Setup Azure File Share with AD authentication (Manual)

With the traditional file server coming to a end, it is time to move along with Azure File Share and AD authentication.

This image has an empty alt attribute; its file name is image-1.png

Pre-requisites:

STEP 1: First, let’s create a new storage account

Continue reading “Setup Azure File Share with AD authentication (Manual)”

Convert AD domain users to Azure AD users (Manual)

With the move to the cloud there might be a time where you would like to remove the Active Directory link (AD Connect) and go for a cloud only strategy. With a few simple steps you can disconnect the AD connect sync from Azure AD.

When you look in your Office 365 environment you will notice that the sync status has different symbols. One for cloud only, and one for Active Directory. To disable the link, open a PowerShell window and run the following steps.

STEP 1: First make sure that you disable the AD Connect sync service by disabling the service, or set it to staging mode.

STEP 2: Connect to your Microsoft Office 365 environment using the following command, and login to the desired environment:

connect-msolservice

STEP 3: Now run the following command to disable the sync, confirm your actions, you cannot undo this change!

Continue reading “Convert AD domain users to Azure AD users (Manual)”

AD Connect Force synchronization

If you have an AD Connect server, you sometimes require a faster sync than the default 30 minutes. This can be done very easily by entering one Powershell command. Open a Powershell window, and load the AD Connect Sync Powershell module:

Import-Module ADSync

Once imported, you have 2 options. For a full sync, type the following command:

Start-ADSyncSyncCycle -PolicyType Initial

For just syncing the changes, type the following:

Start-ADSyncSyncCycle -PolicyType Delta

Go Azure AD joined with on-prem DC and fileserver!

Wouldn’t be cool to migrate all your laptops and desktops to Azure AD, but still have your on-premise file server for the people that can’t say goodbye to their network drives?

Now it is possible! Azure is supporting out of the box, Azure AD domain joined devices to connect with their on-premise domain joined counterparts with credentials (Kerberos) to the good old file and print server!

Requirements

To be able to set this up, you will still need a traditional domain controller with a file/print server. On top of that you will need to synchronize the identities to Azure AD. Make sure that you enable password sync, and start joining the devices to Azure AD.

One other important thing, your device needs to be Windows 10 1607 or higher! Older versions of Windows 10 do not support the Kerberos authentication.

If you now want to map a network drive with the existing NTFS permissions, just map the drive, and start using like you used to do before!

Sync existing office 365 tenant with local active directory

Recently we created an AAD tenant that has no on-premises AD domain counterpart.
Now we are facing an issue where we want to be able to use the identities in this tenant to log into some servers. It would appear that we would need to domain join these servers, but we can’t do this without AD. The question is, how can we continue to setup these servers?

If the servers are hosted on the Azure IaaS platform you can choose to go ahead with Azure AD Domain services as I wrote before:
https://www.cordenboer.nl/2019/04/22/azure-ad-domain-services-an-option-or-not/

But today we are going to install a new domain on-premise. The domain name isn’t relevant for the sync with Azure AD / Office 365. But the UPN for the end users is important! So first we can add the UPN domains by going to the Domain and Trusts console. Add the required domain names.

Continue reading “Sync existing office 365 tenant with local active directory”

Modernizeer je identiteits en toegangs beheer met Azure AD

Door Azure AD als je centrale Identiteit opslag te gebruiken word beheer een stuk makkelijker en veiliger. Door Azure AD te gebruiken kan je voortaan makkelijk samen werken met andere bedrijven. Door gebruikers van een andere organisatie uit te nodigen, is het niet meer noodzakelijk om deze ook nog is lokaal in je eigen AD aan te maken. Mocht een medewerker van een ander bedrijf uit dienst gaan hoeft deze alleen nog maar uitgeschakeld te worden in de partner organisatie. Doordat er alleen een koppeling is vanuit jouw Azure AD wordt ook automatisch de toegang ontzegt tot de data van jouw organisatie.


Hoe zorg je er voor dat je huidige Active Directory modern beschikbaar komt?

Microsoft heeft een tool beschikbaar gesteld waarmee je alle identiteiten, of een selectie daarvan, kan synchroniseren naar Azure AD. Deze tool heet AD Connect en dient lokaal geïnstalleerd te worden op een server. Er zijn 3 mogelijke synchronisatie scenario’s.

Continue reading “Modernizeer je identiteits en toegangs beheer met Azure AD”