Export (0) Print
Expand All

Deploy Office 365 Directory Synchronization in Microsoft Azure

 

Topic Last Modified: 2014-08-03

Summary: Learn how to deploy the Microsoft Azure Active Directory Sync tool on a virtual machine in Microsoft Azure and synchronize your on-premises Active Directory Domain Services (AD DS) to Office 365.

The Azure Active Directory Sync tool (also known as the Directory Synchronization tool, Directory Sync tool, the DirSync tool, or the DirSync server) is a server-based application that you install on a domain-joined server to synchronize your on-premises Active Directory users to Office 365 for professionals and small businesses. You can install the Azure Active Directory Sync tool on a server in Azure or on-premises, but we recommend installing it in Azure for the following reasons:

  • You can provision and configure cloud-based servers faster, making the services available to your users sooner.

  • Azure offers better site availability with less effort.

  • You can reduce the number of on-premises servers in your organization.

In this article:

ImportantImportant:
This solution requires connectivity between your on-premises network and your Azure Virtual Network. For more information, see Connect an on-premises network to a Microsoft Azure virtual network.
ImportantImportant:
This article describes synchronization of a single domain in a single forest. The Azure Active Directory Sync tool synchronizes all Active Directory domains in your Active Directory forest with Office 365. If you have multiple Active Directory forests to synchronize with Office 365, see Multi-forest Directory Sync with Single Sign-On Scenario.
NoteNote:
You might have a question about the difference between Azure Active Directory (Azure AD) and Office 365. Azure AD is the directory service that is used by Office 365. Just like your on-premises Active Directory stores user information for Exchange, SharePoint, Lync, and your custom applications, the Azure AD instance used by Office 365 stores user information for Exchange Online, SharePoint Online, Lync Online, and other custom applications that you build in the cloud.

The following diagram shows the Azure Active Directory Sync tool on a virtual machine in Azure synchronizing on-premises Active Directory Domain Services (AD DS) to Office 365.

DirSync Overview

In the diagram, there are two networks connected by a VPN connection. There is an on-premises network where AD DS is located, and there is an Azure virtual network with a virtual machine running the Azure Active Directory Sync tool. There are two main traffic flows originating from the server hosting the Azure Active Directory Sync tool:

  • The Azure Active Directory Sync tool queries a domain controller on the on-premises network for changes to accounts and passwords.

  • The Azure Active Directory Sync tool sends the changes to accounts and passwords to the Azure AD instance of your Office 365 subscription. These changes are sent through the on-premises network’s proxy server.

NoteNote:
This solution describes synchronization of a single Active Directory domain, in a single Active Directory forest. The Azure Active Directory Sync tool synchronizes all Active Directory domains in your Active Directory forest with Office 365. If you have multiple Active Directory forests to synchronize with Office 365, see Multi-forest Directory Sync with Single Sign-On Scenario.

In both cases, the traffic originated by the Azure Active Directory Sync tool is forwarded to a VPN gateway on the virtual network in Azure, which then forwards the traffic across the site-to-site VPN connection to the VPN gateway device on the on-premises network. The routing infrastructure of the on-premises network then forwards the traffic to its destination, such as a domain controller or a proxy server.

There are two phases when you deploy this solution:

  1. Creating an Azure virtual network and establishing a site-to-site VPN connection to the on-premises (organization) network. For more information, see Connect an on-premises network to a Microsoft Azure virtual network.

  2. Installing the Azure Active Directory Sync tool on a domain-joined virtual machine in Azure, and then synchronizing Active Directory to Office 365 involves:

    1. Creating an Azure Virtual Machine to host the Azure Active Directory Sync tool.

    2. Installing the Azure Active Directory Sync tool (DirSync.exe).

    3. Configuring the Azure Active Directory Sync tool by adding the Azure AD administrator account and the on-premises Enterprise Administrator account, and then enabling password synchronization.

    4. Running the Azure Active Directory Sync tool to synchronize the on-premises Active Directory to Office 365.

ImportantImportant:
When the Azure Active Directory Sync tool configuration completes, the Azure Active Directory Sync tool does not save the on-premises Enterprise Administrator account.
NoteNote:
This solution describes synchronizing a single Active Directory forest to Office 365. The topology discussed in this article represents only one way to implement this solution. Your organization’s topology might differ based on your unique network requirements and security considerations.

Before you begin, review the following prerequisites for this solution:

  • Review the related planning content in Plan your Azure Virtual Network.

  • Ensure you meet all prerequisites for configuring the Azure Virtual Network.

  • Have an Office 365 subscription, which includes the Active Directory integration feature. For information about Office 365 subscriptions, go to the Office 365 subscription page.

  • Provision one Azure Virtual Machine that runs the Azure Active Directory Sync tool to synchronize your Active Directory forest with Office 365.

  • You must have the credentials for the Active Directory Enterprise Administrator account and the Azure Active Directory Administrator account.

The following list represents the design choices made in this solution’s design. For additional solution design choices, see the Variations to solution design section in this topic.

  • This solution uses a single Azure virtual network with a site-to-site VPN connection. The Azure virtual network hosts a single subnet that contains one server that is running the Azure Active Directory Sync tool.

  • On the on-premises network, a domain controller (to be synchronized with Office 365) and DNS servers exist.

  • The Azure Active Directory Sync tool is used for password synchronization instead of single sign-on (you do not have to deploy an Active Directory Federation Services (AD FS) infrastructure). To learn more about password synchronization and single sign-on options, see Determine which directory integration scenario to use.

There are additional design choices that you might consider when you deploy this solution in your environment. These include the following:

  • If there are existing DNS servers in an existing virtual network, determine whether you want your directory synchronization server to use them for name resolution instead of the on-premises network's DNS servers.

  • If there are domain controllers in an existing Azure virtual network, determine whether configuring Active Directory Sites and Services may be a better option for you. The directory synchronization server can use the domain controllers in Azure to look for changes in accounts and passwords instead of domain controllers on the on-premises network.

Deploying the Azure Active Directory Sync tool on Azure consists of four phases, as shown in the following diagram.

DirSync Workflow

 

Phase Description

Phase 1

Prepare your Azure environment

Phase 2

Set up your Office 365 subscription to allow Active Directory synchronization

Phase 3

Install and configure the Azure Active Directory Sync Tool

Phase 4

Assign licenses to users in Office 365

Create the Azure Virtual Machine for the Azure Active Directory Sync tool, and join it to your on-premises Active Directory domain. For more information about how to create a virtual machine in Azure, see How to create the virtual machine.

ImportantImportant:
If you do not use the Gallery to create your virtual machine, you must manually create a storage account to use with the virtual machine. For more information, see How To Create a Storage Account.

Verify that your virtual machine is joined to the domain by checking your internal DNS to make sure that an Address (A) record was added for the virtual machine with the correct IP address from Azure. For the Azure Active Directory Sync tool to gain access to Internet resources, you must configure the server that runs the Azure Active Directory Sync tool to use the on-premises network's proxy server. You should contact your network administrator for additional configuration steps to perform on the server.

Allow Active Directory synchronization in Office 365 by completing the following steps:

  1. Log on to the Office 365 portal page.

  2. Click Users. Next to Active Directory synchronization, click Set up, and then click Activate.

Complete the following steps to install and configure the Azure Active Directory Sync tool on your Azure Virtual Machine:

  1. On the Azure Virtual Machine, log on by using an account that has local administrator privileges, and then use the following link to download the Azure Active Directory Sync tool: Microsoft Azure Active Directory Sync tool – 64 bit.

  2. Run the setup program, choose an installation path for the tool, and then click Next. The setup wizard installs the tool, which can take up to 10 minutes to complete.

  3. On the last page of the wizard, select Start Configuration Wizard now, and then click Finish to start the Azure Active Directory Sync Tool Configuration Wizard.

  4. Provide the Azure Active Directory Administrator credentials, and then click Next.

  5. Provide the Active Directory Enterprise Administrator credentials, and then click Next.

  6. When prompted, select Enable Password Sync, and then click Next.

  7. When configuration is complete, click Next.

  8. When prompted, select Synchronize your directories now to start synchronization.

CautionCaution:
Setup creates the AAD_xxxxxxxxxxxx account in the Local Users OU. Do not move or remove this account or synchronization will fail.

Activate your Office 365 users by completing the following procedure:

  1. Log on to the Office 365 portal page, and then click Users.

  2. Select the check box next to the user, or users, that you want to activate, and then click Activate synced users.

  3. Under Set user location, select the user’s, or users’, work location.

  4. Under Assign licenses, select the licenses that you want to assign to the user, or users, and then click Next.

  5. On the Send results in email page, select Send email to send a user name and temporary password by email. Enter email addresses, separated by semicolons (;), and then click Activate. You can enter a maximum of five email addresses.

  6. On the Results page, the new user, or users, and a corresponding temporary password are displayed. Click Finish.

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft