You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
21
21
22
22
You can use the environment you create in this tutorial for testing or for getting more familiar with cloud sync.
23
23
24
24
## Prerequisites
25
+
25
26
### In the Azure Active Directory admin center
26
27
27
28
1. Create a cloud-only global administrator account on your Azure AD tenant. This way, you can manage the configuration of your tenant should your on-premises services fail or become unavailable. Learn about [adding a cloud-only global administrator account](../fundamentals/add-users-azure-active-directory.md). Completing this step is critical to ensure that you don't get locked out of your tenant.
28
29
2. Add one or more [custom domain names](../fundamentals/add-custom-domain.md) to your Azure AD tenant. Your users can sign in with one of these domain names.
29
30
30
31
### In your on-premises environment
31
32
32
-
1. Identify a domain-joined host server running Windows Server 2016 or greater with minimum of 4GB RAM and .NET 4.7.1+ runtime
33
+
1. Identify a domain-joined host server running Windows Server 2016 or greater with minimum of 4-GB RAM and .NET 4.7.1+ runtime
33
34
34
-
2. If there is a firewall between your servers and Azure AD, configure the following items:
35
+
2. If there's a firewall between your servers and Azure AD, configure the following items:
35
36
- Ensure that agents can make *outbound* requests to Azure AD over the following ports:
36
37
37
38
| Port number | How it's used |
@@ -43,91 +44,131 @@ You can use the environment you create in this tutorial for testing or for getti
43
44
If your firewall enforces rules according to the originating users, open these ports for traffic from Windows services that run as a network service.
44
45
- If your firewall or proxy allows you to specify safe suffixes, then add connections t to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If not, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
45
46
- Your agents need access to **login.windows.net** and **login.microsoftonline.com** for initial registration. Open your firewall for those URLs as well.
46
-
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products you may already have these URLs unblocked.
47
+
- For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products, you may already have these URLs unblocked.
47
48
48
49
## Install the Azure AD Connect provisioning agent
49
-
1. Sign in to the domain joined server. If you are using the [Basic A D and Azure environment](tutorial-basic-ad-azure.md) tutorial, it would be DC1.
50
-
2. Sign in to the Azure portal using cloud-only global admin credentials.
51
-
3. On the left, select **Azure Active Directory**, click **Azure AD Connect**, and in the center select **Manage cloud sync**.
1. Sign in to the domain joined server. If you're using the [Basic AD and Azure environment](tutorial-basic-ad-azure.md) tutorial, it would be DC1.
52
+
53
+
1. Sign in to the Azure portal using cloud-only global admin credentials.
54
+
55
+
1. On the left, select **Azure Active Directory**.
56
+
57
+
1. Select **Azure AD Connect**, and in the center select **Manage Azure AD cloud sync**.
58
+
59
+
60
+
61
+
1. Select **Download agent**, and select **Accept terms & download**.
62
+
63
+
[](media/how-to-install/install-6a.png#lightbox)
64
+
65
+
1. Run the **Azure AD Connect Provisioning Agent Package** AADConnectProvisioningAgentSetup.exe in your downloads folder.
66
+
67
+
1. On the splash screen, select **I agree to the license and conditions**, and select **Install**.
54
68
55
-
4. Click **Download agent**.
56
-
5. Run the Azure AD Connect provisioning agent.
57
-
6. On the splash screen, **Accept** the licensing terms and click **Install**.
69
+
58
70
59
-
71
+
1. Once this operation completes, the configuration wizard will launch. Sign in with your Azure AD global administrator account. If you have Internet Explorer enhanced security enabled, it will block the sign-in. If so, close the installation, [disable Internet Explorer enhanced security](/troubleshoot/developer/browsers/security-privacy/enhanced-security-configuration-faq), and restart the **Azure AD Connect Provisioning Agent Package** installation.
60
72
61
-
7. Once this operation completes, the configuration wizard will launch. Sign in with your Azure AD global administrator account. Note that if you have IE enhanced security enabled this will block the sign-in. If this is the case, close the installation, disable IE enhanced security in Server Manager, and click the **AAD Connect Provisioning Agent Wizard** to restart the installation.
62
-
8. On the **Connect Active Directory** screen, click **Add directory** and then sign in with your Active Directory domain administrator account. NOTE: The domain administrator account should not have password change requirements. If the password expires or changes, you will need to re-configure the agent with the new credentials. This operation will add your on-premises directory. Click **Next**.
73
+
1. On the **Connect Active Directory** screen, select **Authenticate** and then sign in with your Active Directory domain administrator account. NOTE: The domain administrator account shouldn't have password change requirements. If the password expires or changes, you'll need to reconfigure the agent with the new credentials.
63
74
64
-
75
+
65
76
66
-
9. On the **Configuration complete** screen, click **Confirm**. This operation will register and restart the agent.
77
+
1. On the **Configure Service Account screen**, select **Create gMSA** and enter the Active Directory domain administrator credentials to create the group Managed Service Account. This account will be used to run the agent service. To continue, select **Next**.
78
+
79
+
[](media/how-to-install/new-install-7.png#lightbox)
80
+
81
+
1. On the **Connect Active Directory** screen, select **Next**. Your current domain has been added automatically.
82
+
83
+
[](media/how-to-install/new-install-8.png#lightbox)
84
+
85
+
1. On the **Configuration complete** screen, select **Confirm**. This operation will register and restart the agent.
67
86
68
87
69
88
70
-
10. Once this operation completes you should see a notice: **Your agent configuration was successfully verified.** You can click **Exit**.</br>
1. On the left, select **Azure Active Directory**, select **Azure AD Connect** and in the center select **Manage Azure AD cloud sync**.
84
106
85
-
3. On the **Azure AD Connect cloud sync** screen click **Review all agents**.
86
-
</br>
107
+
108
+
109
+
1. On the **Azure AD Connect cloud sync** screen, select
110
+
**Review all agents**.
111
+
112
+
[](media/how-to-install/install-7.png#lightbox)
87
113
88
-
4. On the **On-premises provisioning agents screen** you will see the agents you have installed. Verify that the agent in question is there and is marked **active**.
1. On the **On-premises provisioning agents screen**, you'll see the agents you've installed. Verify that the agent in question is there and is marked **active**.
115
+
116
+
[](media/how-to-install/verify-1.png#lightbox)
90
117
91
118
### On the local server
92
-
To verify that the agent is running follow these steps:
93
119
94
-
1. Log on to the server with an administrator account
95
-
2. Open **Services** by either navigating to it or by going to Start/Run/Services.msc.
96
-
3. Under **Services**, make sure **Microsoft Azure AD Connect Agent Updater** and **Microsoft Azure AD Connect Provisioning Agent** are present and the status is **Running**.
To verify that the agent is running, follow these steps:
121
+
122
+
1. Log on to the server with an administrator account
123
+
124
+
1. Open **Services** by either navigating to it or by going to Start/Run/Services.msc.
125
+
126
+
1. Under **Services**, make sure **Microsoft Azure AD Connect Agent Updater** and **Microsoft Azure AD Connect Provisioning Agent** are present and the status is **Running**.
127
+
128
+
[](media/how-to-install/troubleshoot-1.png#lightbox)
[](media/tutorial-single-forest/configure-1.png#lightbox)
144
+
145
+
1. On the configuration screen, enter a **Notification email**, move the selector to **Enable** and select **Save**.
146
+
147
+
[](media/how-to-configure/configure-2.png#lightbox)
148
+
149
+
1. The configuration status should now be **Healthy**.
150
+
151
+
[](media/how-to-configure/manage-4.png#lightbox)
113
152
114
153
## Verify users are created and synchronization is occurring
115
-
You will now verify that the users that you had in your on-premises directory have been synchronized and now exist in your Azure AD tenant. Be aware that this may take a few hours to complete. To verify users are synchronized do the following.
154
+
155
+
You'll now verify that the users that you had in your on-premises directory have been synchronized and now exist in your Azure AD tenant. The sync operation may take a few hours to complete. To verify users are synchronized, follow these steps:
116
156
117
157
118
158
1. Browse to the [Azure portal](https://portal.azure.com) and sign in with an account that has an Azure subscription.
119
159
2. On the left, select **Azure Active Directory**
120
160
3. Under **Manage**, select **Users**.
121
-
4. Verify that you see the new users in your tenant</br>
161
+
4. Verify that the new users appear in your tenant
122
162
123
163
## Test signing in with one of your users
124
164
125
165
1. Browse to [https://myapps.microsoft.com](https://myapps.microsoft.com)
126
-
2. Sign in with a user account that was created in your tenant. You will need to sign in using the following format: ([email protected]). Use the same password that the user uses to sign in on-premises.</br>
You have now successfully configured a hybrid identity environment using Azure AD Connect cloud sync.
167
+
1. Sign in with a user account that was created in your tenant. You'll need to sign in using the following format: ([email protected]). Use the same password that the user uses to sign in on-premises.
168
+
169
+
130
170
171
+
You've now successfully configured a hybrid identity environment using Azure AD Connect cloud sync.
0 commit comments