disconnected forest or you’re in a company the place you are attempting to do an M&A. So, we set out to have a look at methods to simplify it.”

Cloud sync goals to interchange Azure AD Join for cloud

The result’s Azure AD Connect cloud sync, which began out as a software for bringing identities from multiple disconnected AD forests right into a single Azure AD tenant.

It nonetheless does that, however it’s now a light-weight various to AD Join that doesn’t have fairly as many options however is way sooner to arrange and requires fewer sources. It is because cloud sync strikes a lot of the configuration into the cloud, needing solely provisioning brokers.

“While you have a look at AD Join, nearly all of the configuration is finished within the on-prem world, and it’s saved in that native server,” mentioned Dadzie. “For cloud sync, the thought is to change the configuration to be cloud based mostly and have a really light-weight agent within the buyer’s setting in order that it’s straightforward to deploy.

“It takes about 10 megabytes, so you possibly can have a number of of those working collectively for prime availability options; one thing that’s tougher to do in case you have a full Join sync functionality.”

That top availability is especially helpful for those who’re utilizing Microsoft’s advisable password hash synchronization.

The way forward for cloud sync

Cloud sync can deal with teams with as much as 50,000 members, however it doesn’t cowl the whole lot you are able to do with AD Join sync but, Dadzie instructed us.

“When you’ve executed loads of customizations on attributes in your AD and you continue to use Alternate on-prem, there’s nonetheless some delta within the capabilities,” mentioned Dadzie. “In the long term, we are going to wish to have or not it’s the total substitute; we’re not there but.”

At present, it may’t hook up with LDAP directories and doesn’t but have help for system objects, simply customers, teams and contacts. There are superior customization and filtering choices that aren’t obtainable, and cloud sync can’t deal with Alternate hybrid writeback, so you possibly can’t use it for Alternate hybrid migrations.

Federation is supported however not Azure AD Area Providers or Cross By means of Authentication, no less than for disconnected forests. That’s one thing the AD Join group is engaged on, Dadzie mentioned, and writeback for safety teams can also be in improvement.

“Over the previous yr, we added the self-service password writeback situations,” mentioned Dadzie.

Machine writeback can also be below improvement, as a result of “nearly any deployment begins with getting a few of the customers from on-prem to the cloud,” Dadzie notes. It’s barely complicated as a result of each Azure AS and Home windows Hiya For Enterprise have providers named Cloud Kerberos trust, which do various things, however Microsoft tells us the naming and documentation ought to turn into clearer in future.

The cloud sync group can also be taking a look at options to writeback.

“When you have an on-prem app and you’ve got a cloud person who wants entry to it, how do you give that person entry with out having an account within the on-prem AD,” mentioned Dadzie. “We’re taking a look at what we would do in that area: Is there a option to have a few of the secrets and techniques go down so as to have the person credentials, the place the person will get entry to on-prem with out having to have the person object in there?”

That’s nonetheless within the early phases, however there are common updates to cloud sync performance.

“Each quarter to 6 months, we replace and add new capabilities,” mentioned Dadzie. “We’re on a mission to chip away on the the explanation why somebody would possibly nonetheless wish to use the total AD Join sync. We’re on a mission to maintain including to cloud sync to the purpose that we ultimately substitute AD Join sync, however we’re not there but.”

Selecting between Azure AD Join and cloud sync

There’s no urgency about shifting to cloud sync for those who want an AD Join sync function, however there are some situations the place cloud sync is already the higher selection, in addition to much less demanding.

“It really works effectively for organizations that aren’t as sophisticated or don’t have loads of objects; if they’ve lower than 150K objects of their listing, then it’s simpler to begin off utilizing cloud sync,” mentioned Dadzie.

There’s a wizard within the Microsoft 365 admin heart that walks you thru selecting the best identification sync possibility in addition to a step-by-step migration guide if you wish to transfer from Azure AD Join sync to cloud sync.

How complicated that migration will probably be is dependent upon how complicated your AD setting is: “The extra complicated the setting is, then a extra phased strategy works,” Dazie mentioned. But when your wants are much less complicated and also you’re beginning out with hybrid identification, he suggests beginning with cloud sync for simplicity (Determine A).

Determine A

In reality, an enormous a part of the enchantment of cloud sync is that it’s designed to be a lot simpler to get began with.

“In Join sync, it’s important to do all of the Schema Mapping your self, whereas in cloud sync we attempt to autodiscover them for you, so that you don’t need to hunt round and to make it straightforward so that you can configure these,” mentioned Dadzie. “The principle philosophy we try to get with cloud sync is to make it tremendous, tremendous straightforward, so prospects don’t need to assume by means of these items.”