Getting Started with Azure AD and Hybrid Identities

Transcription

1 Getting Started with Azure AD and Hybrid Identities Jason Himmelstein, SharePoint MVP Office 365 Advisory Services Todd Klindt, SharePoint MVP SharePoint Principal

2 Who is this Todd Klindt guy? SharePoint MVP since 2006 Speaker, writer, consultant, Aquarius, Iowa Native Fan of all sorts of Microsoft technologies Personal Blog Twitter If you re not already sick of him

3 That other guy Jason something SharePoint Server MVP Office 365 Advisory Services Manager, Rackspace ITPro enthusiast, Business Intelligence geek, & general technology fan boy Re-installed Texan, die-hard Spurs, Longhorns, & Jaguars fan Geek Blog: On the GitHub:

4 Agenda History lesson Defining Terminology Active Directory Core Concepts & Concerns Topology & Security Use Cases Homework

5 History lesson

6 History lesson The dark days SharePoint 2003 & 2007

7 History lesson Age of enlightenment - SharePoint 2010

8 History lesson Age of the Internet - SharePoint 2013

9 Defining Terminology

10 Defining Terminology Active Directory DirSync User Principal Name ADFS Azure Active Directory Azure AD Connect Identity as a Service

11 Azure AD Connect: Your Identity Bridge Azure AD Connect (sync + sign on) LDAP Active Directory

12 Hybrid Identity management Azure Active Directory Connect Consolidated deployment assistant for your identity bridge components Common monitoring for your identity bridge components

13 Active Directory Core Concepts & Concerns FSMO roles, AD DNS, WINS, NETBIOS, etc Dirty, dirty directories 2003 (Everyone group) --> 2008 (Authenticated Users group) IsCriticalSystemObject objects not synced (like Domain Users) UPN issues around migration Schema extensions

14 Topology & Security ADFS vs DirSync Multifactor Auth

15 Same Sign On scenario

16 Single Sign On scenario

17 Highly Available Auth scenario

18 Use Cases Old environment moving to a new Hybrid Estate New Farm Identities Extranet situations

19 Pre-requisites for Installing Azure AD Connect Office 365 tenant 1 Registered Domain URL 2 Machines 1 AD Domain Controller (ADDC) Windows 2003 or later 1 Domain member server Windows 2008 or greater But really, Windows 2012 R2

20 Downloads Package downloads on member server Azure AD Connect PowerShell Bits Windows PowerShell cmdlets for Office 365 management and deployment Microsoft Online Services Sign-In Assistant for IT Professionals RTW Azure AD Module for Windows PowerShell

21 CSSA (The Cloud Search Service Application) Introduced in the August 2015 CU for SharePoint 2013 Combines on-prem Search index and SharePoint Online Search Not Federation Search results are not separated Does not require a Search index on-prem Allows cloud services to include on-prem content Getting Comfortable with the new hybrid Cloud Search Service in SharePoint 2013

22 What are we can do It s not over complicating things it s fun! Using PowerShell to manage Office 365 How screw up and lose friends Tales of woe from the field & what not to do Licensing a cat Creating accounts, syncing them & applying licenses

23 Param( ) [Parameter(Mandatory=$true)] [ValidateNotNullOrEmpty()] [string] $User Real world example # Add the Active Directory bits and not complain if they're already there Import-Module ActiveDirectory -ErrorAction SilentlyContinue

24 # Add the Azure Active Directory module Import-Module MSOnline # Define AD group that is synced to AAD and is used for ODFB audience $syncgroupname = "CloudSync" $syncgroup =Get-ADGroup $syncgroupname

25 # Location to AAD Connect manual sync EXE $syncclient = "C:\Program Files\Microsoft Azure AD Sync\Bin\DirectorySyncClientCmd.exe" # Name of the Azure License to apply $license = "reseller-account:enterprisepack"

26 # Azure AD domain suffix $aadsuffix = "rackhybrid4.com" # First, add the user to the group Add-ADGroupMember -Identity $syncgroupname - Members $User # Remind them to recompile their SharePoint audience Write-Host "You'll need to recompile your SharePoint audience to reflect the group change"

27 # Sync up to Azure AD & $syncclient # Now tweak the user in Azure AD # First connect Connect-MsolService # Get the user $aaduser = "$user@$aadsuffix"

28 # Set the user's location. Without that the license will fail Set-MsolUser -UserPrincipalName $aaduser - UsageLocation "US" # Set the user's license Set-MsolUserLicense -UserPrincipalName $aaduser - AddLicenses $license

29 MIM (Microsoft Identity Management) The next version of FIM ILM MIIS What are they trying to hide? Better cloud and Windows 10 & 2016 support Don t upgrade SharePoint FIM AD Team Blog Post

30 The Hybrid Picker Helps you configure your hybrid options Requires August 2015 CU Shows up in Admin Tenant Console Plan for the SharePoint Hybrid Picker

31 Links For Clicking The Microsoft Cloud Show episode on Azure AD dev

32 Q & A