AADSync Installation Guide

Transcription

1 Solutions for the Modern Workforce AADSync Installation Guide Requirements Windows Server 2008, 2008R2, 2012, 2012R2.Net 3.5 and.net 4.5 Installed PowerShell (preferably PS3 or better) Limitations AADSync will always use SQL Express LocalDB When configured, you cannot run the wizard a second time to change configuration Getting Started 1. Create an AD Account for the Sync Service a. You need an account in each forest the Sync Service can use to communicate with Active Directory b. The account will only need the default read permissions a regular user already has in AD c. In a release post-ctp, when it will write back information, the account will also need appropriate write permissions in AD 2. Create an AAD Directory a. Make sure you have an AAD directory you can connect to 3. Create an Account for the AAD Connector a. In your AAD tenant, you need to create an account that has Global Administrator as Organizational Role selected. 4. Turn off Strong Name Signing Verification a. The installation wizard is not yet strongly signed. For that reason, strong name signing must be turned off on the server. i. Go to an elevated cmd prompt and locate sn.exe (it is available with the install package). ii. Run sn Vr *,* Note: The parameters to sn are case sensitive. Installing and Configuring AADSync You must have an account with local administrator privileges to install AADSync. Start by launching the executable named WindowsAzureADConnectionTool. This self-extracting executable will put all required files on the local drive and start the installation guide. If you cancel the installation guide, there will be a shortcut in the start menu and on the desktop.

2 1. Install Prerequisites and AADSync a. The AADSync installer installs all required components: i. SQL Express LocalDB ii. Azure Active Directory Sync Services iii. Sign-In Assistant iv. AAD Connector 2. Connect to Windows Azure Active Directory

3 a. Enter credentials to connect to WAAD 3. Connect to Active Directory Domain Services a. Enter credentials for each of the forests you want to connect to b. These are the accounts created in the Getting Started section c. The user must be able to authenticate in the target forest but does not have to be located in that forest. i. **When you enter the name of the forest, please use the FQDN format 4. Configure Synchronization Options

4 a. Configure Account Join and Identity Federation b. The Account Join will allow you to define how users are represented in the forests entered on the previous page c. A user might either be represented only once across all forests or have a combination of enabled and disabled accounts Setting My users are only represented once across all forests Mail attribute Description All users will be created as individual objects in WAAD. The objects will not join in the metaverse The option will join users and contacts if the mail attribute has the same value in different forests. This option would commonly be used if GALSync has created contacts ObjectSID and msexchangemasteraccountsid This option will join and enable user in an account forest with a disabled user in an Exchange resource forest. This is also known as linked mailbox in Exchange samaccountname and MailNickName This option would join on attributes where it is expected the login ID for the user can be found My own attribute Limitation in CTP: make sure to pick an attribute which will already exist in the metaverse. If you pick a custom attribute the wizard will not be able to complete If you configure to join multiple forests, the default configuration will assume the following: A user will only have only one enabled user account and login information is taken from this forest A user will only have only one Exchange mailbox The data quality for a user is best in the forest where Exchange is located - If an Exchange mailbox is found, common user attributes are taken from this forest The Identity Federation selection is user to configure which attribute is used as the Immutable ID, also known as source anchor, in your on-premises AD for your federation provider to consume. The attribute selected must be immutable, i.e. must not change during the lifetime of the object This would include if the object is moved between domains in a forest or between forests - For the current release (CTP), make sure to select ObjectGUID or a string attribute 5. Configure Optional Settings

5 a. Hybrid Exchange is not supported in the current release (CTP). This option must be unchecked 6. Review and Start Synchronization