You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/how-to-mfa-number-match.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Learn how to use number matching in MFA notifications
4
4
ms.service: active-directory
5
5
ms.subservice: authentication
6
6
ms.topic: conceptual
7
-
ms.date: 01/06/2023
7
+
ms.date: 01/13/2023
8
8
ms.author: justinha
9
9
author: mjsantani
10
10
ms.collection: M365-identity-device-management
@@ -64,6 +64,7 @@ AD FS adapter will require number matching on supported versions of Windows Serv
64
64
|---------|--------|
65
65
| Windows Server 2022 |[November 9, 2021—KB5007205 (OS Build 20348.350)](https://support.microsoft.com/topic/november-9-2021-kb5007205-os-build-20348-350-af102e6f-cc7c-4cd4-8dc2-8b08d73d2b31)|
66
66
| Windows Server 2019 |[November 9, 2021—KB5007206 (OS Build 17763.2300)](https://support.microsoft.com/topic/november-9-2021-kb5007206-os-build-17763-2300-c63b76fa-a9b4-4685-b17c-7d866bb50e48)|
67
+
| Windows Server 2016 |[October 12, 2021—KB5006669 (OS Build 14393.4704)](https://support.microsoft.com/topic/october-12-2021-kb5006669-os-build-14393-4704-bcc95546-0768-49ae-bec9-240cc59df384)|
This article walks you through the installation process for the Azure Active Directory (Azure AD) Connect provisioning agent and how to initially configure it in the Azure portal.
19
19
20
-
>[!IMPORTANT]
21
-
>The following installation instructions assume that all the [prerequisites](how-to-prerequisites.md) were met.
20
+
>[!IMPORTANT]
21
+
>The following installation instructions assume that you've met all the [prerequisites](how-to-prerequisites.md).
22
22
23
23
>[!NOTE]
24
-
>This article deals with installing the provisioning agent by using the wizard. For information on installing the Azure AD Connect provisioning agent by using a command-line interface (CLI), see [Install the Azure AD Connect provisioning agent by using a CLI and PowerShell](how-to-install-pshell.md).
24
+
>This article deals with installing the provisioning agent by using the wizard. For information about installing the Azure AD Connect provisioning agent by using a CLI, see [Install the Azure AD Connect provisioning agent by using a CLI and PowerShell](how-to-install-pshell.md).
25
25
26
-
For more information and an example, see the following video.
26
+
For more information and an example, view the following video:
A Group Managed Service Account (gMSA) is a managed domain account that provides automatic password management, simplified service principal name (SPN) management, and the ability to delegate the management to other administrators. It also extends this functionality over multiple servers. Azure AD Connect cloud sync supports and recommends the use of a Group Managed Service Account for running the agent. For more information on a Group Managed Service Account, see [Group Managed Service Accounts](how-to-prerequisites.md#group-managed-service-accounts).
31
+
A group Managed Service Account (gMSA) is a managed domain account that provides automatic password management, simplified service principal name (SPN) management, and the ability to delegate the management to other administrators. A gMSA also extends this functionality over multiple servers. Azure AD Connect cloud sync supports and recommends the use of a gMSA for running the agent. For more information, see [Group Managed Service Accounts](how-to-prerequisites.md#group-managed-service-accounts).
32
32
33
33
34
-
### Upgrade an existing agent to use the gMSA
35
-
To upgrade an existing agent to use the Group Managed Service Account created during installation, update the agent service to the latest version by running AADConnectProvisioningAgent.msi. Now run through the installation wizard again and provide the credentials to create the account when prompted.
34
+
### Update an existing agent to use the gMSA
35
+
To update an existing agent to use the Group Managed Service Account created during installation, upgrade the agent service to the latest version by running *AADConnectProvisioningAgent.msi*. Now run through the installation wizard again and provide the credentials to create the account when you're prompted to do so.
>The agent has been installed, but it must be configured and enabled before it will start synchronizing users. To configure a new agent, see [Create a new configuration for Azure AD Connect cloud sync](how-to-configure.md).
46
+
>After you've installed the agent, you must configure and enable it before it will start synchronizing users. To configure a new agent, see [Create a new configuration for Azure AD Connect cloud sync](how-to-configure.md).
47
47
48
48
## Enable password writeback in Azure AD Connect cloud sync
49
49
50
-
To use password writeback and enable the self-service password reset (SSPR) service to detect the cloud sync agent, you need to use the `Set-AADCloudSyncPasswordWritebackConfiguration` cmdlet and tenant’s global administrator credentials:
50
+
To use *password writeback* and enable the self-service password reset (SSPR) service to detect the cloud sync agent, use the `Set-AADCloudSyncPasswordWritebackConfiguration` cmdlet and the tenant’s global administrator credentials:
51
51
52
52
```
53
53
Import-Module "C:\\Program Files\\Microsoft Azure AD Connect Provisioning Agent\\Microsoft.CloudSync.Powershell.dll"
For more information on using password writeback with Azure AD Connect cloud sync, see [Tutorial: Enable cloud sync self-service password reset writeback to an on-premises environment (preview)](../../active-directory/authentication/tutorial-enable-cloud-sync-sspr-writeback.md).
57
+
For more information about using password writeback with Azure AD Connect cloud sync, see [Tutorial: Enable cloud sync self-service password reset writeback to an on-premises environment (preview)](../../active-directory/authentication/tutorial-enable-cloud-sync-sspr-writeback.md).
58
58
59
-
## Installing against US government cloud
59
+
## Install an agent in the US government cloud
60
60
61
-
By default, the Azure Active Directory (Azure AD) Connect provisioning agent installs against the default Azure cloud environment. If you're installing the agent for usein the US government, follow these steps:
61
+
By default, the Azure AD Connect provisioning agent is installed in the default Azure environment. If you're installing the agent for US government use, make this change in step 7 of the preceding installation procedure:
62
62
63
-
-In step #7 above, instead of select**Open file**, go to start run and navigate to the **AADConnectProvisioningAgentSetup.exe** file. In the run box, after the executable, enter **ENVIRONMENTNAME=AzureUSGovernment** and select **Ok**.
63
+
-Instead of selecting**Open file**, select **Start** > **Run**, and then go to the *AADConnectProvisioningAgentSetup.exe* file. In the **Run** box, after the executable, enter **ENVIRONMENTNAME=AzureUSGovernment**, and then select **OK**.
64
64
65
-
[](media/how-to-install/new-install-12.png#lightbox)
65
+
[](media/how-to-install/new-install-12.png#lightbox)
66
66
67
67
## Password hash synchronization and FIPS with cloud sync
68
68
69
-
If your server has been locked down according to Federal Information Processing Standard (FIPS), then MD5 is disabled.
70
-
69
+
If your server has been locked down according to the Federal Information Processing Standard (FIPS), MD5 (message-digest algorithm 5) is disabled.
71
70
72
-
To enable MD5 for password hash synchronization, perform the following steps:
71
+
To enable MD5 for password hash synchronization, do the following:
73
72
74
73
1. Go to %programfiles%\Microsoft Azure AD Connect Provisioning Agent.
75
-
2. Open AADConnectProvisioningAgent.exe.config.
76
-
3. Go to the configuration/runtime node at the top of the file.
77
-
4. Add the following node: `<enforceFIPSPolicy enabled="false"/>`
78
-
5. Save your changes.
74
+
1. Open *AADConnectProvisioningAgent.exe.config*.
75
+
1. Go to the configuration/runtime node at the top of the file.
76
+
1. Add the `<enforceFIPSPolicy enabled="false"/>` node.
77
+
1. Save your changes.
79
78
80
-
For reference, this snippet is what it should look like:
79
+
For reference, your code should look like the following snippet:
81
80
82
81
```xml
83
82
<configuration>
@@ -87,7 +86,7 @@ For reference, this snippet is what it should look like:
87
86
</configuration>
88
87
```
89
88
90
-
For information about security and FIPS, see [Azure AD password hash sync, encryption, and FIPS compliance](https://blogs.technet.microsoft.com/enterprisemobility/2014/06/28/aad-password-sync-encryption-and-fips-compliance/).
89
+
For more information about security and FIPS, see [Azure AD password hash sync, encryption, and FIPS compliance](https://blogs.technet.microsoft.com/enterprisemobility/2014/06/28/aad-password-sync-encryption-and-fips-compliance/).
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-sync/tutorial-existing-forest.md
+45-35Lines changed: 45 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Tutorial - Integrate an existing forest and a new forest with a single Azure AD tenant using Azure AD Connect cloud sync.
2
+
title: Tutorial - Integrate an existing forest and a new forest with a single Azure AD tenant by using Azure AD Connect cloud sync
3
3
description: Learn how to add cloud sync to an existing hybrid identity environment.
4
4
services: active-directory
5
5
author: billmath
@@ -13,43 +13,53 @@ ms.author: billmath
13
13
ms.collection: M365-identity-device-management
14
14
---
15
15
16
-
# Integrate an existing forest and a new forest with a single Azure AD tenant
16
+
# Tutorial: Integrate an existing forest and a new forest with a single Azure AD tenant
17
17
18
18
This tutorial walks you through adding cloud sync to an existing hybrid identity environment.
19
19
20
20
21
21
22
22
You can use the environment you create in this tutorial for testing or for getting more familiar with how a hybrid identity works.
23
23
24
-
In this scenario, there's an existing forest synced using Azure AD Connect sync to an Azure AD tenant. And you have a new forest that you want to sync to the same Azure AD tenant. You'll set up cloud sync for the new forest.
24
+
In this scenario, you sync an existing forest with an Azure AD tenant by using Azure Active Directory (Azure AD) Connect. You want to sync a new forest with the same Azure AD tenant. You'll set up cloud sync for the new forest.
25
25
26
26
## Prerequisites
27
-
### In the Azure Active Directory admin center
28
27
29
-
1. Create a cloud-only global administrator account on your Azure AD tenant. This way, you can manage the configuration of your tenant should your on-premises services fail or become unavailable. Learn about [adding a cloud-only global administrator account](../fundamentals/add-users-azure-active-directory.md). Completing this step is critical to ensure that you don't get locked out of your tenant.
30
-
2. Add one or more [custom domain names](../fundamentals/add-custom-domain.md) to your Azure AD tenant. Your users can sign in with one of these domain names.
28
+
Before you begin, set up your environments.
29
+
30
+
### In the Azure AD admin center
31
+
32
+
1. Create a cloud-only global administrator account on your Azure AD tenant.
33
+
34
+
This way, you can manage the configuration of your tenant if your on-premises services fail or become unavailable. [Learn how to add a cloud-only global administrator account](../fundamentals/add-users-azure-active-directory.md). Complete this step to ensure that you don't get locked out of your tenant.
35
+
36
+
1. Add one or more [custom domain names](../fundamentals/add-custom-domain.md) to your Azure AD tenant. Your users can sign in with one of these domain names.
31
37
32
38
### In your on-premises environment
33
39
34
-
1. Identify a domain-joined host server running Windows Server 2012 R2 or greater with minimum of 4-GB RAM and .NET 4.7.1+ runtime
40
+
1. Identify a domain-joined host server that's running Windows Server 2012 R2 or later, with at least 4 GB of RAM and .NET 4.7.1+ runtime.
41
+
42
+
1. If there's a firewall between your servers and Azure AD, configure the following items:
35
43
36
-
2. If there's a firewall between your servers and Azure AD, configure the following items:
37
44
- Ensure that agents can make *outbound* requests to Azure AD over the following ports:
38
45
39
46
| Port number | How it's used |
40
47
| --- | --- |
41
-
|**80**| Downloads the certificate revocation lists (CRLs) while validating the TLS/SSL certificate |
42
-
|**443**| Handles all outbound communication with the service |
43
-
|**8080** (optional) | Agents report their status every 10 minutes over port 8080, if port 443 is unavailable. This status is displayed on the Azure AD portal. |
48
+
|**80**| Downloads the certificate revocation lists (CRLs) while it validates the TLS/SSL certificate.|
49
+
|**443**| Handles all outbound communication with the service.|
50
+
|**8080** (optional) | Agents report their status every 10 minutes over port 8080, if port 443 is unavailable. This status is displayed in the Azure AD portal. |
44
51
45
52
If your firewall enforces rules according to the originating users, open these ports for traffic from Windows services that run as a network service.
46
-
- If your firewall or proxy allows you to specify safe suffixes, then add connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If not, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
53
+
54
+
- If your firewall or proxy allows you to specify safe suffixes, add connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If it doesn't, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
55
+
47
56
- Your agents need access to **login.windows.net** and **login.microsoftonline.com** for initial registration. Open your firewall for those URLs as well.
48
-
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products, you may already have these URLs unblocked.
57
+
58
+
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Because these URLs are used to validate certificates for other Microsoft products, you might already have these URLs unblocked.
49
59
50
60
## Install the Azure AD Connect provisioning agent
51
61
52
-
If you're using the [Basic AD and Azure environment](tutorial-basic-ad-azure.md) tutorial, it would be DC1. To install the agent, follow these steps:
62
+
If you're using the [Basic Active Directory and Azure environment](tutorial-basic-ad-azure.md) tutorial, the agent is DC1. To install the agent, do the following:
70
81
71
-
5. Select **New Configuration**
82
+
1. Select **New Configuration**.
72
83
73
-
84
+
74
85
75
-
7. On the configuration screen, enter a **Notification email**, move the selector to **Enable** and select **Save**.
86
+
1. On the **Configuration** page, enter a **Notification email**, move the selector to **Enable**, and then select **Save**.
76
87
77
-
88
+
78
89
79
90
1. The configuration status should now be **Healthy**.
80
91
81
-
82
-
83
-
## Verify users are created and synchronization is occurring
92
+
84
93
85
-
You'll now verify that the users that you had in our on-premises directory have been synchronized and now exist in our Azure AD tenant. This process may take a few hours to complete. To verify users are synchronized, do the following:
94
+
## Verify that users are created and synchronization is occurring
86
95
96
+
You'll now verify that the users in your on-premises Active Directory have been synchronized and exist in your Azure AD tenant. This process might take a few hours to complete. To verify that the users are synchronized, do the following:
87
97
88
-
1.Browse to the [Azure portal](https://portal.azure.com) and sign in with an account that has an Azure subscription.
89
-
2. On the left, select **Azure Active Directory**
90
-
3. Under **Manage**, select **Users**.
91
-
4. Verify that you see the new users in our tenant
98
+
1.Sign in to the [Azure portal](https://portal.azure.com) with an account that has an Azure subscription.
99
+
1. On the left pane, select **Azure Active Directory**.
100
+
1. Under **Manage**, select **Users**.
101
+
1. Verify that the new users are displayed in your tenant.
92
102
93
-
## Test signing in with one of our users
103
+
## Test signing in with one of your users
94
104
95
-
1.Browse to [https://myapps.microsoft.com](https://myapps.microsoft.com)
96
-
2. Sign in with a user account that was created in our new tenant. You'll need to sign in using the following format: ([email protected]). Use the same password that the user uses to sign in on-premises.
105
+
1.Go to the [Microsoft My Apps](https://myapps.microsoft.com) page.
106
+
1. Sign in with a user account that was created in your new tenant. You'll need to sign in by using the following format: *[email protected]*. Use the same password that the user uses to sign in on-premises.
97
107
98
-
108
+
99
109
100
110
You have now successfully set up a hybrid identity environment that you can use to test and familiarize yourself with what Azure has to offer.
0 commit comments