0

was wondering if anyone has any practical experience with enabling SSO via AADConnect and the new pass-through authentication - https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication ?

Specifically, was wondering if the forest/domain functional level needs to be at Server 2012? The pre-reqs say Server 2012 required to run AAD Connect, but not why.

We have hybrid Azure infrastructure at the moment, so throwing in a 2012 server to run AAD Connect is easy, but upgrading all the DC's in order to increase the forest functional level is going to take some doing, and i would really preder not to have to create an ADFS cluster...

regards, Justin

0

1 Answer 1

0

Found the answers i was looking for (i.e. use password hash, for now at least) - https://blogs.msdn.microsoft.com/samueld/2017/06/13/choosing-the-right-sign-in-option-to-connect-to-azure-ad-office-365/

1
  • Password hash sync is great as you also get the ability of azure ad to report on leaked credentials. PTA does not require Domain controllers to be upgraded. Phs vs pta comes down to your preference to where you want password validation to occur.
    – maweeras
    Aug 3, 2017 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .