You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-sync/tutorial-existing-forest.md
+36-46Lines changed: 36 additions & 46 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,65 +1,55 @@
1
1
---
2
-
title: Tutorial - Integrate an existing forest and a new forest with a single Azure AD tenant by using Azure AD Connect cloud sync
2
+
title: Tutorial - Integrate an existing forest and a new forest with a single Azure AD tenant using Azure AD Connect cloud sync.
3
3
description: Learn how to add cloud sync to an existing hybrid identity environment.
4
4
services: active-directory
5
5
author: billmath
6
6
manager: amycolannino
7
7
ms.service: active-directory
8
8
ms.workload: identity
9
9
ms.topic: tutorial
10
-
ms.date: 11/11/2022
10
+
ms.date: 01/17/2023
11
11
ms.subservice: hybrid
12
12
ms.author: billmath
13
13
ms.collection: M365-identity-device-management
14
14
---
15
15
16
-
# Tutorial: Integrate an existing forest and a new forest with a single Azure AD tenant
16
+
# Integrate an existing forest and a new forest with a single Azure AD tenant
17
17
18
18
This tutorial walks you through adding cloud sync to an existing hybrid identity environment.
19
19
20
20
21
21
22
22
You can use the environment you create in this tutorial for testing or for getting more familiar with how a hybrid identity works.
23
23
24
-
In this scenario, you sync an existing forest with an Azure AD tenant by using Azure Active Directory (Azure AD) Connect. You want to sync a new forest with the same Azure AD tenant. You'll set up cloud sync for the new forest.
24
+
In this scenario, there's an existing forest synced using Azure AD Connect sync to an Azure AD tenant. And you have a new forest that you want to sync to the same Azure AD tenant. You'll set up cloud sync for the new forest.
25
25
26
26
## Prerequisites
27
+
### In the Azure Active Directory admin center
27
28
28
-
Before you begin, set up your environments.
29
-
30
-
### In the Azure AD admin center
31
-
32
-
1. Create a cloud-only global administrator account on your Azure AD tenant.
33
-
34
-
This way, you can manage the configuration of your tenant if your on-premises services fail or become unavailable. [Learn how to add a cloud-only global administrator account](../fundamentals/add-users-azure-active-directory.md). Complete this step to ensure that you don't get locked out of your tenant.
35
-
36
-
1. Add one or more [custom domain names](../fundamentals/add-custom-domain.md) to your Azure AD tenant. Your users can sign in with one of these domain names.
29
+
1. Create a cloud-only global administrator account on your Azure AD tenant. This way, you can manage the configuration of your tenant should your on-premises services fail or become unavailable. Learn about [adding a cloud-only global administrator account](../fundamentals/add-users-azure-active-directory.md). Completing this step is critical to ensure that you don't get locked out of your tenant.
30
+
2. Add one or more [custom domain names](../fundamentals/add-custom-domain.md) to your Azure AD tenant. Your users can sign in with one of these domain names.
37
31
38
32
### In your on-premises environment
39
33
40
-
1. Identify a domain-joined host server that's running Windows Server 2012 R2 or later, with at least 4 GB of RAM and .NET 4.7.1+ runtime.
41
-
42
-
1. If there's a firewall between your servers and Azure AD, configure the following items:
34
+
1. Identify a domain-joined host server running Windows Server 2012 R2 or greater with minimum of 4-GB RAM and .NET 4.7.1+ runtime
43
35
36
+
2. If there's a firewall between your servers and Azure AD, configure the following items:
44
37
- Ensure that agents can make *outbound* requests to Azure AD over the following ports:
45
38
46
39
| Port number | How it's used |
47
40
| --- | --- |
48
-
|**80**| Downloads the certificate revocation lists (CRLs) while it validates the TLS/SSL certificate.|
49
-
|**443**| Handles all outbound communication with the service.|
50
-
|**8080** (optional) | Agents report their status every 10 minutes over port 8080, if port 443 is unavailable. This status is displayed in the Azure AD portal. |
41
+
|**80**| Downloads the certificate revocation lists (CRLs) while validating the TLS/SSL certificate |
42
+
|**443**| Handles all outbound communication with the service |
43
+
|**8080** (optional) | Agents report their status every 10 minutes over port 8080, if port 443 is unavailable. This status is displayed on the Azure AD portal. |
51
44
52
45
If your firewall enforces rules according to the originating users, open these ports for traffic from Windows services that run as a network service.
53
-
54
-
- If your firewall or proxy allows you to specify safe suffixes, add connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If it doesn't, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
55
-
46
+
- If your firewall or proxy allows you to specify safe suffixes, then add connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If not, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
56
47
- Your agents need access to **login.windows.net** and **login.microsoftonline.com** for initial registration. Open your firewall for those URLs as well.
57
-
58
-
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Because these URLs are used to validate certificates for other Microsoft products, you might already have these URLs unblocked.
48
+
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products, you may already have these URLs unblocked.
59
49
60
50
## Install the Azure AD Connect provisioning agent
61
51
62
-
If you're using the [Basic Active Directory and Azure environment](tutorial-basic-ad-azure.md) tutorial, the agent is DC1. To install the agent, do the following:
52
+
If you're using the [Basic AD and Azure environment](tutorial-basic-ad-azure.md) tutorial, it would be DC1. To install the agent, follow these steps:
73
+
85
74
86
-
1. On the **Configuration** page, enter a **Notification email**, move the selector to **Enable**, and then select **Save**.
75
+
7. On the configuration screen, enter a **Notification email**, move the selector to **Enable** and select **Save**.
87
76
88
-
77
+
89
78
90
79
1. The configuration status should now be **Healthy**.
91
80
92
-
81
+
82
+
83
+
## Verify users are created and synchronization is occurring
93
84
94
-
## Verify that users are created and synchronization is occurring
85
+
You'll now verify that the users that you had in our on-premises directory have been synchronized and now exist in our Azure AD tenant. This process may take a few hours to complete. To verify users are synchronized, do the following:
95
86
96
-
You'll now verify that the users in your on-premises Active Directory have been synchronized and exist in your Azure AD tenant. This process might take a few hours to complete. To verify that the users are synchronized, do the following:
97
87
98
-
1.Sign in to the [Azure portal](https://portal.azure.com) with an account that has an Azure subscription.
99
-
1. On the left pane, select **Azure Active Directory**.
100
-
1. Under **Manage**, select **Users**.
101
-
1. Verify that the new users are displayed in your tenant.
88
+
1.Browse to the [Azure portal](https://portal.azure.com) and sign in with an account that has an Azure subscription.
89
+
2. On the left, select **Azure Active Directory**
90
+
3. Under **Manage**, select **Users**.
91
+
4. Verify that you see the new users in our tenant
102
92
103
-
## Test signing in with one of your users
93
+
## Test signing in with one of our users
104
94
105
-
1.Go to the [Microsoft My Apps](https://myapps.microsoft.com) page.
106
-
1. Sign in with a user account that was created in your new tenant. You'll need to sign in by using the following format: *[email protected]*. Use the same password that the user uses to sign in on-premises.
95
+
1.Browse to [https://myapps.microsoft.com](https://myapps.microsoft.com)
96
+
2. Sign in with a user account that was created in our new tenant. You'll need to sign in using the following format: ([email protected]). Use the same password that the user uses to sign in on-premises.
107
97
108
-
98
+
109
99
110
100
You have now successfully set up a hybrid identity environment that you can use to test and familiarize yourself with what Azure has to offer.
0 commit comments