05 | AD to Windows Azure AD IT Professionals David Tesar | Microsoft Technical Evangelist David Aiken | Microsoft Group Technical Product Manager

Agenda AD to Windows Azure AD Sync Options Federation Architecture AD to AAD Quickstart

AD to AAD Sync Options

Identities for Microsoft Cloud Services Personal Services Organizational Services User OrgID Organizational Account OnMicrosoft Account (Azure AD Account) Examples: alice@contoso.com alice@contoso.onmicrosoft.com Live ID Microsoft Account Examples: alice@outlook.com alice@live.com Distinct identity systems Microsoft Account to access consumer services like Skydrive, Xbox Live, Outlook.com Organizational Account to access business services like Office 365, CRM Online, Intune For reasons such as Privacy, use-rights there is no direct connection or federation between the two identity systems. Users can use the two identities on their devices independently and simultaneously at times but the two will not identities will not be integrated with each other. User

Cloud-Only / No Integration Directory Synchronization Directory and Federated SSO Office 365 Windows Azure Active Directory Joe@contoso.msonline.com Authentication platform Dynamics CRM Online Contoso customer premises Admin Portal/ PowerShell/GRAPH IdP CORP App IdP AD Directory Store Provisioning platform Windows Intune Joe@contoso.com

Directory Synchronization No Integration Directory Synchronization Directory and Single sign-on (SSO) Office 365 Windows Azure Active Directory Authentication platform Dynamics CRM Online Contoso customer premises Admin Portal/ PowerShell/GRAPH IdP CORP App IdP Directory Store AD Directory Sync (DirSync) Provisioning platform Windows Intune

Directory Synchronization Options DirSync Office 365 Connector PowerShell & Graph API Suitable for Organizations using Active Directory (AD) Supports Exchange Co-existence scenarios Coupled with AD FS, provides best option for federation and synchronization Does not require any additional software licenses Multi-forest available through MCS+Partners Suitable for large organizations with certain AD and Non-AD scenarios Complex multi-forest AD scenarios Non-AD synchronization through Microsoft premier deployment support Requires Forefront Identity Manager and additional software licenses Suitable for small/medium size organizations with AD or Non-AD Not a highly recommended option compared to DirSync or FIM Connector Performance limitations apply with PowerShell and Graph API provisioning PowerShell requires extensive scripting experience PowerShell option can be used where the customer/partner may have wrappers around PowerShell scripts (eg: Self Service Provisioning) As this is a custom solution, Microsoft support may not be able to help if there are issues For provisioning of large number of users, DirSync and FIM are recommended options for reasons of performance. Forefront Identity Manager (FIM) Suitable for all organizations Supports Exchange Co-existence scenarios

Directory and Federated SSO No Integration Directory Synchronization Directory and Federated SSO CORP App Windows Azure Active Directory Authentication platform Dynamics CRM Online Contoso customer premises Trust Active Directory Federation Server 2.0 Admin Portal/ PowerShell/GRAPH IdP Office 365 IdP Directory Store AD Directory Sync (DirSync) Provisioning platform Windows Intune

Federation options AD FS Works with AD Third-party STS Works with AD & Non-AD Shibboleth Works with AD & Non-AD Suitable for medium, large enterprises including educational organizations Recommended option for Active Directory (AD) based customers Single sign-on Secure token based authentication Support for web and rich clients Microsoft supported Requires on-premises servers, licenses & support Suitable for medium, large enterprises including educational organizations Recommended where customers may use existing non-AD FS Identity systems with AD or Non-AD Single sign-on Secure token based authentication Support for web and rich clients Third-party supported Requires on-premises servers, licenses & support Suitable for educational organizations Recommended where customers may use existing non-AD FS Identity systems Single sign-on Secure token based authentication Support for web clients and outlook only Microsoft supported for integration only, no shibboleth deployment support Requires on-premises servers & support Works with AD and other directories on-premises AD FS This is the most recommended option as it is end to end Microsoft support and offers the best customer experience Offers advantage of evolving with Microsoft’s identity strategy Best solution with On-Premises AD Works only with AD On-Premises Supports all web and rich client scenarios Third-party STS This is a good option for customers that currently use third-party Identity systems in their infrastructure Works for both On-Premises AD and Non-AD Stores Verified through ‘Works with Office 365 Program’ – Discussed in the next slide Shibboleth Works only for Web client scenarios and Outlook Lync, certain Office Pro-plus scenarios, Active Sync on mobile will not work

Identity Options Comparison 1. No Integration 2. Directory Only 3. Directory and SSO Appropriate for Smaller orgs without AD on-premise Pros No servers required on-premise Same Domain name for users possible Cons No SSO No 2FA 2 sets of credentials to manage with differing password policies IDs mastered in the cloud Pros Users and groups mastered on-premise Enables co-existence Single server deployment Cons No 2FA until Spring 2013 2 sets of credentials to manage with differing password policies OR Manual / 3rd Party password Sync OR use FIM No SSO Pros SSO with corporate cred IDs mastered on-premise Password policy controlled on-premise 2FA solutions possible Enables hybrid scenarios Location isolation Ideal for multiple forests Cons Additional Servers required for AD FS

Accounts in Windows Azure AD Demo

Federation Architecture

Federated Architecture Active Directory Windows Azure AD AD FS + DirSync AD FS Proxy [Server1] [Server2] Internet CorpNet

AD FS Scalability Planning Users Dedicated Federation Servers Federation server proxies NLB servers Comments <1,000 1 Deploy AD FS on two DCs 1,000–15,000 2 Install NLB on proxies 15,000–60,000 2+1 for every 15,000 users 2+ Install NLB on proxies or use dedicated NLB implementation http://technet.microsoft.com/en-us/library/jj151794.aspx

Federated Architecture on Windows Azure! Windows Azure Subscription VPN Active Directory Windows Azure AD AD FS + AD AD FS Proxy DirSync CorpNet Internet

Quick Start Guide for Integrating a Single Forest On-Premises Active Directory with Windows Azure AD

Quickstart Guide Architecture Windows Server 2012 Windows Server 2012 Active Directory Windows Azure AD AD FS + DirSync AD FS Proxy [Server1] [Server2]

AD to AAD Quickstart Steps Add Domain to Windows Azure AD [Windows Azure from Server1] Activate DirSync [Windows Azure from Server1] Install AD FS Server Role [Server1] Configure AD FS Server [Server1] Install AD FS Proxy (optional) [Server2] Configure AD FS Proxy (optional) [Server2] Configure Inbound SSL Access [Server2] Configure AD Federation Support [Server1] Install & Configure DirSync [Server1]

Demo Pre-requisites & Initial Setup Install and Configure a new AD FS farm

Windows Azure Subscription What we’ve built so far Windows Azure Subscription VPN Active Directory Windows Azure AD AD + AD FS DirSync – Activated, not synced Domain Name – Added, not verified CorpNet Internet

Configure Inbound SSL Access Windows Azure Subscription Domain: Christianboarders.com VPN Active Directory Windows Azure AD AD + AD FS 157.56.167.107 mycloudservice.cloudapp.net CorpNet Internet Internet

TechReady 16 11/20/2018 Install DirSync on WS 2012 [On Server1] Write-QSTitle 'Download, install, and configure the DirSync tool' $DirSyncFilename = $script:CurrentExecutingPath + '\DirSync.exe' if (-not (Require-QSDownloadableFile -FileName $DirSyncFilename -URL 'http://g.microsoftonline.com/0BX10en/571')) { Write-QSError 'DirSync download failed.' return } Write-Host 'Running DirSync installer...' Start-Process -FilePath $DirSyncFilename -ArgumentList @('/quiet') -Wait Note: SQL 2008 R2 Express not officially supported on WS 2012. SP1 is supported, but http://support.microsoft.com/kb/2681562 © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Azure Subscription Final Configuration Windows Azure Subscription VPN Active Directory Windows Azure AD AD FS + AD AD FS Proxy DirSync DirSync – Activated + synced Domain Name – Added + verified CorpNet Internet

Actual Times Taken *Includes auto-install of .Net Framework tools Document Step # PS Script Step # Component of Configuration Actual Time Taken 1 1-2 Initial Software Installation (pre-requisites)*,*** 1 min 12 sec 3 Office 365 Readiness Tool 5 min 48 sec 2 4-5 Add Domain Name in Windows Azure AD 27 sec 6 Activate DirSync Support 10 sec 4 7-14 Install and Configure On-Premise AD FS Server1** 2 min 53 sec 5 15-22 Install and Configure AD FS Proxy Server2*, ***, **** 6 min 12 sec 23-24 Configure Windows Azure AD Federation Support 41 sec 7 25-27 Install and Configure DirSync 3 min 26 sec *Includes auto-install of .Net Framework tools **Includes using self-signed certificate & auto-install of RSAT-DNS tools *** Includes install of Sign-in Assistant & PS Module for MS Online **** Used single-core VM for comparison vs AD FS server VM with 6 cores

Total Time Taken ~20 Minutes http://aka.ms/AD2AAD

Demo My Final Configuration in Production