Illustrated Guide to Synchronizing your Local Active Directory to Azure Active Directory

By | May 17, 2016

This guide will illustrate to you step by step instructions on how to integrate your on-premises Active directory with Azure Active Directory by using Azure AD Connect.  In doing so it will allow you to provide common identity for your users for Office 365, Azure, and any applications that are integrated with Azure AD.  This topic will guide you on the simplest way on how to achieve this assuming that you already have fulfilled the prerequisites for your Active Directory Instance, Azure Instance as well as the server where Azure AD Connect will be installed.

Lets start!

First you need to go login to your Azure and once logged in go on the Active Directory Tab and add a domain.

Azure AD 01

Select your domain name and tick the configure this domain for single sign-on with my local Active Directory.

Azure AD 02

Now configure your domain for single-sign on.  Tick the Go to the Directory Integration page now.

At this point it will go to the Directory Integration tab and will show you stats of your domains.

Azure AD 04

Before continuing to install the Azure AD connect I suggest for you to verify your domain first, go to Domains tab.

Note:  The domain you use in here must be verified and this should be the UPN that show on you user accounts.   If your UPN is not the same as your Domain Name you will need to add the UPN to the top level of your domains forest.

Now to verify go to the list of unverified domains and click verify.

Azure AD 02c

choose a record type TXT or MX Record, enter the appropriate details.

Azure AD 02b

Click on verify (from this point on it might take sometime to verify but you can continue on with the next steps).

Now go back to the Directory Integration tab and on go to item number 2 and install and run Azure AD Connect and download.

Azure AD 05

Choose a server you will install this, the best place will be in one of your domain controllers.  Click to install.

Azure AD 06

Choose customize, to customize the installation

Azure AD 07b

Set up your install location, point to a SQL Server and use and existing service account.  If you don’t have the service account I suggest you do it first.

Azure AD 08a

You might also need to create different groups in your Active Directory to separate the different types of users.  If you installed this on a Domain Controller then the setup need to happen in Active Directory but if you prepared a stand alone server you will be setting this up on the local users and groups of the server (not ideal).

Azure AD 09a

For this demo I all placed them in the same Organizational Unit

Azure AD 09b

Install will now commence.

Azure AD 10

Now you need to set up user sign in, you have 3 options.  In this instance I used Password Synchronization which allows users to sign in to Microsoft cloud services like Office 365 and Azure deployed servers using the same password they use in their on-premises network. The users passwords are synchronized to Azure AD as a password hash and authentication occurs in the cloud.

Azure AD 11

Click next and indicate a username that has the appropriate access to Azure AD.

Azure AD 12

Now connect your directories by indicating your directory type, forest and the credentials who has the appropriate access to your local Directory.

Azure AD 13

Now you can filter by OU and choose only OU’s you want to sync.  I suggest doing this in a test or a smaller OU (few users).

Azure AD 14

Then you move on to the section for uniquely identifying your users In this section I chose users are only represented once across all forests which means that all users are created as individual objects in Azure AD. The objects are not joined in the metaverse.

On source anchor I chose objectGUID, this attribute is immutable during the lifetime of a user object. It is the primary key linking the on-premises user with the user in Azure AD.  I know this wont change hence I chose the option.  Also the User Principal Name in AD is called userPrincipalName hence I used that.

Azure AD 15

On Filter users and devices I did not choose a filter since I already filtered it on an OU level.  You are free to create your own filter if you wish to filter it down further.

Azure AD 16a


Click next then you will see optional features.

Azure AD 17

I left the optional features default.  You can click on the question mark beside each one of them for a more detailed information, or you can have a look below on what they all mean.  I just copied them over at the documentation at Microsoft.

Exchange Hybrid DeploymentThe Exchange Hybrid Deployment feature allows for the co-existence of Exchange mailboxes both on-premises and in Office 365. Azure AD Connect is synchronizing a specific set of attributes from Azure AD back into your on-premises directory.
Azure AD app and attribute filteringBy enabling Azure AD app and attribute filtering, the set of synchronized attributes can be tailored. This option adds two more configuration pages to the wizard. For more information, see Azure AD app and attribute filtering.
Password synchronizationIf you selected federation as the sign-in solution, then you can enable this option. Password synchronization can then be used as a backup option. For additional information, see Password synchronization.
Password writebackBy enabling password writeback, password changes that originate in Azure AD is written back to your on-premises directory. For more information, see Getting started with password management.
Group writebackIf you use the Office 365 Groups feature, then you can have these groups represented in your on-premises Active Directory. This option is only available if you have Exchange present in your on-premises Active Directory. For more information, see Group writeback.
Device writebackAllows you to writeback device objects in Azure AD to your on-premises Active Directory for conditional access scenarios. For more information, see Enabling device writeback in Azure AD Connect.
Directory extension attribute syncBy enabling directory extensions attribute sync, attributes specified are synced to Azure AD. For more information, see Directory extensions.

Now its ready to configure, click install and the start synchronization option so it synchronizes after the installation.

Azure AD 18

All you need to do now is wait.

Azure AD 19

Grab a coffee and after a cup or two your configuration will be complete.

Azure AD 20

And you can verify that on the users tab on your Azure AD.  Be patient this might not show up instantaneously give it sometime for it to synchronize properly.

Azure AD 21

One thought on “Illustrated Guide to Synchronizing your Local Active Directory to Azure Active Directory

  1. Pingback: Changing User Principal Names in Bulk on Azure Active Directory – Raymund Macaalay's Dev Blog

Leave a Reply