How to Configure Azure AD Connect Account and Resource Forest Synchronization
Question details
The user needs to understand the requirements and proper configuration steps for synchronizing identities in an Azure AD Connect account-resource forest topology.
- Product
- Azure AD Connect
- Device & OS
- not provided
- Scenario
- Deploying and configuring directory synchronization across multiple on-premises Active Directory forests.
- Observed behavior
- Attempting to synchronize isolated linked mailboxes without their corresponding active accounts causes configuration issues. Proper identity mapping requires matching active accounts, user principal names, and source anchors.
Ensure you have global administrator privileges in Azure Active Directory and Enterprise Administrator access to your on-premises Active Directory forests before modifying your sync topology.
Configure Identity Matching Across Multiple Forests
Join active accounts in the account forest with their linked mailboxes in the resource forest to ensure proper identity synchronization.
In a multiple forest topology, user identities often exist across different directories. Authentication occurs in the account forest, while Exchange mailboxes are maintained in the resource forest. Azure AD Connect must join these separate objects into a single identity before synchronizing them to the cloud.
Ensure that every linked mailbox located in your resource forest has a corresponding, active user account in the associated account forest.
Run the Azure AD Connect configuration wizard. When you reach the 'Identify users' screen, select the option to join user identities across multiple directories.
Map the identities by selecting a reliable matching attribute (such as ObjectSID or Mail). Ensure that the User Principal Name (UPN) and source anchor are properly defined to represent the joined identity in Azure AD.
Document Your Active Directory Infrastructure with WPS Office
While Azure AD Connect handles your complex directory synchronizations, managing the documentation and deployment plans for your IT infrastructure doesn't have to be complicated or expensive. WPS Office is a powerful, lightweight, and completely free office suite designed to help you organize server configurations, IP schemas, and deployment notes effortlessly.
- 1. Download and Install: Visit the official WPS Office website and download the free installation package for your administrative workstation.
- 2. Draft Deployment Documentation: Use WPS Writer to create comprehensive step-by-step guides for your Azure AD Connect rollout.
- 3. Track Sync Status: Utilize WPS Spreadsheet to map out source anchors, UPNs, and organizational units across multiple forests.
Frequently Asked Questions
Can Azure AD Connect automatically create a new account in Active Directory Domain Services?
No. Azure AD Connect primarily reads from your on-premises Active Directory to synchronize objects to Azure AD. You must create the necessary user accounts and organizational units (OUs) in Active Directory before running the configuration wizard, ensuring port 389 is open for LDAP communication.
What happens if I synchronize a linked mailbox without its active account?
If you synchronize an isolated linked mailbox from the resource forest without joining it to the active account from the account forest, the resulting cloud identity will be incomplete and disabled, preventing the user from authenticating.
How should I structure my OUs for a resource forest synchronization?
It is highly recommended to logically align your OU structure. You may find it beneficial to create a new OU in the resource forest that mirrors the structure of the account forest, which significantly simplifies the filtering and synchronization process within Azure AD Connect.
