- \n
- Managed Authentication:<\/span> Azure AD will handle the authentication locally by using a locally stored hashed version of the password or sends the credentials to an on-premise software agent to be authenticated on the premise by AD DS<\/span><\/li>\n
- Federated Authentication:<\/span> Azure AD redirects the client computer requesting authentication to another identity provider<\/span><\/li>\n<\/ol>\n
\n
<\/p>\n
Managed Authentication<\/h3>\n
- \n
- Password Hash Sync (PHS):<\/span> Azure AD performs the authentication itself (recommended option). You manage your users on premise and the accounts and passwords sync to M365<\/span>
\n<\/span><\/li>\n<\/ol>\n<\/p>\n
\n
- \n
- Pass through authentication (PTA):<\/span> There is an agent on an onsite server and Azure AD passes the requests to the on premise AD DS to perform the authentication. The down site is if your on premise domain goes down you cant authenticate with Azure AD from anywhere.
\nyou manage your users on premise and the accounts sync to Azure AD. Passwords are NOT synced to Azure AD<\/span><\/li>\n<\/ol>\n\n
\n
<\/p>\n
Federated Authentication<\/h3>\n
This is primarily for large enterprise organisations with more complex authentication requirements. Federated authentication can support additional features like<\/p>\n
- \n
- Smart card authentication<\/span><\/li>\n
- 3rd party authentication<\/span><\/li>\n<\/ul>\n
AD DS identities are synced from on premise to Azure AD<\/p>\n
\n
\n
<\/p>\n
Evaluating the Requirements and Solutions for Hybrid Identity Management<\/h1>\n
\n
– Clean up Active Directory as best you can beforehand (replication errors, DcDIAG, Sync errors etc…). You just need to go back 100 days<\/p>\n
– Microsoft recommends you have a good understanding of the issues in your on premise environment before syncing to the cloud<\/p>\n
– tools such as IdFix (these can help you clean up AD) and AD Connect Health can generate a lot of false positives<\/p>\n
\n
\n
<\/p>\n
Sync Scope and Object Filtering<\/h2>\n
Try and clean up AD to remove objects that are no longer required<\/p>\n
Removing objects that don’t need to be synced has benefits:<\/p>\n
– fewer sources of sync errors<\/p>\n
– faster sync cycles<\/p>\n
– less garbage to carry forward<\/p>\n
\n
<\/p>\n
Examples of objects to be excluded:<\/span><\/p>\n
– service accounts that aren’t needed for cloud apps<\/p>\n
– groups that are needed for cloud scenarios<\/p>\n
– users or contacts from external orgs<\/p>\n
– computer accounts where users aren’t meant to access cloud apps. EG: servers<\/p>\n
\n
<\/h2>\n
Sync Failover or Disaster Recovery<\/h2>\n
You can only have one production Azure AD connect server running at a time.<\/p>\n
If the server running Azure AD connect goes offline the sync cannot occur.<\/p>\n
\n
There are 2 main strategies to resolve this:<\/p>\n
– Deploy Azure AAD connect server in Staging Mode. the “staging” server can be promoted to Production in the case of a failure<\/p>\n
– Use virtualisation resources to redeploy the VM running Azure AD Connect<\/p>\n
\n
<\/p>\n
Enabling Staging Mode<\/span><\/p>\n
When going through the Azure AD Connect setup wizard there is a checkbox that allows you to enable staging mode.<\/p>\n
\n
\n
<\/h2>\n
Source Anchor<\/h2>\n
This is an attribute that uniquely identifies an object as being the same object on premise and in Azure AD. This attribute is also called “immutable”. These terms are interchangeable.<\/p>\n
This attribute cannot be changed.<\/p>\n
\n
The usual attribute used is ms-DS-consistencyguid<\/p>\n
\n
<\/h1>\n
Evaluating Requirements and Solutions for Authentication with SSO,PHS, PTA ADFS<\/h1>\n
To choose an authentication method you need to think of the time, existing infrastructure, complexity and cost of implementing your choice.<\/p>\n
\n
<\/h2>\n
Azure AD Password Hash Sync<\/h2>\n
- \n
- The simplest way to enable authentication for on-premise objects in Azure AD<\/span><\/li>\n
- No need for additional infrastructure<\/span><\/li>\n
- Some premium features, like Identity Protection and Azure AD Domain Services, require PHS no matter which authentication method you use<\/span><\/li>\n
- Doesn\u2019t support 3rd party authentication<\/span><\/li>\n
- This is part of Azure AD Connect and runs every 2 mins<\/span><\/li>\n<\/ul>\n
\n
\n
<\/h2>\n
Azure AD Pass Through Authentication<\/h2>\n
- \n
- Uses a software agent that runs on an on premise server(recommended 3)<\/span><\/li>\n
- Password validation happens on-premise, not in the cloud<\/span><\/li>\n
- Companies with security requirements to immediately enforce on premise user account states, password policies, and sign in hours might use this method<\/span><\/li>\n
- Doesn\u2019t support 3rd party authentication<\/span><\/li>\n
- If you lose connectivity from outside to your on premise infrastructure you can’t authenticate with the cloud<\/span><\/li>\n<\/ul>\n
\n
<\/h2>\n
Federated Authentication<\/h2>\n
- \n
- Azure AD hands off the authentication process to a separate trusted authentication system such as AD FS to validate users<\/span><\/li>\n
- This can be expensive and complex<\/span><\/li>\n
- Can you 3rd party non Microsoft solutions for authentication<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
Evaluating Requirements and Solutions – Sync for PHS, PTA and ADFS SAML Federation Authentication for Hybrid Identity Managed Authentication: Azure AD will handle the authentication locally by using a locally stored hashed version of the password or sends the credentials to an on-premise software agent to be authenticated on the premise by AD DS […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[13,12,3],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts\/804"}],"collection":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=804"}],"version-history":[{"count":2,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts\/804\/revisions"}],"predecessor-version":[{"id":806,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts\/804\/revisions\/806"}],"wp:attachment":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=804"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=804"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=804"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- This can be expensive and complex<\/span><\/li>\n
- Password validation happens on-premise, not in the cloud<\/span><\/li>\n
- No need for additional infrastructure<\/span><\/li>\n
- 3rd party authentication<\/span><\/li>\n<\/ul>\n
- Smart card authentication<\/span><\/li>\n
- Pass through authentication (PTA):<\/span> There is an agent on an onsite server and Azure AD passes the requests to the on premise AD DS to perform the authentication. The down site is if your on premise domain goes down you cant authenticate with Azure AD from anywhere.
- Federated Authentication:<\/span> Azure AD redirects the client computer requesting authentication to another identity provider<\/span><\/li>\n<\/ol>\n