You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-domain-services/deploy-sp-profile-sync.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Enable SharePoint User Profile service with Microsoft Entra DS | Microsoft Docs
2
+
title: Enable SharePoint User Profile service with Domain Services | Microsoft Docs
3
3
description: Learn how to configure a Microsoft Entra Domain Services managed domain to support profile synchronization for SharePoint Server
4
4
services: active-directory-ds
5
5
author: justinha
@@ -16,9 +16,9 @@ ms.author: justinha
16
16
---
17
17
# Configure Microsoft Entra Domain Services to support user profile synchronization for SharePoint Server
18
18
19
-
SharePoint Server includes a service to synchronize user profiles. This feature allows user profiles to be stored in a central location and accessible across multiple SharePoint sites and farms. To configure the SharePoint Server user profile service, the appropriate permissions must be granted in a Microsoft Entra Domain Services (Microsoft Entra DS) managed domain. For more information, see [user profile synchronization in SharePoint Server](/SharePoint/administration/user-profile-service-administration).
19
+
SharePoint Server includes a service to synchronize user profiles. This feature allows user profiles to be stored in a central location and accessible across multiple SharePoint sites and farms. To configure the SharePoint Server user profile service, the appropriate permissions must be granted in a Microsoft Entra Domain Services managed domain. For more information, see [user profile synchronization in SharePoint Server](/SharePoint/administration/user-profile-service-administration).
20
20
21
-
This article shows you how to configure Microsoft Entra DS to allow the SharePoint Server user profile sync service.
21
+
This article shows you how to configure Domain Services to allow the SharePoint Server user profile sync service.
22
22
23
23
## Before you begin
24
24
@@ -30,7 +30,7 @@ To complete this article, you need the following resources and privileges:
30
30
* If needed, [create a Microsoft Entra tenant][create-azure-ad-tenant] or [associate an Azure subscription with your account][associate-azure-ad-tenant].
31
31
* A Microsoft Entra Domain Services managed domain enabled and configured in your Microsoft Entra tenant.
32
32
* If needed, complete the tutorial to [create and configure a Microsoft Entra Domain Services managed domain][create-azure-ad-ds-instance].
33
-
* A Windows Server management VM that is joined to the Microsoft Entra DS managed domain.
33
+
* A Windows Server management VM that is joined to the Domain Services managed domain.
34
34
* If needed, complete the tutorial to [create a management VM][tutorial-create-management-vm].
35
35
* A user account that's a member of the *Microsoft Entra DC administrators* group in your Microsoft Entra tenant.
36
36
* The SharePoint service account name for the user profile synchronization service. For more information about the *Profile Synchronization account*, see [Plan for administrative and service accounts in SharePoint Server][sharepoint-service-account]. To get the *Profile Synchronization account* name from the SharePoint Central Administration website, click **Application Management** > **Manage service applications** > **User Profile service application**. For more information, see [Configure profile synchronization by using SharePoint Active Directory Import in SharePoint Server](/SharePoint/administration/configure-profile-synchronization-by-using-sharepoint-active-directory-import).
@@ -50,7 +50,7 @@ When added to this security group, the service account for SharePoint Server use
50
50
51
51
The service account for SharePoint Server needs adequate privileges to replicate changes to the directory and let SharePoint Server user profile sync work correctly. To provide these privileges, add the service account used for SharePoint user profile synchronization to the *Microsoft Entra DC Service Accounts* group.
52
52
53
-
From your Microsoft Entra DS management VM, complete the following steps:
53
+
From your Domain Services management VM, complete the following steps:
54
54
55
55
> [!NOTE]
56
56
> To edit group membership in a managed domain, you must be signed in to a user account that's a member of the *AAD DC Administrators* group.
Copy file name to clipboardExpand all lines: articles/active-directory-domain-services/faqs.yml
+9-9Lines changed: 9 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ metadata:
11
11
ms.subservice: domain-services
12
12
ms.workload: identity
13
13
ms.topic: faq
14
-
ms.date: 09/15/2023
14
+
ms.date: 09/23/2023
15
15
ms.author: justinha
16
16
title: Frequently asked questions (FAQs) about Microsoft Entra Domain Services
17
17
summary: This page answers frequently asked questions about Microsoft Entra Domain Services.
@@ -62,20 +62,20 @@ sections:
62
62
- question: |
63
63
Can I enable Microsoft Entra Domain Services using a Resource Manager Template?
64
64
answer: |
65
-
Yes, you can create a Microsoft Entra Domain Services managed domain using a Resource Manager template. A service principal and Microsoft Entra group for administration must be created using the Microsoft Entra admin center or Azure PowerShell before the template is deployed. For more information, see [Create a Microsoft Entra DS managed domain using an Azure Resource Manager template](template-create-instance.md). When you create a Microsoft Entra Domain Services managed domain in the Microsoft Entra admin center, there's also an option to export the template for use with additional deployments.
65
+
Yes, you can create a Microsoft Entra Domain Services managed domain using a Resource Manager template. A service principal and Microsoft Entra group for administration must be created using the Microsoft Entra admin center or Azure PowerShell before the template is deployed. For more information, see [Create a Domain Services managed domain using an Azure Resource Manager template](template-create-instance.md). When you create a Microsoft Entra Domain Services managed domain in the Microsoft Entra admin center, there's also an option to export the template for use with other deployments.
66
66
67
67
- question: |
68
68
Can I add domain controllers to a Microsoft Entra Domain Services managed domain?
69
69
answer: |
70
-
No. The domain provided by Microsoft Entra Domain Services is a managed domain. You don't need to provision, configure, or otherwise manage domain controllers for this domain. These management activities are provided as a service by Microsoft. Therefore, you can't add additional domain controllers (read-write or read-only) for the managed domain.
70
+
No. The domain provided by Microsoft Entra Domain Services is a managed domain. You don't need to provision, configure, or otherwise manage domain controllers for this domain. These management activities are provided as a service by Microsoft. Therefore, you can't add more domain controllers (read-write or read-only) for the managed domain.
71
71
72
72
- question: |
73
73
Can guest users be invited to my directory use Microsoft Entra Domain Services?
74
74
answer: |
75
75
No. Guest users invited to your Microsoft Entra directory using the [Microsoft Entra B2B](../active-directory/external-identities/what-is-b2b.md) invite process are synchronized into your Microsoft Entra Domain Services managed domain. However, passwords for these users aren't stored in your Microsoft Entra directory. Therefore, Microsoft Entra Domain Services has no way to synchronize NTLM and Kerberos hashes for these users into your managed domain. Such users can't sign in or join computers to the managed domain.
76
76
77
77
- question: |
78
-
Can a two-way forest trust be created between Microsoft Entra DS and an on-premises forest?
78
+
Can a two-way forest trust be created between Domain Services and an on-premises forest?
79
79
answer: |
80
80
No. A managed domain supports up to five one-way outbound forest trusts to on-premises forests.
81
81
@@ -109,7 +109,7 @@ sections:
109
109
- question: |
110
110
Is there any quota for the number of machines that I can join to the domain?
111
111
answer: |
112
-
There's no quota in Microsoft Entra DS for domain-joined machines.
112
+
There's no quota in Domain Services for domain-joined machines.
113
113
114
114
- question: |
115
115
Do I have domain administrator privileges for the managed domain provided by Microsoft Entra Domain Services?
@@ -119,7 +119,7 @@ sections:
119
119
- question: |
120
120
Can I modify group memberships using LDAP or other AD administrative tools on managed domains?
121
121
answer: |
122
-
Users and groups that are synchronized from Microsoft Entra ID to Microsoft Entra Domain Services cannot be modified because their source of origin is Microsoft Entra ID. This includes moving users or groups from the AADDC Users managed organizational unit to a custom organizational unit. Any user or group originating in the managed domain may be modified.
122
+
Users and groups that are synchronized from Microsoft Entra ID to Microsoft Entra Domain Services can't be modified because their source of origin is Microsoft Entra ID. This includes moving users or groups from the **AADDC Users** managed organizational unit to a custom organizational unit. Any user or group originating in the managed domain may be modified.
123
123
124
124
- question: |
125
125
How long does it take for changes I make to my Microsoft Entra directory to be visible in my managed domain?
@@ -139,7 +139,7 @@ sections:
139
139
- question: |
140
140
What is the password lifetime policy on a managed domain?
141
141
answer: |
142
-
The default password lifetime on a Microsoft Entra Domain Services managed domain is 90 days. This password lifetime is not synchronized with the password lifetime configured in Microsoft Entra ID. Therefore, you may have a situation where users' passwords expire in your managed domain, but are still valid in Microsoft Entra ID. In such scenarios, users need to change their password in Microsoft Entra ID and the new password will synchronize to your managed domain. If you want to change the default password lifetime in a managed domain, you can [create and configure custom password policies.](password-policy.md).
142
+
The default password lifetime on a Microsoft Entra Domain Services managed domain is 90 days. This password lifetime isn't synchronized with the password lifetime configured in Microsoft Entra ID. Therefore, you may have a situation where users' passwords expire in your managed domain, but are still valid in Microsoft Entra ID. In such scenarios, users need to change their password in Microsoft Entra ID and the new password will synchronize to your managed domain. If you want to change the default password lifetime in a managed domain, you can [create and configure custom password policies](password-policy.md).
143
143
144
144
Additionally, the Azure AD password policy for *DisablePasswordExpiration* is synchronized to a managed domain. When *DisablePasswordExpiration* is applied to a user in Microsoft Entra ID, the *UserAccountControl* value for the synchronized user in the managed domain has *DONT_EXPIRE_PASSWORD* applied.
145
145
@@ -163,7 +163,7 @@ sections:
163
163
- question: |
164
164
Why do my domain controllers change names?
165
165
answer: |
166
-
It is possible that during the maintenance of domain controllers there is a change in their names. To avoid problems with this type of change, it is recommended to not use the names of the domain controllers hardcoded in applications and/or other domain resources, but the FQDN of the domain. This way, no matter what the names of the domain controllers are, you won't need to reconfigure anything after a name change.
166
+
It's possible that during the maintenance of domain controllers, there is a change in their names. To avoid problems with this type of change, it's recommended to not use the names of the domain controllers hardcoded in applications and/or other domain resources, but the FQDN of the domain. This way, no matter what the names of the domain controllers are, you won't need to reconfigure anything after a name change.
167
167
- question: |
168
168
Is the password of the KRBTGT account in a managed domain rolled periodically? If so, what is the frequency?
169
169
answer: |
@@ -189,7 +189,7 @@ sections:
189
189
- question: |
190
190
Can I fail over Microsoft Entra Domain Services to another region for a DR event?
191
191
answer: |
192
-
Yes, to provide geographical resiliency for a managed domain, you can create an additional [replica set](tutorial-create-replica-set.md) to a peered virtual network in any Azure region that supports Microsoft Entra DS. Replica sets share the same namespace and configuration with the managed domain.
192
+
Yes, to provide geographical resiliency for a managed domain, you can create another [replica set](tutorial-create-replica-set.md) to a peered virtual network in any Azure region that supports Domain Services. Replica sets share the same namespace and configuration with the managed domain.
193
193
194
194
- question: |
195
195
Can I get Microsoft Entra Domain Services as part of Enterprise Mobility Suite (EMS)? Do I need Microsoft Entra ID P1 or P2 to use Microsoft Entra Domain Services?
0 commit comments