Learn Everything About Entra ID Connect Cloud Sync | Peter Rising MVP

Summary

In this video, the presenter explores Azure AD Connect Cloud Sync, a lightweight solution for synchronizing on-premises Active Directory with Microsoft 365 and Azure AD. Unlike the traditional Azure AD Connect, this tool is easier to set up and lacks some features but offers a simpler experience for organizations with lighter needs. The video covers the setup process, including agent installation, configuration, and user synchronization. It also highlights the benefits and practical steps for administrators looking to implement Cloud Sync. The presenter shares personal insights from the process, providing viewers with a hands-on guide to using this tool.

Takeaways

• 😀 Azure AD Connect Cloud Sync is a lightweight and simplified version of Azure AD Connect, designed to synchronize on-premises Active Directory with Azure AD and Microsoft 365.
• 😀 Unlike traditional Azure AD Connect, Cloud Sync is easier to set up and lacks some of the more advanced features, making it a good choice for smaller or less complex environments.
• 😀 To start the setup, you must first disable Azure AD Connect's sync by running the command `Set-ADSync-Enable-DirSync $False` to ensure the traditional sync is turned off.
• 😀 The setup of Azure AD Connect Cloud Sync involves downloading the provisioning agent, agreeing to terms, and installing the agent on your on-premises server.
• 😀 After installing the agent, you authenticate using your Microsoft 365 global administrator account, requiring multi-factor authentication (MFA).
• 😀 A Group Managed Service Account (GMSA) must be created or an existing one used to manage the synchronization process.
• 😀 You will need to configure synchronization settings, including enabling **Password Hash Sync** and selecting which Active Directory domain to sync with Azure AD.
• 😀 The configuration process includes scoping filters and attribute mapping, allowing you to specify which users or groups to sync and what attributes to map.
• 😀 Azure AD Connect Cloud Sync allows you to test your configuration before enabling it, providing a validation option to check for potential errors in your sync setup.
• 😀 Once the configuration is complete and enabled, the sync process begins, and you can monitor the sync status through the Azure portal, including viewing logs for any errors or sync activities.
• 😀 Cloud Sync simplifies identity management by offering a faster, more efficient way to sync users from on-premises to Azure AD, with the ability to create new users that will sync automatically after a short wait or via manual on-demand sync.

Q & A

What is Azure AD Connect Cloud Sync, and how does it differ from the full Azure AD Connect?

Azure AD Connect Cloud Sync is a simplified version of Azure AD Connect designed to synchronize on-premises Active Directory with Azure AD and Microsoft 365. Unlike the full version of Azure AD Connect, Cloud Sync is easier and faster to install, though it lacks some advanced features found in the full version. It is a more lightweight solution aimed at organizations that want a simpler synchronization process.

Why might an organization prefer Azure AD Connect Cloud Sync over the full Azure AD Connect?

Organizations might prefer Azure AD Connect Cloud Sync because it offers a simpler installation process and requires less management. It is ideal for smaller or less complex environments where full Azure AD Connect's advanced features are unnecessary. Cloud Sync also provides a lighter touch for synchronizing identities without the need for heavy infrastructure.

What prerequisites need to be considered before installing Azure AD Connect Cloud Sync?

Before installing Azure AD Connect Cloud Sync, it’s important to review the configuration guide, which includes prerequisites such as ensuring certain ports are open for outbound requests to Azure AD, especially if there's a firewall between the on-premises servers and Azure AD.

How do you start the installation of Azure AD Connect Cloud Sync?

To start the installation, you need to download the on-premises agent from the Azure portal, accept the terms, and run the setup file. The provisioning agent configuration wizard will guide you through the process.

What are the steps involved in setting up the agent configuration for Cloud Sync?

The agent configuration involves selecting the appropriate extension for synchronization (such as HR-driven provisioning or Azure AD Connect Cloud Sync). After authentication with your Microsoft 365 account, you must configure a service account, either using a Group Managed Service Account (GMSA) or a custom one, to manage the synchronization. Once these configurations are confirmed, the process proceeds to complete the agent setup.

What does the agent configuration wizard allow you to do in Azure AD Connect Cloud Sync?

The agent configuration wizard lets you choose the type of provisioning (like HR-driven or on-premises app provisioning) and configure the sync process, including selecting the on-premises Active Directory to sync with Azure AD. It also involves setting up the necessary credentials and ensuring that synchronization occurs securely.

How do you configure scoping filters and attribute mappings in Azure AD Connect Cloud Sync?

Scoping filters allow you to specify which users or groups should be synchronized between on-premises AD and Azure AD. You can select all users or specify selected groups for synchronization. Similarly, attribute mapping enables customization of which attributes are synchronized, and you can edit mappings to suit your needs, such as adjusting mapping types or source attributes.

What happens after completing the configuration in Azure AD Connect Cloud Sync?

After the configuration is completed, the sync is enabled, and you can monitor the status in the Azure portal. The agent status will initially show as yellow (pending), but it eventually turns green after synchronization is completed. The process may take several minutes for the agent status to update.

What are the monitoring options available in Azure AD Connect Cloud Sync?

In Azure AD Connect Cloud Sync, monitoring options include viewing provisioning logs, auditing logs, and sync activities. You can check the status of your agents, monitor sync progress, and review activities such as export and import of data. Integration with log analytics is also possible, though not covered in this video.

How do you test synchronization with a new user in Azure AD Connect Cloud Sync?

To test synchronization with a new user, you can create a user in on-premises Active Directory, then trigger on-demand synchronization using the 'Provision on Demand' feature. You must enter the distinguished name of the new user, and once validated, the sync will push the new account to Azure AD. The new user will appear in the Azure AD portal after a brief sync period.

What is the benefit of using the on-demand sync feature in Azure AD Connect Cloud Sync?

The on-demand sync feature allows you to manually trigger synchronization for new or modified users, ensuring that they are quickly propagated to Azure AD. This is useful for testing or when you need to sync users immediately without waiting for the next scheduled sync cycle.