You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/hybrid-cloud-to-on-premises.md
+5-13Lines changed: 5 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: B2B
8
8
ms.topic: how-to
9
-
ms.date: 10/30/2020
9
+
ms.date: 11/05/2021
10
10
11
11
ms.author: mimart
12
12
author: msmimart
@@ -44,10 +44,10 @@ To provide B2B users access to on-premises applications that are secured with in
44
44
> [!NOTE]
45
45
> When you configure the Azure AD Application Proxy, ensure that **Delegated Logon Identity** is set to **User principal name** (default) in the single sign-on configuration for integrated Windows authentication (IWA).
46
46
47
-
For the B2B user scenario, there are two methods available that you can use to create the guest user objects that are required for authorization in the on-premises directory:
47
+
For the B2B user scenario, there are two methods you can use to create the guest user objects that are required for authorization in the on-premises directory:
48
48
49
-
- Microsoft Identity Manager (MIM) and the MIM management agent for Microsoft Graph.
50
-
-[A PowerShell script](#create-b2b-guest-user-objects-through-a-script-preview). Using the script is a more lightweight solution that does not require MIM.
49
+
- Microsoft Identity Manager (MIM) and the MIM management agent for Microsoft Graph.
50
+
- A PowerShell script, which is a more lightweight solution that does not require MIM.
51
51
52
52
The following diagram provides a high-level overview of how Azure AD Application Proxy and the generation of the B2B user object in the on-premises directory work together to grant B2B users access to your on-premises IWA and KCD apps. The numbered steps are described in detail below the diagram.
53
53
@@ -72,20 +72,12 @@ You can manage the on-premises B2B user objects through lifecycle management pol
72
72
73
73
For information about how to use MIM 2016 Service Pack 1 and the MIM management agent for Microsoft Graph to create the guest user objects in the on-premises directory, see [Azure AD business-to-business (B2B) collaboration with Microsoft Identity Manager (MIM) 2016 SP1 with Azure Application Proxy](/microsoft-identity-manager/microsoft-identity-manager-2016-graph-b2b-scenario).
74
74
75
-
### Create B2B guest user objects through a script (Preview)
76
-
77
-
There’s a PowerShell sample script available that you can use as a starting point to create the guest user objects in your on-premises Active Directory.
78
-
79
-
You can download the script and the Readme file from [Connectors for Microsoft Identity Manager 2016 and Forefront Identity Manager 2010 R2](https://www.microsoft.com/download/details.aspx?id=51495). In the download package, choose the **Script and Readme to pull Azure AD B2B users on-prem.zip** file.
80
-
81
-
Before you use the script, make sure that you review the prerequisites and important considerations in the associated Readme file. Also, understand that the script is made available only as a sample. Your development team or a partner must customize and review the script before you run it.
82
-
83
75
## License considerations
84
76
85
77
Make sure that you have the correct Client Access Licenses (CALs) for external guest users who access on-premises apps. For more information, see the "External Connectors" section of [Client Access Licenses and Management Licenses](https://www.microsoft.com/licensing/product-licensing/client-access-license.aspx). Consult your Microsoft representative or local reseller regarding your specific licensing needs.
86
78
87
79
## Next steps
88
80
89
-
-[Azure Active Directory B2B collaboration for hybrid organizations](hybrid-organizations.md)
81
+
-See also [Azure Active Directory B2B collaboration for hybrid organizations](hybrid-organizations.md)
90
82
91
83
- For an overview of Azure AD Connect, see [Integrate your on-premises directories with Azure Active Directory](../hybrid/whatis-hybrid-identity.md).
0 commit comments