Hybrid Identity — Part 02
Before Synching…
The significance of authentication techniques is covered in the article while configuring a Microsoft Entra hybrid identity system for cloud access. It highlights the importance of carefully selecting properties for userPrincipalName (UPN) to maintain compatibility and describes the idea of SourceAnchor for synchronization. Prior to synchronization, the validation of routable UPN suffixes and custom domains is emphasized. Depending on the requirements of the organization, several authentication solutions, such as Microsoft Identity Manager (MIM), cloud sync, and connect sync are discussed. Lastly, a summary of the Entra Connect deployment architecture is given, with a focus on the elements that are needed to sync objects between Microsoft Entra ID and Active Directory.
Choose THE Authetication Method.
Authentication serves as an organization’s gatekeeper to the new cloud environment, since identity is the new control plane of IT security. Authentication forms the basis of cloud access when you use the Microsoft Entra hybrid identity solution as your new control plane. When configuring a Microsoft Entra hybrid identity solution, selecting the appropriate authentication mechanism is an important first step. You must take into account the time, complexity, cost, and current infrastructure when selecting an authentication mechanism. To choose an authentication method, you need to consider the time, existing infrastructure, complexity, and cost of implementing your choice. These factors are different for every organization and might change over time.
SourceAnchor or Immutableld.
What is SourceAnchor? It is a property that is described as being immutable or never changing over an object’s lifespan. Similar to our ID number.
Following situations make use of this property.
1. When the new sync engine is implemented, it will use the sourceAnchor attribute to link pre-existing objects in Microsoft Entra to the on-premises version, either as a new implementation or as a disaster recovery option.
2. This will be used to hard match an object from Entra ID to an on-premises service when switching from the Cloud alone IDP paradigm to the Synchronise model.
3. To uniquely identify a user with Federation Service, sourceAnchor with UPN will be utilised in the claim.
We can utilise the ObjectGUID as the SourceAnchor in on-premises Active Directory with Single Forest. Conversely, any object characteristic that you are certain will never change can be used as the sourceAnchor. Upon selecting the sourceAnchor, the wizard saves the data to your Microsoft Entra tenant. Future Microsoft Entra Connect installations will take advantage of this data.
The way of Sign in…
Microsoft Entra employs UPN (userPrincipalName) to authenticate the user upon synchronization. But, you have to be careful when selecting the properties to use as the value of userPrincipalName when you synchronize your users. In choosing the characteristic that will supply the UPN value in Azure, one should make sure
- The attribute values follow the format of username@domain in the UPN syntax (RFC 822).
- The values’ suffix corresponds to one of Microsoft Entra ID’s recognized custom domains.
The attributes that we want to use with the UPN can be selected using the Custom Installation option.
Custom domain and UPN.
We do need to confirm that the UPN’s suffix value is a routable domain before synchronizing. For instance, once users have synchronized with the Entra directory encodap.onmicrosoft.com, you would like Dhananjaya to log in to Azure using the on-premises UPN dhananjaya@encodap.xyz. Before we begin the syncing process, we must confirm that encodap.xyz is a verified custom domain in Microsoft Entra ID.If it does not correspond with the Entra-verified domain, encodap.onmicrosoft.com is used in place of the UPN suffix.
Microsoft Entra Connect can only synchronize with domains that are routable. If Microsoft Entra Connect determines that you are operating in an environment that is not a router, it will alert you and advise against using the express settings. If you’re operating in a non-routable domain, then it’s likely that the UPN, of the users, has a non-routable suffix too.
Select the Authetication Tool.
According to the information in Part 01 of the Hybrid Identity Series, we can apply several rules to carry out the Synchronization in accordance with the specifications.
These tools can all achieve comparable outcomes. Thus, choosing the appropriate tool is crucial. In the majority of cases, cloud sync will be the suggested tool. Next, connect sync and, in more complicated or advanced cases, MIM. The ECMA Host would be the recommended tool for on-premises apps. Microsoft offers a tool that allows users to choose the best syncing mechanism through an efficient approach. To determine what is best for your organization, utilise the Check Sync Tool.
Overview of the Entra Connect Deployment.
The provided diagram illustrates the high-level architecture of the provisioning engine in a Microsoft Entra Connect environment. This system connects to Active Directory forests and Microsoft Entra ID for synchronization. The process involves importing information from directories, exporting updates back to directories, and syncing objects within the provisioning engine.
Get Cloud Chronicles: From Concept to Reality’s stories in your inbox
Join Medium for free to get updates from this writer.
Key components and processes include:
1. Connector Space (CS): Objects from connected directories are staged here before processing. Each forest has its own CS, including Microsoft Entra ID.
2. Metaverse (MV): Objects to be synced are created here based on sync rules. Objects must exist in the MV before populating other connected directories. There’s only one MV.
3. Sync Rules: Determine which objects will be created or connected in the MV. They also dictate attribute value copying or transformation between directories.
4. Run Profiles: Bundle process steps for copying objects and their attributes based on sync rules between staging areas and connected directories.
This architecture facilitates synchronization from Active Directory to Microsoft Entra ID, utilizing staging areas, rules, and processes to ensure accurate and efficient data transfer.
What Next..
The Hybrid Identity Article Series isn’t just theoretical — it’s hands-on with multiple activities. Building on what we’ve learned, the series will continue with a scenario-based approach, providing practical insights for real-world application.
Let’s consider a scenario where a fictional company, “Encodap,” wants to implement Azure Active Directory (Azure AD) for single sign-on (SSO) and identity management across their cloud-based applications. They decide to use Azure AD Connect to synchronize their on-premises Active Directory with Azure AD and implement Azure AD Connect for federated authentication using Azure AD Connect.
Scenario: Encodap Implements Azure AD Connect for Single Sign-On
Background:
Encodap is a growing technology company with offices in multiple locations. They have an on-premises Active Directory environment for managing user identities and access to internal resources. Recently, they started using various cloud-based applications for project management, document collaboration, and communication.
Objective:
Encodap wants to streamline user authentication and access management for their cloud-based applications. They aim to implement single sign-on (SSO) using Azure Active Directory to provide a seamless user experience and improve security by centralizing identity management.
Implementation Steps:
- Azure Entra Setup: Encodap creates an Azure Entra tenant in the Azure portal. They configure the necessary settings in Azure AD, such as domain verification and custom branding.
- Azure Entra Connect Installation:Encodap downloads and installs Azure Entra Connect on a dedicated server in their on-premises network.They follow the installation wizard to configure Azure Entra Connect with their on-premises Active Directory.
- 3. Synchronization: Azure Entra Connect synchronizes user accounts, groups, and other directory objects from the on-premises Active Directory to Azure Entra. Encodap schedules regular synchronization tasks to keep the directories up to date.
- Federated Authentication: Encodap decides to implement federated authentication using Azure Entra Connect and Active Directory Federation Services (AD FS). They install and configure AD FS on another server in their on-premises network. Azure AD Connect is configured to use AD FS for federated authentication.
- Cloud Application Integration: Encodap configures their cloud-based applications (e.g., Microsoft 365, Salesforce) to use Azure AD as the identity provider. They enable single sign-on (SSO) for these applications, allowing users to sign in with their Encodap credentials.
- Testing and Rollout: Encodap performs thorough testing to ensure that SSO and federated authentication work as expected. They gradually roll out the solution to different teams within the organization, providing training and support as needed.
Based on this scenario, we will continue starting with Azure Entra Setup in the next Article…
Continue….
Contact Me
If you have any questions or would like to connect, feel free to reach out:
- Email: dhananjayacstc@outlook.com
- LinkedIn: www.linkedin.com/in/dhananjayakurukulasooriya
