Office 365 disaster recovery

[jonathan.lees]

I'm just in the process of updating our IT disaster recovery plan and I'm having to think about Office 365 as we use it for our email services and also for storage, teams, sway etc. We use Azure AD sync for account management and in a worst case scenario if our AD DS was irrevocable and we had a to build a new domain, I understand that the accounts in Office 365 would transfer over to cloud based accounts but does anyone have any knowledge they could share on how the Office 365 accounts could be migrated over to a new local AD DS domain?

[FN-GM]

As long as the username and FQDN match, when you reinstall the sync it will marry it back up again.

[Steve21]

Not really sure what you're asking here. If you mean fully re-create a local account from o365 I doubt it unless you have a full AzureAD licenses etc as it doesn't store all the information AD holds in O365 only email linked bits.

 

But even if it could, if your entire local network was gone, which would mean all your AADC etc is dead too, wouldn't you restore from it and AADC would still work then? Or do you mean if all backups were gone too? If so what about information releated to the AADC sync accounts for the domain etc?

 

Steve

[jonathan.lees]

ah great, that's good to know, quite simple then...

[jonathan.lees]

Just out of interest, how would we go about it if a new FQDN was used?

[TechMonkey]

Not what you are asking but if you are looking for options we have gone with a cheap (relatively) Azure server setup as a DC, VPN'd to our site. If worst case scenario occurs and our site is razed to the ground we can still log on to or domain, using a VPN, and we can then speed up restoration as we have a DC to build off and replicate from. We have installed the sync software on that server so our SSO will still work.

 

It's one of those things, I'm hoping not to have to use it, I'm hoping it is wasted money but if we ever need it I bet I will be thanking past me.

[Jaymate]

Out of interest how much is relatively cheap azure setup for a dc and vpn?

[jonathan.lees]

Not really sure what you're asking here. If you mean fully re-create a local account from o365 I doubt it unless you have a full AzureAD licenses etc as it doesn't store all the information AD holds in O365 only email linked bits.

 

But even if it could, if your entire local network was gone, which would mean all your AADC etc is dead too, wouldn't you restore from it and AADC would still work then? Or do you mean if all backups were gone too? If so what about information releated to the AADC sync accounts for the domain etc?

 

Steve

 

I don't mean recreating the local account from O365, just worst case scenario our local ADDS fails, backups fails and I have to rebuild a new ADDS from scratch, what happens with the O365 synced accounts beyond converting them to cloud based accounts.

[jonathan.lees]

Not what you are asking but if you are looking for options we have gone with a cheap (relatively) Azure server setup as a DC, VPN'd to our site. If worst case scenario occurs and our site is razed to the ground we can still log on to or domain, using a VPN, and we can then speed up restoration as we have a DC to build off and replicate from. We have installed the sync software on that server so our SSO will still work.

 

It's one of those things, I'm hoping not to have to use it, I'm hoping it is wasted money but if we ever need it I bet I will be thanking past me.

 

sounds like a really good idea for DRP, be interesting to find out how much you are paying, I've briefly looked into using Azure + VPN for backup storage but the pricing is a bit too much for my budget.

[Steve21]

I don't mean recreating the local account from O365, just worst case scenario our local ADDS fails, backups fails and I have to rebuild a new ADDS from scratch, what happens with the O365 synced accounts beyond converting them to cloud based accounts.

 

If you create a new AD and the users match with things like UPN blahblah they'll rematch and convert back to local in that case.

 

Steve

[TechMonkey]

£120 a month. So £1440 a year. Hence I said relative, we weighed it up here and decided it was a price worth paying for easier spin up after a disaster and to allow SSO for external services if our site got cut off. The later was actually our first concern and how we ended up at the solution.

 

Much like insurance, you'll have to weigh it up for your circumstances.

 

This is purely a DC, no storage, not backing up anything to it. It just sits there and gets replication from our onsite DCs.

[mavhc]

£120 a month. So £1440 a year. Hence I said relative, we weighed it up here and decided it was a price worth paying for easier spin up after a disaster and to allow SSO for external services if our site got cut off. The later was actually our first concern and how we ended up at the solution.

 

Much like insurance, you'll have to weigh it up for your circumstances.

 

This is purely a DC, no storage, not backing up anything to it. It just sits there and gets replication from our onsite DCs.

 

Is there an option to only have it run for an hour a day and save money that way?

[TechMonkey]

Is there an option to only have it run for an hour a day and save money that way?

 

That I don't know, sounds feasible if you can ensure the sync happens at that specific time.