1

Scenario: small company (<200 users), local Active Directory (single domain, 2008R2 level), on-premises deployment of Exchange 2010, Lync 2010 and SharePoint 2013.

The company wants to go full-cloud for Exchange, Lync and SharePoint services, thus is migrating everything to Office 365; however, the local AD will be preserved as the main authentication system, because there are various other application servers and keeping users and computers joined to the domain is a requirement.

In this scenario, should ADFS be used or will DirSync suffice?
Is ADFS required or optional?
If optional, what benefits (and caveats) will it provide over the simpler DirSync-only solution?

3
  • In a nutshell, DirSync provides Same Sign On (authenticate twice with same credentials) - ADFS provides Single Sign On
    – rbrayb
    Nov 28, 2013 at 20:14
  • Not always and not everywhere. Outlook f.e. is unable to perform SSO even if ADFS is deployed.
    – Massimo
    Nov 28, 2013 at 21:02
  • True - and Lync as well IIRC - but I wasn't writing an essay - just a simple rule of thumb that applies to most situations
    – rbrayb
    Nov 29, 2013 at 0:02

2 Answers 2

3

It depends on your needs, if you need to provide SSO to your environment you should deploy ADFS. On the other side if you only want your users use their AD password to log on Office365 you should user DirSync.

In the fomer scenario the authorization is performed by your AD environment and trusted by Office 365. In the DirSync scenario is actually Office365 which will perform the authentication instead of your local AD.

Since your AD will be the main authentication system I cannot see a real reason to deploy ADFS instead of using only DirSync.

5
  • Is it true that ADFS becomes critical for Office 365 login if you deploy it? As in, "if your ADFS server is down you're not going to use anything"?
    – Massimo
    Nov 22, 2013 at 16:51
  • Also, which benefits does ADFS actually offer? The users log in to Office 365 using their AD credentials in both scenarios...
    – Massimo
    Nov 22, 2013 at 16:53
  • 1
    @Massimo for your first question, the answer is YES, it's critical to get at least one DC of your domain to be reachable to get your users authenticated, but this problem is solved using Azure AD. I'm not sure if you get a free Azure AD instance when you purchase a O365 subscription, but it's a solution for your scenario. For the second question, in a Federated scenario actually is your AD who performs the authentication because there is an exchange of security tokens between your AD and the one on Microsoft's cloud. That's the reason why at least one DC of your domain must be reachable... Nov 22, 2013 at 19:21
  • 1
    …by O365 in order to get your users authenticated, because if O365 cannot contact your AD he cannot get the token that authenticates a user from your domain. In that scenario user are still in your domain, not in Microsoft's cloud. On the other side, when you use DirSync you are just "copying" your user's password to the user's account that really exists on Microsoft's cloud, so in this scenario is O365's AD which performs the authentication, not yours. I really think that, since you want to maintain your AD as the main authentication DirSync fits better than ADFS. Nov 22, 2013 at 19:29
  • 1
    Think about this, if you use DirSync, and put O365 URLs on the Intranet Sites security configuration zone on the IE, your users will experience a SSO. Also bear in mind that O365 also deploy a Desktop agent that helps to get that SSO experience... Nov 22, 2013 at 19:31
1

ADFS will allow you to use the same password that is set on AD. The same feature is now provided by DirSync with Password Sync. So ADFS can be avoided. But if deployed whenever you login to office 365 you will be redirected to the ADFS server for authentication. If the ADFS server is down there are chances that you might not be able to authenticate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .