Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
For organizations that keep user accounts in an on-premises Active Directory Domain Services (AD DS) forest, a tool called Microsoft Entra Connect is used to synchronize those identities to the cloud-based Microsoft Entra ID. This process copies user accounts and group memberships, allowing users to sign into cloud services with the same username and password they use on-premises. The synchronization is one-way by default, from the on-premises AD DS to Microsoft Entra ID, creating a unified identity across both environments.
Microsoft Entra Domain Services provides a managed domain in Azure. Unlike running your own domain controllers on virtual machines, this is a platform service that Microsoft manages, handling updates, backups, and security patches for you. It offers traditional domain services like domain join for virtual machines, group policy management, and support for LDAP, Kerberos, and NTLM authentication protocols. This enables legacy applications that require these older authentication methods to run in Azure without needing a connection back to your on-premises network.
Once synchronization and the managed domain are set up, you must validate that the identity system works as a whole. Users should be able to authenticate to resources in both environments using their single set of credentials. Group policies created in the managed domain should apply correctly to Azure virtual machines that are domain-joined to it. This consistency ensures that security policies and user experiences are uniform, whether an application is hosted on-premises or in Azure.
The integration supports different migration strategies. A hybrid identity model uses Microsoft Entra Connect to sync on-premises AD DS with the cloud. This allows for a phased migration where some applications move to Azure while others remain on-premises, all using the same directory. In a cloud-only scenario, where there is no on-premises AD, user accounts are created directly in Microsoft Entra ID, and Microsoft Entra Domain Services provides the managed domain services for Azure resources without any VPN or replication to an on-premises network.
Choosing Microsoft Entra Domain Services over deploying your own domain controller virtual machines reduces operational complexity. Microsoft handles the underlying infrastructure, including high availability and disaster recovery. The service automatically synchronizes identity information from your Microsoft Entra ID tenant, so there is no separate directory to manage. This managed approach simplifies administration and allows IT teams to focus on applications rather than maintaining core directory infrastructure.
StudyCerts
StudyCerts