Sync On-Premises AD with Azure AD using Azure AD Connect

Microsoft has had an evolution of tools over the past few years that allows syncing on-premises Active Directory users with their Azure AD cloud directory service. This has include the legacy Forefront Identity Management product, DirSync, and others. Now, the tool is Azure AD Connect which is a locally installed tool that you install on-premises on a Windows Server and have Azure AD Connect sync with on-premises AD. This is fairly straightforward to configure, however, let’s take a look at how to sync on-premises AD with Azure AD using Azure AD Connect. We will see how this tool is loaded and configured to synchronize your local Active Directory environment with Azure AD.

Why Synchronize On-Premises AD with Azure AD?

You may wonder why you would want to synchronize your on-premises Active Directory environment with Azure AD. There are many reasons to do this in this day and time.

Cloud is becoming the central focal point for most businesses today. If you don’t already have a cloud presence of some type, most likely you are currently looking at migrating to the cloud, or already have a migration underway.

One of the popular reasons driving the configuration of Active Directory synchronization is a migration to Microsoft Office 365 for cloud email and storage.

Synchronizing your directory service on-premises with Azure AD allows you to configure hybrid identity which allows your end users to have a seamless experience between using on-premises resources and those resources that are located in the cloud.

This includes at a very basic level, being able to use the same password in the cloud as they do on-premises. This is an important basis requirement for most businesses. Configuring the directory synchronization between on-premises Active Directory and Azure AD is the mechanism that makes this possible.

Configure Azure AD and Download Azure AD Connect

Before configuring Azure Ad Connect, you need to actually have an Azure AD environment configured. In the lab environment, I simply have an Azure AD free subscription along with my Visual Studio subscription for testing. You need to start the free subscription or one of the paid directory services with your Azure environment.

You will notice there is an entire “blade” underneath Azure AD dedicated to Azure AD Connect. If you click on this blade, you will see the option to download Azure AD Connect as well as the configuration information regarding any current synchronization services configured.

Download Azure AD Connect from Azure AD portal

Azure AD Connect Requirements

The Azure AD Connect utility is a service that you run on-premises. So, you will need a server/VM to run the service. What are the requirements for installing the Azure AD Connect synchronization utility?

Server OSOther software
Windows Server 2012 R2 and later– PowerShell is installed by default, no action is required.
– Net 4.5.1 and later releases are offered through Windows Update. Make sure you have installed the latest updates to Windows Server in the Control Panel.
Windows Server 2008 R2 with Service Pack 1 (SP1)** or Windows Server 2012– The latest version of PowerShell is available in Windows Management Framework 4.0. Search for it on Microsoft Download Center.
– .Net 4.5.1 and later releases are available on Microsoft Download Center.
Windows Server 2008– The latest supported version of PowerShell is available in Windows Management Framework 3.0, available on Microsoft Download Center.
– .Net 4.5.1 and later releases are available on Microsoft Download Center.

Azure AD Connect Installation

Once you have downloaded the Microsoft Azure AD Connect setup file, run the setup. Click Next.

Beginning the Azure AD Connect setup

You are presented with the Azure AD Connect Welcome screen. The screen gives you an overview of the Azure AD Connect tool and also the EULA checkbox.

Overview of Azure AD Connect and EULA

For many the Express Settings will be what they want to configure. The page gives you an overview of what the Express Settings actually do. This includes:

  • Configure synchronization of identities in the current AD forest
  • Configure password hash synchronization from on-premises AD to Azure AD
  • Start an initial synchronization
  • Synchronize all attributes
  • Enable Auto Upgrade

You may also see a warning about a routable domain if you are using a .local or some other domain as I am in the lab environment. Keep in mind you will need to be able to synchronize a domain with the same UPN suffix both on-premises and in your Azure AD environment or the synchronization between them will not work.

Azure AD Connect Express settings

Provide your Azure AD global administrator credentials.

Enter your Azure AD global administrator credentials

Provide your local on-premises Active Directory credentials.

Enter your On-Premises Enterprise Administrator credentials

As mentioned above, you will need to have the same UPN suffixes between on-premises and your Azure AD environment.

Note about UPN suffixes if these differ between on-premises and verified custom domains

Ready to begin the configuration of the synchronization between on-premises and Azure AD. You can check the box to Start the synchronization process when configuration completes as well as you have the option to select the Exchange hybrid deployment if you are setting up hybrid mailflow between on-premises and Office 365.

Ready to configure Azure AD Connect

Configuration finishes. You will see a few checks and warning on certain things such as AD Recycle Bin, synchronization status, etc, depending on settings you chose in the configuration as well as the current settings of your on-premises Active Directory environment.

Configuration of Azure AD Connect completed

Sync On-Premises AD with Azure AD using Azure AD Connect

If you want to reconfigure any of the settings you may have chosen in the initial setup and configuration, just relaunch the Azure Active Directory Connect tool and choose to Configure. Here I am configuring the Domain/OU Filtering options. This allows you to scope down the OUs/users that you want to synchronize between on-premises and Azure AD.

Filtering the OUs that will be synced with Azure AD Connect

Optional features screen allows you to select other options as relevant to your particular environment.

Configuring Azure AD Connect Optional synchronization features

I am selecting the Start the synchronization process when configuration completes option so the initial sync will begin as soon as you click the Configure button.

Ready to Configure – sync azure ad with on-premises ad

The configuration begins and processes through the synchronization of user objects. I also launched the Synchronization Service Manager utility which is installed in the program group for Azure AD Connect.

I have it overlaid on top of the Azure Active Directory Connect tool. As you can see, you can click the Operations button and see the current operations as they complete in the process.

For those that may be familiar with the previous tools, this looks very familiar (identical) with FIM and other tools.


Sure enough, I navigate to the Default Directory, All Users area and I see the two “testusers” that I had housed in the OU I targeted for the synchronization process.

Verifying the on-premises users are created in Azure AD

Azure AD PowerShell Tools

It is worth mentioned and noting here that PowerShell is a great way to interact with Azure AD. You can install the Azure AD PowerShell module by typing in the following:

install-module -Name MSOnline

Additionally, you then connect to your Azure AD environment by the cmdlet:

Installing the MSOnline Azure AD PowerShell Module

Wrapping Up

If you are looking to Sync On-Premises AD with Azure AD using Azure AD Connect, the process is fairly straightforward. I think Microsoft has made strides in making this process easier and better than it used to be with some of the older tools.

Most likely if you are not already doing this, you will be required to synchronize your on-premises environment with the cloud at some point to support hybrid identity initiatives like Office 365 and others.

Subscribe to VirtualizationHowto via Email 🔔

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Brandon Lee

Brandon Lee is the Senior Writer, Engineer and owner at and has over two decades of experience in Information Technology. Having worked for numerous Fortune 500 companies as well as in various industries, Brandon has extensive experience in various IT segments and is a strong advocate for open source technologies. Brandon holds many industry certifications, loves the outdoors and spending time with family.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.