office 365 Azure AD password sync upgrade - success?

acatic · 2013-06-14T15:10:03.000Z

Anyone implemented the recent Azure AD dirsync release?

learn.microsoft.com

What is hybrid identity with Microsoft Entra ID? - Microsoft Entra ID

Hybrid identity is having a common user identity for authentication and authorization both on-premises and in the cloud.

Any issues encountered?

acatic · 2013-06-14T15:19:49.000Z

We already have dirsync, but some users are not perfectly synced. I’m wondering if the sync will push their current on-prem password to the cloud and overwrite their existing cloud password. Would any admin action be necessary?

dehcbad25 · 2013-06-14T15:21:15.000Z

From what I read, the on premises should overwrite the cloud (Azure)

acatic · 2013-06-14T15:28:07.000Z

dehcbad25:

From what I read, the on premises should overwrite the cloud (Azure)

Thank you, Akhmed.

kylanchilders4705 · 2013-06-14T15:54:44.000Z

I just attempted this yesterday. We already have SQL server 2005 running on the server I attempted on. SQLExpress 2012 is installed along with the dirsync utility. They didn’t like to play well. Could not get it to install completely.

acatic · 2013-06-14T15:59:52.000Z

Interesting. I’d think of installing it on the domain controller.

We already installed Azure AD sync actually, we just didn’t turn on the sync yet.

dehcbad25 · 2013-06-14T16:00:15.000Z

jffnuggets:

dehcbad25:

From what I read, the on premises should overwrite the cloud (Azure)

Thank you, Akhmed.

Akhmed knows. He has seen it all thru his glass eyes.

BTW, I read the review of Azure IaSS about a month ago, that is where I got the info. It just stuck to me because we will need to do something similar for our 365 deployment, and I have been thinking on having an AD server in the cloud for disaster recovery

kylanchilders4705 · 2013-06-14T17:08:48.000Z

I could be wrong here, but I don’t believe that you can install it on a domain controller. I’d have to look at the requirements again though.

bizdps · 2013-06-16T10:33:05.000Z

This is welcome news for SMBs! Warning businesses to not use ADFS was getting old quickly.

Following up what Kylan said, I don’t feel it’s wise to install SQL Server on a DC anyway.

richardparry · 2013-06-16T18:38:42.000Z

Please post your outcome - I’m using an alternative product at the moment but it’s quite hit and miss, so the official product should do the job?!

acatic · 2013-06-17T17:17:55.000Z

Awesome news indeed. We’re planning it for Wednesday.

As for SQL on DC - I thought the same too. Likely you’re right. Mine isn’t actually installed on a DC, sorry. BUT, I did see it done in a professional tutorial (@xenapptraining.com), where the trainer installed the SQL farm on his DC. I always wanted to ask him why he did that without any comment.

scottalanmiller · 2013-06-17T19:06:18.000Z

jffnuggets:

Anyone implemented the recent Azure AD dirsync release?

http://technet.microsoft.com/en-us/library/dn246918.aspx

Any issues encountered?

Yes, we do this. Huw and Wife of SAM are on the team that handles that.

drwhy · 2013-06-20T15:21:58.000Z

Kylan:

I could be wrong here, but I don’t believe that you can install it on a domain controller. I’d have to look at the requirements again though.

your correct.

learn.microsoft.com

What is hybrid identity with Microsoft Entra ID? - Microsoft Entra ID

Hybrid identity is having a common user identity for authentication and authorization both on-premises and in the cloud.

drwhy · 2013-06-20T15:32:32.000Z

StandingForChildren:

Please post your outcome - I’m using an alternative product at the moment but it’s quite hit and miss, so the official product should do the job?!

I’d love to see how this compares to MessageOps Password Sync tool. What tool are you using?

acatic · 2013-06-20T17:09:11.000Z

Applied it two midnights ago. So far, so good! Syncs within a couple minutes. No issues reported.

acatic · 2013-06-20T17:09:54.000Z

We have about 400 users at a few dozen locations.

drwhy · 2013-06-21T17:41:26.000Z

Here is a good article on the security of the password synchronization.

https://www.cogmotive.com/blog/office-365-tips/how-secure-is-dirsync-with-password-synchronisation

roelstra · 2013-06-25T16:41:31.000Z

I was looking at implementing the Message Ops Password Sync but I’d much rather use this. Is it possible to do the upgrade but not have the passwords sync at first?

drwhy · 2013-06-25T16:51:49.000Z

You can install Dirsync without password sync enabled. When your ready to sync passwords, you can run the Dirsync configuration and enable password sync.

Additionally, DirSync does not sync password like the Message Ops Password Sync tool. Because DirSync doesn’t have to intercept the password change before syncing it, it actually syncs the users current password upon it’s first sync which means your users don’t have to change their passwords upon the first sync.

Hope this helps.

roelstra · 2013-06-25T16:56:58.000Z

Dr.Why:

You can install Dirsync without password sync enabled. When your ready to sync passwords, you can run the Dirsync configuration and enable password sync.

Additionally, DirSync does not sync password like the Message Ops Password Sync tool. Because DirSync doesn’t have to intercept the password change before syncing it, it actually syncs the users current password upon it’s first sync.

Hope this helps.

That does indeed help! Thanks a ton!

What kind of upgrade is this? Is it “in place” where we can install it directly on top of the current DirSync install or will we need to remove the current utility and then install this?

Also, we’re running SQL Server Express 2k8r2 on the server handling the DirSync utility. Has anyone running that version of SQL experienced any issues with the install?