2

I currently have a hybrid environment that's syncing with O365/Azure. Can I run my on prom domain along with Azure AD Domain services at the same time with no conflicts? I'm trying to set up a backup solution for employees to work remotely with access to those same on-prem files utilizing Azure Files and Azure File Sync to sync the on-prem files to a storage account along with Identity-based directory service for Azure File Authentication. But I can't do any of this without Azure AD domain services and I want to know if I can turn it on to rest it with no issues.

Improve this question
2
  • 1
    I'm not sure what you mean. If you are syncing with AADConnect you already have AADS.
    – TheCleaner
    Commented Oct 24, 2019 at 20:45
  • @TheCleaner no you don't. AAD DS is a separate service to AAD providing LDAP and similar services on top of AAD. It is not turned on by default.
    – Sam Cogan
    Commented Oct 29, 2019 at 13:57

1 Answer 1

Reset to default
2

Yes, you can enable AAD DS alongside your on premises domain. This is the "hybrid" approach mentioned in this article.

When you use AAD DS with an Azure AD instance that is synced from on premises then AAD DS creates an instance of AD that contains the users synced to Azure AD. This is effectively a separate AD Domain from your on premises one, that just happens to have your users in it. Things like GPO's, OU structure etc. are not synced into AAD DS.

Improve this answer
3
  • He's already using AADConnect to sync his on-prem AD, so he has an AAD DS instance already that's being sourced from on-prem AD. He can create an additional one with a separate custom domain name if he wants, but that's outside of his question scope. He just needs to enable auth for the storage account: rebeladmin.com/2019/08/… -- unless I'm missing something. You know more about Azure than I do.
    – TheCleaner
    Commented Oct 31, 2019 at 13:33
  • 1
    No, that’s not correct. AAD DS is a separate service, it is not related to AD connect. AAD DS is azure ad domain services, a hosted LDAP instance attached to Azure AD. You enable it as a separate service and pay for it separately.
    – Sam Cogan
    Commented Oct 31, 2019 at 13:36
  • I get you now. I didn't even realize the term referred to their full LDAP offering, but I see it now. docs.microsoft.com/en-us/azure/storage/files/storage-files-faq - it states "Azure File Sync preserves and replicates all discretionary ACLs, or DACLs, (whether Active Directory-based or local) to all server endpoints that it syncs to. Because Windows Server can already authenticate with Active Directory, Azure File Sync is an effective stop-gap option until full support for Active Directory-based authentication and ACL support arrives." - so now I'm curious myself for the OP
    – TheCleaner
    Commented Oct 31, 2019 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .