11 thoughts on “Multi-Forest Deployment with AADSync

  1. Thanks for your post. Question: We do have on single domain. I would like sync (AADsync) OU “A” to Office 365 Tenant “A” and OU “B” to Office 365 Tenant “B”. This should be possible, right? But how? Thanks for your feedback.

    • When I attended the Office 365 Summit at the beginning of December, this specific question was asked. The presenter (Luca Bandinelli) stated AADSync is not designed, or supported, to sync one Active Directory forest to multiple Office 365 tenants. A discussion ensued about how to possibly configure such an unsupported implementation in a test environment.

      I have not tried what you are asking but, in theory, think it could be done. In the same vain, if you are curious, I would strongly encourage that any one try it out in a lab environment first. If it does work, however, remember that the configuration is not supported by Microsoft (or any one else I know of for that matter).

      In theory, you could install AADSync on two separate machines. I would sign up for 2 trial tenants to test. One AADSync server for one tenant, filtered by OU using the credentials for “tenant A”. And then the second AADSync server for the other tenant, filtered by OU using the credentials for “tenant B”. Do not sync until you have configured filtering for both implementations. Once the filtering is configured, I would think you should be able to sync from one AD forest to multiple O365 tenants.

      Again, this is all in theory and no guarantees are made or given. All of the risk falls squarely on the shoulders of the implementer.

      Who knows…this may all be possible with the next iteration of the Microsoft sync tools in Azure Active Directory Connect (Azure AD Connect). Until it has been made generally available, we will have to wait.

  2. Hi Todd, thanks for your answer. We’ve already tried this approach by using different AADSync servers with OU-based filtering and it worked. However, the keypoint is that we would like to have just ONE AADSync server for all tenants. In my opinion it should be possible to configure multiple sync instances, for example: Customer “A” with UPN suffix a-example.com to Office 365 tenant “A”, Customer “B” with UPN suffix b-example.com to Office 365 tenant “B” and so on…

    Well, as you already mentioned it’s not a supported configuration. I hope Microsoft will bring this feature very soon – in my opinion it’s a mandatory feature for tenant based Active Directory configuration. Anyway, thanks for your help and I wish you a happy new year.

      • As far as I know, they still do not support it and I don’t believe it will be supported with AADSync. However, that could be possible with AAD Connect. That is where they have all of their focus right now, in my opinion. Hopefully, it will come out about the same time Exchange 2016 is released in Q4 2015.

      • Thanks for quick reply Todd, that’s good news for all SPLA hosting companies doing multitenant with customers that wants to use o365 for some services.

      • Hi Daniel,
        I agree with Todd. Next step will be AAD Connect, but: I didn’t read anything about “Multi-Tenand O365 Support”. We’ll see… at the moment we have to use multiple instances/installations on member servers for each tenant…

  3. Hi Guys,
    first of all, I would like to thank for this blog which is it very useful for who use Office 365 for the first time.
    I’ve the same problem of Oliver, i need to sync a multi domain Office365 with a single AD forest.
    From what I understand, its possible if I install two AADSync server ; Now, as suggested, I would like to make some test with my Office 365 E3 Trial account, but i haven’t understand two thing :
    – Is it possible in the trial version add an other domain and, if yes, there is a place where i can create a test domain.
    – Following this article (https://oddytee.wordpress.com/2014/09/24/configure-filtering-with-aadsync/) i’ve made a sync with a single OU, but i’ve used the office365 global admin. How I should create an administrator account for the single domain.
    Thank’s in advice for the help and please excuse any mistakes as English is my second language.
    Regards
    Alfredo

    • Let me reiterate to see if I understand your questions correctly.

      1) You want to add more domains to a trial account?
      2) You want to create another global admin in the existing O365 account?

      Responses…

      1) An Enterprise E3 trial account is not different than a subscription with regards to features and functionality. You will only be limited by time. But, if you contact support they will extend the trial. I’ve used several trials for 6 months at a time–probably could have gone longer.

      2) If you want to test a theory by syncing multiple OUs in one domain using multiple directory sync instances to one O365 account, I suppose you could but I have never attempted that. If that’s the case, just create a new O365 “in cloud” user and assign as global admin, and another on premise account that has Enterprise Admins privileges.

      I hope I understood your questions correctly. Good luck.

    • Hi Alfredo

      Thanks for your answer. No Problem, English is my second language too 😉 However, here is my feedback about your questions.

      1) Totally agree with Todd Nelson. The Office 365 trial accounts are just limited by time, not functionallity.

      2). Not sure, I really understand your question, but: You could create multiple Global Admins (@yourdoman.onmicrosoft.com). This account is comparable with Domain Admins in your On-Premise environment. You could create, for example, a seperate Global Admin for AADSync, like: sa_aadsync@yourdomain.onmicrosoft.com and set “Password Never Expires” with Powershell, because it’s like a Service Account and you don’t want this password to get expired. You need a Global Admin for each Office 365 Tenant obviously, it doesn’t matter how many domains you added for this tenant.

      Keep in mind: AADSync will be called AADConnect soon (new tool). As I know, there is the Public Preview out in the wild at the moment. I read about the new features – there is no multi-tenant Office 365 feature listet in one AADConnect installation 😦

      However, I can confirm the scenario I described in this post earlier is working:

      One Active Directory (one Domain)
      – OU “Customer A” > AADSync to Office 365 Tenant A
      – OU “Customer B” > AADSync to Office 365 Tenant B
      – OU “Customer C” > AADSync to Office 365 Tenant C

      But, what we need for this synchronization scenario is a seperate installation of AADSync on a member server for every tenant, means: Tenant A, B and C have their own member server with ADDSync installed and OU-based filtering configured. It’s NOT SUPPORTED to sync the same object (user, group,…) to different Office 365 tenants! That’s okay for us… we don’t need something like this 😉

      Hope this clears up your questions. Don’t hesitate to ask you questions or tell us about your experiences.

      Regards
      Oliver

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s