Azure AD Connect is the tool use to connect on-premises directory service with Azure AD. It allows users to use same on-premises ID and passwords to authenticate in to Azure AD, Office 365 or other Applications hosted in Azure. Azure AD connect can install on any server if its meets following,
• The AD forest functional level must be Windows Server 2003 or later.
• If you plan to use the feature password writeback, then the Domain Controllers must be on Windows Server 2008 (with latest SP) or later. If your DCs are on 2008 (pre-R2), then you must also apply hotfix KB2386717.
• The domain controller used by Azure AD must be writable. It is not supported to use a RODC (read-only domain controller) and Azure AD Connect does not follow any write redirects.
• It is not supported to use on-premises forests/domains using SLDs (Single Label Domains).
• It is not supported to use on-premises forests/domains using "dotted" (name contains a period ".") NetBios names.
• Azure AD Connect cannot be installed on Small Business Server or Windows Server Essentials. The server must be using Windows Server standard or better.
• The Azure AD Connect server must have a full GUI installed. It is not supported to install on server core.
• Azure AD Connect must be installed on Windows Server 2008 or later. This server may be a domain controller or a member server when using express settings. If you use custom settings, then the server can also be stand-alone and does not have to be joined to a domain.
• If you install Azure AD Connect on Windows Server 2008 or Windows Server 2008 R2, then make sure to apply the latest hotfixes from Windows Update. The installation is not able to start with an unpatched server.
• If you plan to use the feature password synchronization, then the Azure AD Connect server must be on Windows Server 2008 R2 SP1 or later.
• If you plan to use a group managed service account, then the Azure AD Connect server must be on Windows Server 2012 or later.
• The Azure AD Connect server must have .NET Framework 4.5.1 or later and Microsoft PowerShell 3.0 or later installed.
• If Active Directory Federation Services is being deployed, the servers where AD FS or Web Application Proxy are installed must be Windows Server 2012 R2 or later. Windows remote management must be enabled on these servers for remote installation.
• If Active Directory Federation Services is being deployed, you need SSL Certificates.
• If Active Directory Federation Services is being deployed, then you need to configure name resolution.
• If your global administrators have MFA enabled, then the URL https://secure.aadcdn.microsoftonline-p.com must be in the trusted sites list. You are prompted to add this site to the trusted sites list when you are prompted for an MFA challenge and it has not added before. You can use Internet Explorer to add it to your trusted sites.
• Azure AD Connect requires a SQL Server database to store identity data. By default a SQL Server 2012 Express LocalDB (a light version of SQL Server Express) is installed. SQL Server Express has a 10GB size limit that enables you to manage approximately 100,000 objects. If you need to manage a higher volume of directory objects, you need to point the installation wizard to a different installation of SQL Server.
Param( [Parameter(Mandatory=$true, HelpMessage="Must be a file generated using csexport 'Name of Connector' export.xml /f:x)")] [string]$xmltoimport="%temp%\exportedStage1a.xml", [Parameter(Mandatory=$false, HelpMessage="Maximum number of users per output file")][int]$batchsize=1000, [Parameter(Mandatory=$false, HelpMessage="Show console output")][bool]$showOutput=$false)
#LINQ isn't loaded automatically, so force it[Reflection.Assembly]::Load("System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089") | Out-Null
[int]$count=1[int]$outputfilecount=1[array]$objOutputUsers=@()
#XML must be generated using "csexport "Name of Connector" export.xml /f:x"write-host "Importing XML" -ForegroundColor Yellow
#XmlReader.Create won't properly resolve the file location,#so expand and then resolve it$resolvedXMLtoimport=Resolve-Path -Path ([Environment]::ExpandEnvironmentVariables($xmltoimport))
#use an XmlReader to deal with even large files$result=$reader = [System.Xml.XmlReader]::Create($resolvedXMLtoimport) $result=$reader.ReadToDescendant('cs-object')do { #create the object placeholder #adding them up here means we can enforce consistency $objOutputUser=New-Object psobject Add-Member -InputObject $objOutputUser -MemberType NoteProperty -Name ID -Value "" Add-Member -InputObject $objOutputUser -MemberType NoteProperty -Name Type -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name DN -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name operation -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name UPN -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name displayName -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name sourceAnchor -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name alias -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name primarySMTP -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name onPremisesSamAccountName -Value "" Add-Member -inputobject $objOutputUser -MemberType NoteProperty -Name mail -Value ""
$user = [System.Xml.Linq.XElement]::ReadFrom($reader) if ($showOutput) {Write-Host Found an exported object... -ForegroundColor Green}
#object id $outID=$user.Attribute('id').Value if ($showOutput) {Write-Host ID: $outID} $objOutputUser.ID=$outID
#object type $outType=$user.Attribute('object-type').Value if ($showOutput) {Write-Host Type: $outType} $objOutputUser.Type=$outType
#dn $outDN= $user.Element('unapplied-export').Element('delta').Attribute('dn').Value if ($showOutput) {Write-Host DN: $outDN} $objOutputUser.DN=$outDN
#operation $outOperation= $user.Element('unapplied-export').Element('delta').Attribute('operation').Value if ($showOutput) {Write-Host Operation: $outOperation} $objOutputUser.operation=$outOperation
#now that we have the basics, go get the details
foreach ($attr in $user.Element('unapplied-export-hologram').Element('entry').Elements("attr")) { $attrvalue=$attr.Attribute('name').Value $internalvalue= $attr.Element('value').Value
switch ($attrvalue) { "userPrincipalName" { if ($showOutput) {Write-Host UPN: $internalvalue} $objOutputUser.UPN=$internalvalue } "displayName" { if ($showOutput) {Write-Host displayName: $internalvalue} $objOutputUser.displayName=$internalvalue } "sourceAnchor" { if ($showOutput) {Write-Host sourceAnchor: $internalvalue} $objOutputUser.sourceAnchor=$internalvalue } "alias" { if ($showOutput) {Write-Host alias: $internalvalue} $objOutputUser.alias=$internalvalue } "proxyAddresses" { if ($showOutput) {Write-Host primarySMTP: ($internalvalue -replace "SMTP:","")} $objOutputUser.primarySMTP=$internalvalue -replace "SMTP:","" } } }
$objOutputUsers += $objOutputUser
Write-Progress -activity "Processing ${xmltoimport} in batches of ${batchsize}" -status "Batch ${outputfilecount}: " -percentComplete (($objOutputUsers.Count / $batchsize) * 100)
#every so often, dump the processed users in case we blow up somewhere if ($count % $batchsize -eq 0) { Write-Host Hit the maximum users processed without completion... -ForegroundColor Yellow
#export the collection of users as as CSV Write-Host Writing processedusers${outputfilecount}.csv -ForegroundColor Yellow $objOutputUsers | Export-Csv -path processedusers${outputfilecount}.csv -NoTypeInformation
#increment the output file counter $outputfilecount+=1
#reset the collection and the user counter $objOutputUsers = $null $count=0 }
$count+=1
#need to bail out of the loop if no more users to process if ($reader.NodeType -eq [System.Xml.XmlNodeType]::EndElement) { break }
} while ($reader.Read)
#need to write out any users that didn't get picked up in a batch of 1000#export the collection of users as as CSVWrite-Host Writing processedusers${outputfilecount}.csv -ForegroundColor Yellow$objOutputUsers | Export-Csv -path processedusers${outputfilecount}.csv -NoTypeInformation
Great article! Thank you!
Very nice article with all require steps. Helped me alot.