I saw a few questions related to the situation we're in but not the answer I needed;

So we're mostly a cloud based company (G suite, Azure AD etc.) Azure AD has too many limitations, we're going to work with new HR soft that wants a full fledged AD.

So the environment has been setup with Azure AD, all the computers (Windows and mac) are using Azure AD credentials to logon.

Now we would like to create a hybrid environment, I already figured that we will need to rebuild the AD - export Azure AD and recreate on premises AD and then sync with azure AD - now for the questions;

If we recreate the on premises AD - and sync with Azure AD - will this cause the user accounts to be still recognized, or will all workstations need to be reconfiguration to open a new session under the user account and then transfer the data? Or would it re-associate the same session?

One time password change would not be the end of the world. But I remember from AD that if you delete an account, re-create an account with the same details it would be considered a new user, and it would create a new user folder and the old user session you would not be able to logon too. Would this be the same? and if so is there a work around?

  • Is there a reason why you havent looked at Azure AD domain services? e.g. you run HR software in VMs in Azure which are domain joined to Azure AD domain services. azure.microsoft.com/en-gb/services/active-directory-ds – maweeras Apr 1 at 17:22
  • On itself it's interesting but as I would actually like to deploy radius and we've quite a few connectors it seemed more logical to go with something that fits the bill completely rather than 60% – Leto Apr 2 at 4:54

See https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-existing-tenant#sync-with-existing-users-in-azure-ad as this answers how user objects already in AAD are matched with on-premises AD users. Also has a blurb specifically on your scenario about trying to go from AAD --> AD.

You will obviously need to set new passwords in on-premises AD. I suggest using password hash sync with Azure AD connect to keep passwords in sync between on-premises AD and Azure AD.

I dont know your full radius deployment plans but if you are deploying Radius and need to do MFA then you might find https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension useful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.