You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Repeat the previous step to add more domains. Provide the account names and domain names of the respective domains.
91
-
92
-
1. Restart the service.
93
-
85
+
15. Repeat the previous step to add more domains. Provide the account names and domain names of the respective domains.
86
+
16. Restart the service.
94
87
```
95
88
Restart-Service -Name AADConnectProvisioningAgent
96
89
```
97
-
1. Go to the Azure portal to create the cloud sync configuration.
90
+
17. Go to the Azure portal to create the cloud sync configuration.
98
91
99
92
## Provisioning agent gMSA PowerShell cmdlets
100
93
Now that you've installed the agent, you can apply more granular permissions to the gMSA. For information and step-by-step instructions on how to configure the permissions, see [Azure AD Connect cloud provisioning agent gMSA PowerShell cmdlets](how-to-gmsa-cmdlets.md).
101
94
95
+
## Installing against US govt cloud
96
+
By default, the Azure Active Directory (Azure AD) Connect provisioning agent installs against the default Azure cloud environment. If you are installing the agent for use in the US government cloud do the following:
97
+
98
+
- In step #8 above, add **ENVIRONMENTNAME=AzureUSGovernment** to the command line like the example below.
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-sync/how-to-install.md
+42-45Lines changed: 42 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ manager: karenhoran
7
7
ms.service: active-directory
8
8
ms.workload: identity
9
9
ms.topic: how-to
10
-
ms.date: 12/13/2021
10
+
ms.date: 01/31/2021
11
11
ms.subservice: hybrid
12
12
ms.author: billmath
13
13
ms.collection: M365-identity-device-management
@@ -22,7 +22,7 @@ This article walks you through the installation process for the Azure Active Dir
22
22
>[!NOTE]
23
23
>This article deals with installing the provisioning agent by using the wizard. For information on installing the Azure AD Connect provisioning agent by using a command-line interface (CLI), see [Install the Azure AD Connect provisioning agent by using a CLI and PowerShell](how-to-install-pshell.md).
24
24
25
-
For additional information and an example, see the following video.
25
+
For more information and an example, see the following video.
@@ -38,36 +38,33 @@ To upgrade an existing agent to use the group Managed Service Account created du
38
38
To install the agent:
39
39
40
40
1. Sign in to the server you'll use with enterprise admin permissions.
41
-
1. Sign in to the Azure portal, and then go to **Azure Active Directory**.
42
-
1. On the menu on the left, select **Azure AD Connect**.
43
-
1. Select **Manage cloud sync** > **Review all agents**.
44
-
1. Download the Azure AD Connect provisioning agent from the Azure portal.
45
-
46
-
</br>
47
-
1. Accept the terms and select **Download**.
48
-
1. Run the Azure AD Connect provisioning installer AADConnectProvisioningAgentSetup.msi.
49
-
1. On the **Microsoft Azure AD Connect Provisioning Agent Package** screen, accept the licensing terms and select **Install**.
50
-
51
-
</br>
52
-
1. After this operation finishes, the configuration wizard starts. Sign in with your Azure AD global administrator account.
53
-
1. On the **Configure Service Account** screen, select either **Create gMSA** or **Use custom gMSA**. If you allow the agent to create the account, it will be named provAgentgMSA$. If you specify **Use custom gMSA**, you're prompted to provide this account.
54
-
1. Enter the domain admin credentials to create the group Managed Service account that will be used to run the agent service. Select **Next**.
55
-
56
-
</br>
57
-
1. On the **Connect Active Directory** screen, select **Add Directory**. Then sign in with your Active Directory administrator account. This operation adds your on-premises directory.
58
-
1. Optionally, you can manage the preference of domain controllers the agent will use by selecting the **Select domain controller priority** checkbox and ordering the list of domain controllers. Select **OK**.
59
-
60
-
</br>
61
-
1. Select **Next**.
62
-
63
-
</br>
64
-
1. On the **Agent installation** screen, confirm settings and the account that will be created and select **Confirm**.
65
-
66
-
</br>
67
-
1. After this operation finishes, you should see **Your agent installation is complete.** Select **Exit**.
68
-
69
-
</br>
70
-
1. If you still see the initial **Microsoft Azure AD Connect Provisioning Agent Package** screen, select **Close**.
41
+
2. Sign in to the Azure portal, and then go to **Azure Active Directory**.
42
+
3. On the menu on the left, select **Azure AD Connect**.
43
+
4. Select **Manage cloud sync**.
44
+
[](media/how-to-install/new-install-1.png#lightbox)</br>
45
+
5. At the top, click **Download agent**.
46
+
[](media/how-to-install/new-install-2.png#lightbox)</br>
47
+
7. On the right, click **Accept terms and download**.
48
+
[](media/how-to-install/new-install-3.png#lightbox)</br>
49
+
9. Once the agent has completed downloading, click **Open file**. This will start the installation.
50
+
[](media/how-to-install/new-install-4.png#lightbox)</br>
51
+
10. On the **Microsoft Azure AD Connect Provisioning Agent Package** screen, accept the licensing terms, and select **Install**.
52
+
[](media/how-to-install/new-install-5.png#lightbox)</br>
53
+
11. After this operation finishes, the configuration wizard starts. Click **Next**.
54
+
[](media/how-to-install/new-install-6.png#lightbox)</br>
55
+
13. Sign in with your Azure AD global administrator account.
56
+
14. On the **Configure Service Account** screen, select either **Create gMSA**, or **Use custom gMSA**. If you allow the agent to create the account, it will be named **provAgentgMSA$**. If you specify **Use custom gMSA**, you're prompted to provide this account.
57
+
[](media/how-to-install/new-install-7.png#lightbox)</br>
58
+
15. Enter the domain administrator credentials to create the group Managed Service account that will be used to run the agent service. Select **Next**.
59
+
</br>
60
+
16. On the **Connect Active Directory** screen, click **Next**. Your current domain has been added automatically. If you wish to add additional domains, enter them and select **Add Directory**. Then sign in with an administrator account from that domain.
61
+
[](media/how-to-install/new-install-8.png#lightbox)</br>
62
+
17. Optionally, you can manage the preference of domain controllers the agent will use. To do this, click **Add Directory** and select the **Select domain controller priority** checkbox and then order the list of domain controllers. Select **OK**. Click **Next**.
63
+
[](media/how-to-install/new-install-10.png#lightbox)</br>
64
+
18. On the **Agent installation** screen, confirm settings and the account that will be created and select **Confirm**.
65
+
[](media/how-to-install/new-install-11.png#lightbox)</br>
66
+
20. After this operation finishes, you should see **Your agent installation is complete.** Select **Exit**.
67
+
21. If you still see the initial **Microsoft Azure AD Connect Provisioning Agent Package** screen, select **Close**.
71
68
72
69
## Verify agent installation
73
70
Agent verification occurs in the Azure portal and on the local server that's running the agent.
@@ -76,33 +73,27 @@ Agent verification occurs in the Azure portal and on the local server that's run
76
73
To verify the agent is being seen by Azure:
77
74
78
75
1. Sign in to the Azure portal.
79
-
1. On the left, select **Azure Active Directory** > **Azure AD Connect**. In the center, select **Manage cloud sync**.
80
-
76
+
2. On the left, select **Azure Active Directory** > **Azure AD Connect**. In the center, select **Manage cloud sync**.
81
77
</br>
82
-
83
-
1. On the **Azure AD Connect cloud sync** screen, select **Review all agents**.
84
-
78
+
3. On the **Azure AD Connect cloud sync** screen, select **Review all agents**.
85
79
</br>
86
-
87
-
1. On the **On-premises provisioning agents** screen, you see the agents you installed. Verify that the agent in question is there and is marked *active*.
88
-
80
+
4. On the **On-premises provisioning agents** screen, you see the agents you installed. Verify that the agent in question is there and is marked *active*.
89
81
</br>
90
82
91
83
### On the local server
92
84
To verify that the agent is running:
93
85
94
86
1. Sign in to the server with an administrator account.
95
-
1. Open **Services** by going to it or by selecting **Start** > **Run** > **Services.msc**.
96
-
1. Under **Services**, make sure **Microsoft Azure AD Connect Agent Updater** and **Microsoft Azure AD Connect Provisioning Agent** are there and their status is *Running*.
97
-
98
-
87
+
2. Open **Services** by going to it or by selecting **Start** > **Run** > **Services.msc**.
88
+
3. Under **Services**, make sure **Microsoft Azure AD Connect Agent Updater** and **Microsoft Azure AD Connect Provisioning Agent** are present. Also, ensure the status is *Running*.
89
+
99
90
100
91
>[!IMPORTANT]
101
92
>The agent has been installed, but it must be configured and enabled before it will start synchronizing users. To configure a new agent, see [Create a new configuration for Azure AD Connect cloud sync](how-to-configure.md).
102
93
103
94
## Enable password writeback in Azure AD Connect cloud sync
104
95
105
-
To use password writeback and enable the SSPR service to detect the cloud sync agent, you need to use the `Set-AADCloudSyncPasswordWritebackConfiguration` cmdlet and tenant’s global administrator credentials:
96
+
To use password writeback and enable the self-service password reset (SSPR) service to detect the cloud sync agent, you need to use the `Set-AADCloudSyncPasswordWritebackConfiguration` cmdlet and tenant’s global administrator credentials:
106
97
107
98
```
108
99
Import-Module "C:\\Program Files\\Microsoft Azure AD Connect Provisioning Agent\\Microsoft.CloudSync.Powershell.dll"
@@ -111,6 +102,12 @@ To use password writeback and enable the SSPR service to detect the cloud sync a
111
102
112
103
For more information on using password writeback with Azure AD Connect cloud sync, see [Tutorial: Enable cloud sync self-service password reset writeback to an on-premises environment (preview)](../../active-directory/authentication/tutorial-enable-cloud-sync-sspr-writeback.md).
113
104
105
+
## Installing against US govt cloud
106
+
By default, the Azure Active Directory (Azure AD) Connect provisioning agent installs against the default Azure cloud environment. If you are installing the agent for use in the US government cloud do the following:
107
+
108
+
- In step #7 above, instead of click **Open file**, go to start run and navigate to the **AADConnectProvisioningAgentSetup.exe** file. In the run box, after the executable, enter **ENVIRONMENTNAME=AzureUSGovernment** and click **Ok**.
109
+
[](media/how-to-install/new-install-12.png#lightbox)</br>
0 commit comments