Azure AD Connect: Setup for cloud-only management

In today’s rapidly evolving IT landscape, organizations are increasingly looking to enhance their operations by switching to cloud-based environments. One crucial aspect of this transition is managing user identities and groups effectively in the cloud. Azure Active Directory (Azure AD) offers robust capabilities for cloud identity management, but for organizations with legacy on-premises Active Directory environments, a smooth migration process is essential.

In this blog, we’ll learn the process of configuring Azure AD Connect to support cloud-only users and groups, enabling users to seamlessly switch from hybrid environments to a cloud-only model. This blog will cover everything from initial setup and configuration to testing and rollback procedures, providing a step-by-step roadmap for users administrators. 

Steps for setting Azure AD connect configurations and the stage for the current environment:

1. Login to Azure Portal.

2. Click on the Azure AD icon on the home screen.

3. From the Azure AD blade menu, select “Azure AD Connect.”

4. Within the Azure AD connect blade, check the sync status.

5. Ensure that it is set to ‘Enabled’ and check if there has been a recent sync cycle performed.

6. Login to the Azure AD connect server.

7. Open the Azure AD connect console.

8. If a current sync cycle is ongoing, wait for it to complete or the sync service console to stop the sync process.

9. Once the console is opened, click on ‘Configure.’

10. In the configuration wizard, select ‘View current configuration’ and click ‘Next.’

11. Capture screenshots of the settings displayed for later reference.

12. Include settings related to synchronization options, such as selected OUs and extension attributes.

13. Identify a test user managed within the on-premises Active Directory and synchronized by Azure AD Connect.

14. Note that the source for this user is listed as ‘Windows Server AD,’ indicating it’s a synchronized account.

Steps for disabling on-premises sync and beginning the Azure AD connect removing process:

1. Identify the test group for the scenario.

2. Note that the source for this group is ‘Windows Server AD,’ indicating it’s synchronized.

3. Launch a powershell console as an administrator on the Azure AD connect server.

4. Run the command to determine the PowerShell version installed.

5. Get-Host | Select-Object version

6. Now disable the sync cycle schedule, If the powershell version is acceptable

7. Set-ADSyncScheduler -SyncCycleEnabled $false

8. Confirm that the scheduler has been disabled.

9. Note that the services still report as ‘Healthy,’ indicating that the sync process is paused.

10. List Users and Verify Sync Configuration:

11. From a PowerShell console, run this command.

12. Connect-MsolService

13. Sign in with an account with the Global Administrator role.

14. Run the command to see the list of users.

15. Get-MsolUser

16. Verify and record synchronization configuration by running.

17. Get-MsolDirSyncFeatures

18. Test user login.

 Steps for preparing to remove Azure AD Connect services:

• Check the current synchronization status using, a PowerShell console, run this command.

(Get-MsolCompanyInformation).directorysynchronizationenabled

• If synchronization is enabled, disable it using

Set-MsolDirSyncEnabled -EnableDirSync $false

 Backup configuration and rules:

1. Create a backup of the Azure AD connect server virtual machine.

2. Copy the Azure AD Connect installer package and configuration files to a backup location.

3. Create a folder to store exported data.

4. Export Azure AD Connect configuration, run the following on powershell.

5. Get-ADSyncServerConfiguration.

Path “C:\PathToNewFolder\"

6. Export custom enabled sync rules from the Synchronization Rules Editor.

7. Navigating to Programs and features on the Azure AD connect server.

Uninstall Microsoft Azure AD Connect Server

1. Deselect uninstalling supporting components.

2. Complete the uninstallation wizard.

3. Verify removal and wait for changes.

4. Refresh the program list.

5. Monitor the Azure AD connect blade in the Azure portal for changes.

6. Add new attributes to past synchronized test users using the Azure AD portal.

7. Create a new cloud user in the custom domain.

8. Modify group memberships and test user logins to verify functionality.

9. Check the tenant sync status to ensure synchronization is disabled.

10. Re-enable synchronization if necessary using command.

11. Set-MsolDirSyncEnabled -EnableDirSync $true

12. Verify synchronization is re-enabled.

13. Re-establish sync with Azure AD Connect by running the installer for the same version.

14. Select the required settings and continue through the installation process.

15. Ensure objects are joining correctly in the synchronization service manager.

16. Change Azure AD connect server from staging mode to syncing mode.

17. Start the sync process.

18. Verify user and group objects in the Azure AD portal and their source.

Configuring Azure AD Connect to support cloud-only users and groups is a critical step in transitioning to a cloud-based identity management model. By following the outlined steps, organizations can smoothly migrate from hybrid environments to a cloud-only model while ensuring minimal disruption to user access and group memberships.

As organizations continue to embrace cloud technologies, mastering the configuration of Azure AD Connect for cloud-only scenarios becomes increasingly vital. With proper planning and execution, administrators can streamline identity management processes, enhance security, and improve overall operational efficiency in the cloud.