My Articles Support Center

Contact Us

Why use Azure AD Connect

Azure AD Connect will integrate your on-premises directories with Azure Active Directory. This allows you to provide a common identity for your users for Office 365, Azure, and SaaS applications integrated with Azure AD. This topic will guide you through the planning, deployment, and operation steps. It is a collection of links to the topics related to this area.


Azure AD Connect is the best way to connect your on-premises directory with Azure AD and Office 365. This is a great time to upgrade to Azure AD Connect from Windows Azure Active Directory Sync (DirSync) or Azure AD Sync as these tools are now deprecated are no longer supported as of April 13, 2017.

What is Azure AD Connect

Why use Azure AD Connect

Integrating your on-premises directories with Azure AD makes your users more productive by providing a common identity for accessing both cloud and on-premises resources. Users and organizations can take advantage of the following:

How Azure AD Connect works

Azure Active Directory Connect is made up of three primary components: the synchronization services, the optional Active Directory Federation Services component, and the monitoring component named Azure AD Connect Health.

Azure AD Connect Stack

Install Azure AD Connect

You can find the download for Azure AD Connect on Microsoft Download Center.

Before you start - Hardware and prerequisites
  • Steps to complete before you start to install Azure AD Connect.
Express settings
  • If you have a single forest AD then this is the recommended option to use.
  • User sign in with the same password using password synchronization.
Customized settings
  • Used when you have multiple forests. Supports many on-premises topologies.
  • Customize your sign-in option, such as ADFS for federation or use a 3rd party identity provider.
  • Customize synchronization features, such as filtering and writeback.
Upgrade from DirSync
  • Used when you have an existing DirSync server already running.
Upgrade from Azure AD Sync or Azure AD Connect
  • There are several different methods depending on your preference.

After installation you should verify it is working as expected and assign licenses to the users.

Next steps to Install Azure AD Connect

Download Azure AD ConnectDownload Azure AD Connect
Install using Express settingsExpress installation of Azure AD Connect
Install using Customized settingsCustom installation of Azure AD Connect
Upgrade from DirSyncUpgrade from Azure AD sync tool (DirSync)
After installationVerify the installation and assign licenses

Learn more about Install Azure AD Connect

You also want to prepare for operational concerns. You might want to have a stand-by server so you easily can fall over if there is a disaster. If you plan to make frequent configuration changes, you should plan for a staging mode server.

Supported topologiesTopologies for Azure AD Connect
Design conceptsAzure AD Connect design concepts
Accounts used for installationMore about Azure AD Connect credentials and permissions
Operational planningAzure AD Connect sync: Operational tasks and considerations
User sign-in optionsAzure AD Connect User sign-in options

Configure sync features

Azure AD Connect comes with several features you can optionally turn on or are enabled by default. Some features might sometimes require more configuration in certain scenarios and topologies.

Filtering is used when you want to limit which objects are synchronized to Azure AD. By default all users, contacts, groups, and Windows 10 computers are synchronized. You can change the filtering based on domains, OUs, or attributes.1

Password synchronization synchronizes the password hash in Active Directory to Azure AD. The end-user can use the same password on-premises and in the cloud but only manage it in one location. Since it uses your on-premises Active Directory as the authority, you can also use your own password policy.

Password writeback will allow your users to change and reset their passwords in the cloud and have your on-premises password policy applied.

Device writeback will allow a device registered in Azure AD to be written back to on-premises Active Directory so it can be used for conditional access.

The prevent accidental deletes feature is turned on by default and protects your cloud directory from numerous deletes at the same time. By default it allows 500 deletes per run. You can change this setting depending on your organization size.

Automatic upgrade is enabled by default for express settings installations and ensures your Azure AD Connect is always up to date with the latest release.

Next steps to configure sync features

Configure filteringAzure AD Connect sync: Configure filtering
Password synchronizationAzure AD Connect sync: Implement password synchronization
Password writebackGetting started with password management
Device writebackEnabling device writeback in Azure AD Connect
Prevent accidental deletesAzure AD Connect sync: Prevent accidental deletes
Automatic upgradeAzure AD Connect: Automatic upgrade

Customize Azure AD Connect sync

Azure AD Connect sync comes with a default configuration that is intended to work for most customers and topologies. But there are always situations where the default configuration does not work and must be adjusted. It is supported to make changes as documented in this section and linked topics.

If you have not worked with a synchronization topology before you want to start to understand the basics and the terms used as described in the technical concepts. Azure AD Connect is the evolution of MIIS2003, ILM2007, and FIM2010. Even if some things are identical, a lot has changed as well.

The default configuration assumes there might be more than one forest in the configuration. In those topologies a user object might be represented as a contact in another forest. The user might also have a linked mailbox in another resource forest. The behavior of the default configuration is described in users and contacts.

The configuration model in sync is called declarative provisioning. The advanced attribute flows are using functions to express attribute transformations. You can see and examine the entire configuration using tools which comes with Azure AD Connect. If you need to make configuration changes, make sure you follow the best practices so it is easier to adopt new releases.

Next steps to customize Azure AD Connect sync

All Azure AD Connect sync articlesAzure AD Connect sync
Technical conceptsAzure AD Connect sync: Technical Concepts
Understanding the default configurationAzure AD Connect sync: Understanding the default configuration
Understanding users and contactsAzure AD Connect sync: Understanding Users and Contacts
Declarative provisioningAzure AD Connect Sync: Understanding Declarative Provisioning Expressions
Change the default configurationBest practices for changing the default configuration

Configure federation features

Azure AD Connect provides several features that simplify federating with Azure AD using AD FS and managing your federation trust. Azure AD Connect supports AD FS on Windows Server 2012R2 or later.

Update SSL certificate of AD FS farm even if you are not using Azure AD Connect to manage your federation trust.

Add an AD FS server to your farm to expand the farm as required.

Repair the trust with Azure AD in a few simple clicks.

ADFS can be configured to support multiple domains. For example you might have multiple top domains you need to use for federation.

if your ADFS server has not been configured to automatically update certificates from Azure AD or if you use a non-ADFS solution, then you will be notified when you have to update certificates.

Next steps to configure federation features

All AD FS articlesAzure AD Connect and federation
Configure ADFS with subdomainsMultiple Domain Support for Federating with Azure AD
Manage AD FS farmAD FS management and customization with Azure AD Connect
Manually updating federation certificatesRenewing Federation Certificates for Office 365 and Azure AD

More information and references

Version historyVersion history
Compare DirSync, Azure ADSync, and Azure AD ConnectDirectory integration tools comparison
Non-ADFS compatibility list for Azure ADAzure AD federation compatibility list
Configuring a SAML 2.0 IdpUsing a SAML 2.0 Identity Provider (IdP) for Single Sign On
Attributes synchronizedAttributes synchronized
Monitoring using Azure AD Connect HealthAzure AD Connect Health
Frequently Asked QuestionsAzure AD Connect FAQ

Powered by HelpSite