Azure Entra Connect Server

[ashgreenway]

Good morning Hive Mind,

 

I'm looking at setting up a server in Azure that will handle Entra Connect, but wanted some advice from anyone that's done this previously. Here's the scenario:

 

- We have an on-prem AD that currently syncs to a 365 tenancy

- We will be doing a tenant-to-tenant migration in the near future, so the environment will change

- Entra Connect for the on-prem AD is then going to have to point to the new tenant, however...

- This isn't the only tenant-to-tenant migration that will happen to this destination, and we don't want the Entra Connect server to be placed on-prem at any one location. We'd rather have it in the cloud on the destination tenant so future on-prem environments can also point to it

 

I'm ready to set up the Azure server, but I wanted to know if anyone had done something similar before I hit 'Create' in case there's anything in particular I need to watch out for.

 

Advice is welcome, thank you in advance!

[Roberto]

You're asking if EntraID Connect can run in a cloud server in Azure or whatever? Yes this is absolutely fine. I'm syncing about 100,000 objects that way with no issues.

 

Have you looked at Cloud Entra Connect, the new 'serverless' agent based sync? If you don't have anything that represents a hard requirement for Entra ID Connect server (hybrid exchange springs to mind) then this may fit your needs better?

 

One thing to mention as you talk about migrations is that Microsoft will only support one Entra ID Connect server being the 'live' server so you cannot have multiple Entra ID Connect servers in multiple forests syncing to the same Entra ID tenant (well it will probably work if you don't do any writebacks to AD, but its absolutely not supported and microsoft support will point at you and laugh if you log a support call to say you've done this and banjaxed something). This sort of requirement is one thing that cloud connect will support that the traditional server will not.

 

Again, with an eye to migrations as you mention it, I think its the default now for source anchor but make sure you're using MSDS-ConsistencyGuid as your source anchor for the sync.

Edited June 14, 2024 by Roberto

[ashgreenway]

There's nothing in particular that's a hard requirement for a server, providing that Cloud Connect can handle multiple AD Forests (which the documentation seems to suggest it does). Some sites do currently have Hybrid Exchange but we'll be looking at removing that at the same time as doing their migrations if and when it comes round to it.

 

I'll have a deep dive into the Cloud Connect and see if that's a suitable option, thank you for the advice, really appreciate it!