How can a Azure-AD joined device log in to onpremise Active Directory (for Windows-authentication and SQL-server)

roberth

11/14/23, 4:23 PM

I don't understand how to handle this case:

A laptop is joined to Azure-AD and the user logs in with a PIN-code (for example). This part works fine.

Now the user needs to work with the on-premise domain too. The on-premise AD is synced with Azure-AD using AAD Connect Provisioning Agent Wizard. The NPS Exension for Azure AD is installed so the on-premise Domain Controller can access Azure to authenticate. The Azure users have a Azure AD Premium license.

Now, when the user logs in, the laptop is not logged in to the on-premise AD, right? There are no policies applied, no loginscripts, etc. A LOB-application that connects to a on-premise SQL-server might not accept this user with integraded Windows-authentication because of that.

What is a solution then? Can I join the laptop to the on-premise domain at the same time? If so, how does login work then (what account)?

I know that I can make this work with a RDS-server. Then, if a users logs in, he or she uses his username and password (which is the same in AAD and AD) and NPS Exension for Azure AD is used to authenticate. But what if you don't use RDS and just need to login on the on-premise domain? For example: to use a fileshare or SQL-server that requires Windows-authentication?

671

1 + 1

active-directory

azure-active-directory

azure-active-directory-ds

joeqwerty

11/14/23, 4:27 PM

https://learn.microsoft.com/en-us/azure/active-directory/devices/azuread-join-sso

Score:0

Server

kambm

11/18/23, 11:05 AM

You cannot create users in Azure AD and sync them (back) to on-premises AD. However, you can setup your on-premises AD objects with the same UPN and SMTP addresses that are set in Azure AD. Then you can use Azure AD connect to use SMTP matching and synchronise your AD to Azure AD. I think this will grant them the required permissons on shares that need windows authentication. Test on one user before.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-existing-tenant

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How can a Azure-AD joined device log in to onpremise Active Directory (for Windows-authentication and SQL-server)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.