You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-sync/how-to-install.md
+18-60Lines changed: 18 additions & 60 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,13 +7,14 @@ manager: amycolannino
7
7
ms.service: active-directory
8
8
ms.workload: identity
9
9
ms.topic: how-to
10
-
ms.date: 03/01/2022
10
+
ms.date: 11/11/2022
11
11
ms.subservice: hybrid
12
12
ms.author: billmath
13
13
ms.collection: M365-identity-device-management
14
14
---
15
15
16
16
# Install the Azure AD Connect provisioning agent
17
+
17
18
This article walks you through the installation process for the Azure Active Directory (Azure AD) Connect provisioning agent and how to initially configure it in the Azure portal.
18
19
19
20
>[!IMPORTANT]
@@ -35,58 +36,11 @@ To upgrade an existing agent to use the group Managed Service Account created du
35
36
36
37
## Install the agent
37
38
38
-
To install the agent:
39
-
40
-
1. Sign in to the server you'll use with enterprise admin permissions.
41
-
2. Sign in to the Azure portal, and then go to **Azure Active Directory**.
42
-
3. On the menu on the left, select **Azure AD Connect**.
43
-
4. Select **Manage cloud sync**.
44
-
[](media/how-to-install/new-install-1.png#lightbox)</br>
45
-
5. At the top, click **Download agent**.
46
-
[](media/how-to-install/new-install-2.png#lightbox)</br>
47
-
7. On the right, click **Accept terms and download**.
48
-
[](media/how-to-install/new-install-3.png#lightbox)</br>
49
-
9. Once the agent has completed downloading, click **Open file**. This will start the installation.
50
-
[](media/how-to-install/new-install-4.png#lightbox)</br>
51
-
10. On the **Microsoft Azure AD Connect Provisioning Agent Package** screen, accept the licensing terms, and select **Install**.
52
-
[](media/how-to-install/new-install-5.png#lightbox)</br>
53
-
11. After this operation finishes, the configuration wizard starts. Click **Next**.
54
-
[](media/how-to-install/new-install-6.png#lightbox)</br>
55
-
13. Sign in with your Azure AD global administrator account.
56
-
14. On the **Configure Service Account** screen, select either **Create gMSA**, or **Use custom gMSA**. If you allow the agent to create the account, it will be named **provAgentgMSA$**. If you specify **Use custom gMSA**, you're prompted to provide this account.
57
-
[](media/how-to-install/new-install-7.png#lightbox)</br>
58
-
15. Enter the domain administrator credentials to create the group Managed Service account that will be used to run the agent service. Select **Next**.
59
-
</br>
60
-
16. On the **Connect Active Directory** screen, click **Next**. Your current domain has been added automatically. If you wish to add additional domains, enter them and select **Add Directory**. Then sign in with an administrator account from that domain.
61
-
[](media/how-to-install/new-install-8.png#lightbox)</br>
62
-
17. Optionally, you can manage the preference of domain controllers the agent will use. To do this, click **Add Directory** and select the **Select domain controller priority** checkbox and then order the list of domain controllers. Select **OK**. Click **Next**.
63
-
[](media/how-to-install/new-install-10.png#lightbox)</br>
64
-
18. On the **Agent installation** screen, confirm settings and the account that will be created and select **Confirm**.
65
-
[](media/how-to-install/new-install-11.png#lightbox)</br>
66
-
20. After this operation finishes, you should see **Your agent installation is complete.** Select **Exit**.
67
-
21. If you still see the initial **Microsoft Azure AD Connect Provisioning Agent Package** screen, select **Close**.
Agent verification occurs in the Azure portal and on the local server that's running the agent.
71
-
72
-
### Azure portal agent verification
73
-
To verify the agent is being seen by Azure:
74
-
75
-
1. Sign in to the Azure portal.
76
-
2. On the left, select **Azure Active Directory** > **Azure AD Connect**. In the center, select **Manage cloud sync**.
77
-
</br>
78
-
3. On the **Azure AD Connect cloud sync** screen, select **Review all agents**.
79
-
</br>
80
-
4. On the **On-premises provisioning agents** screen, you see the agents you installed. Verify that the agent in question is there and is marked *active*.
81
-
</br>
82
42
83
-
### On the local server
84
-
To verify that the agent is running:
85
-
86
-
1. Sign in to the server with an administrator account.
87
-
2. Open **Services** by going to it or by selecting **Start** > **Run** > **Services.msc**.
88
-
3. Under **Services**, make sure **Microsoft Azure AD Connect Agent Updater** and **Microsoft Azure AD Connect Provisioning Agent** are present. Also, ensure the status is *Running*.
89
-
>The agent has been installed, but it must be configured and enabled before it will start synchronizing users. To configure a new agent, see [Create a new configuration for Azure AD Connect cloud sync](how-to-configure.md).
@@ -103,15 +57,19 @@ To use password writeback and enable the self-service password reset (SSPR) serv
103
57
For more information on using password writeback with Azure AD Connect cloud sync, see [Tutorial: Enable cloud sync self-service password reset writeback to an on-premises environment (preview)](../../active-directory/authentication/tutorial-enable-cloud-sync-sspr-writeback.md).
104
58
105
59
## Installing against US govt cloud
106
-
By default, the Azure Active Directory (Azure AD) Connect provisioning agent installs against the default Azure cloud environment. If you are installing the agent for use in the US government cloud do the following:
107
60
108
-
- In step #7 above, instead of click **Open file**, go to start run and navigate to the **AADConnectProvisioningAgentSetup.exe** file. In the run box, after the executable, enter **ENVIRONMENTNAME=AzureUSGovernment** and click **Ok**.
109
-
[](media/how-to-install/new-install-12.png#lightbox)</br>
61
+
By default, the Azure Active Directory (Azure AD) Connect provisioning agent installs against the default Azure cloud environment. If you're installing the agent for use in the US government, follow these steps:
62
+
63
+
- In step #7 above, instead of select **Open file**, go to start run and navigate to the **AADConnectProvisioningAgentSetup.exe** file. In the run box, after the executable, enter **ENVIRONMENTNAME=AzureUSGovernment** and select **Ok**.
64
+
65
+
[](media/how-to-install/new-install-12.png#lightbox)
110
66
111
67
## Password hash synchronization and FIPS with cloud sync
68
+
112
69
If your server has been locked down according to Federal Information Processing Standard (FIPS), then MD5 is disabled.
113
70
114
-
**To enable MD5 for password hash synchronization, perform the following steps:**
71
+
72
+
To enable MD5 for password hash synchronization, perform the following steps:
115
73
116
74
1. Go to %programfiles%\Microsoft Azure AD Connect Provisioning Agent.
117
75
2. Open AADConnectProvisioningAgent.exe.config.
@@ -121,12 +79,12 @@ If your server has been locked down according to Federal Information Processing
121
79
122
80
For reference, this snippet is what it should look like:
123
81
124
-
```
125
-
<configuration>
126
-
<runtime>
127
-
<enforceFIPSPolicy enabled="false"/>
128
-
</runtime>
129
-
</configuration>
82
+
```xml
83
+
<configuration>
84
+
<runtime>
85
+
<enforceFIPSPolicyenabled="false"/>
86
+
</runtime>
87
+
</configuration>
130
88
```
131
89
132
90
For information about security and FIPS, see [Azure AD password hash sync, encryption, and FIPS compliance](https://blogs.technet.microsoft.com/enterprisemobility/2014/06/28/aad-password-sync-encryption-and-fips-compliance/).
21
21
22
22
You can use the environment you create in this tutorial for testing or for getting more familiar with how a hybrid identity works.
23
23
24
-
In this scenario, there is an existing forest synced using Azure AD Connect sync to an Azure AD tenant. And you have a new forest that you want to sync to the same Azure AD tenant. You will setup cloud sync for the new forest.
24
+
In this scenario, there's an existing forest synced using Azure AD Connect sync to an Azure AD tenant. And you have a new forest that you want to sync to the same Azure AD tenant. You'll set up cloud sync for the new forest.
25
25
26
26
## Prerequisites
27
27
### In the Azure Active Directory admin center
@@ -31,9 +31,9 @@ In this scenario, there is an existing forest synced using Azure AD Connect sync
31
31
32
32
### In your on-premises environment
33
33
34
-
1. Identify a domain-joined host server running Windows Server 2012 R2 or greater with minimum of 4GB RAM and .NET 4.7.1+ runtime
34
+
1. Identify a domain-joined host server running Windows Server 2012 R2 or greater with minimum of 4-GB RAM and .NET 4.7.1+ runtime
35
35
36
-
2. If there is a firewall between your servers and Azure AD, configure the following items:
36
+
2. If there's a firewall between your servers and Azure AD, configure the following items:
37
37
- Ensure that agents can make *outbound* requests to Azure AD over the following ports:
38
38
39
39
| Port number | How it's used |
@@ -45,86 +45,57 @@ In this scenario, there is an existing forest synced using Azure AD Connect sync
45
45
If your firewall enforces rules according to the originating users, open these ports for traffic from Windows services that run as a network service.
46
46
- If your firewall or proxy allows you to specify safe suffixes, then add connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If not, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
47
47
- Your agents need access to **login.windows.net** and **login.microsoftonline.com** for initial registration. Open your firewall for those URLs as well.
48
-
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products you may already have these URLs unblocked.
48
+
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products, you may already have these URLs unblocked.
49
49
50
50
## Install the Azure AD Connect provisioning agent
51
-
1. Sign in to the domain joined server. If you are using the [Basic AD and Azure environment](tutorial-basic-ad-azure.md) tutorial, it would be DC1.
52
-
2. Sign in to the Azure portal using cloud-only global admin credentials.
53
-
3. On the left, select **Azure Active Directory**, click **Azure AD Connect** and in the center select **Manage cloud sync**.</br>
6. On the splash screen, **Accept** the licensing terms and click **Install**.</br>
58
-
</br>
59
51
60
-
7. Once this operation completes, the configuration wizard will launch. Sign in with your Azure AD global administrator account. Note that if you have IE enhanced security enabled this will block the sign-in. If this is the case, close the installation, disable IE enhanced security in Server Manager, and click the **AAD Connect Provisioning Agent Wizard** to restart the installation.
61
-
8. On the **Connect Active Directory** screen, click **Add directory** and then sign in with your Active Directory domain administrator account. The domain administrator account should not have password change requirements. In case the password expires or changes, you will need to re-configure the agent with the new credentials. This operation will add your on-premises directory. Click **Next**.</br>
62
-
</br>
52
+
If you're using the [Basic AD and Azure environment](tutorial-basic-ad-azure.md) tutorial, it would be DC1. To install the agent, follow these steps:
63
53
64
-
9. On the **Configuration complete** screen, click **Confirm**. This operation will register and restart the agent.</br>
65
-
</br>
> The group managed service account (for example, CONTOSO\provAgentgMSA$) is created in the same Active Directory domain where the host server has joined.
69
56
70
-
10. Once this operation completes you should see a notice: **Your agent configuration was successfully verified.** You can click **Exit**.</br>
3. On the **Azure AD Connect cloud sync** screen click **Review all agents**.
86
-
</br>
87
-
88
-
4. On the **On-premises provisioning agents screen** you will see the agents you have installed. Verify that the agent in question is there and is marked **active**.
To verify that the agent is running follow these steps:
73
+
93
74
94
-
1. Log on to the server with an administrator account
95
-
2. Open **Services** by either navigating to it or by going to Start/Run/Services.msc.
96
-
3. Under **Services**, make sure **Microsoft Azure AD Connect Agent Updater** and **Microsoft Azure AD Connect Provisioning Agent** are present and the status is **Running**.
109
-
7. On the configuration screen, enter a **Notification email**, move the selector to **Enable** and click **Save**.
110
-
111
79
1. The configuration status should now be **Healthy**.
112
-
80
+
81
+
113
82
114
83
## Verify users are created and synchronization is occurring
115
-
You will now verify that the users that you had in our on-premises directory have been synchronized and now exist in our Azure AD tenant. Be aware that this may take a few hours to complete. To verify users are synchronized do the following.
84
+
85
+
You'll now verify that the users that you had in our on-premises directory have been synchronized and now exist in our Azure AD tenant. This process may take a few hours to complete. To verify users are synchronized, do the following:
116
86
117
87
118
88
1. Browse to the [Azure portal](https://portal.azure.com) and sign in with an account that has an Azure subscription.
119
89
2. On the left, select **Azure Active Directory**
120
90
3. Under **Manage**, select **Users**.
121
-
4. Verify that you see the new users in our tenant</br>
91
+
4. Verify that you see the new users in our tenant
122
92
123
93
## Test signing in with one of our users
124
94
125
95
1. Browse to [https://myapps.microsoft.com](https://myapps.microsoft.com)
126
-
2. Sign in with a user account that was created in our new tenant. You will need to sign in using the following format: ([email protected]). Use the same password that the user uses to sign in on-premises.</br>
2. Sign in with a user account that was created in our new tenant. You'll need to sign in using the following format: ([email protected]). Use the same password that the user uses to sign in on-premises.
97
+
98
+
128
99
129
100
You have now successfully set up a hybrid identity environment that you can use to test and familiarize yourself with what Azure has to offer.
0 commit comments