Get Mozilla Firefox
We may regret it (at least I do), but Entra ID is increasingly used in enterprises as Microsoft's cloud solution for user account management. It serves as the user account database for all Microsoft cloud services such as Microsoft Azure and Microsoft 365 to authenticate users. Since many organizations still rely on local Active Directory (AD on-premise), it can be very advantageous to synchronize user accounts from on-premise AD to Entra ID. This synchronization offers several advantages, including streamlined account management—administrators only need to create the account once—and password synchronization.
To enable this synchronization, Microsoft provides a tool called Microsoft Entra Connect (previously known as Azure Connect; staying up to date with Microsoft's naming conventions can be as difficult as staying up to date with this site's CSS changes…).
Make sure you have a version of .Net at least equal to 4.7.2 and Tls with version 1.2. For example, on a Windows 2016 server, I had to update my .Net version and activate Tls to 1.2.
PS C:\> [Net.ServicePointManager]::SecurityProtocol
Ssl3, Tls
If (-Not (Test-Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319'))
{
New-Item 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null
If (-Not (Test-Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319'))
{
New-Item 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null
If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'))
{
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null
If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client'))
{
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null
Another prerequisite in our configuration is to have the E-mail field filled in for the Active Directory user accounts that will be synchronized in Entra. I'm in a case where the local domain is private (std.priv) and therefore different from that of Entra-ID (std.rocks). It is therefore the E-mail field that will contain the link between the on-premise account and the one in Entra-ID.
Download the latest version of Microsoft Entra Connect from the official Microsot website: https://www.microsoft.com/en-us/download/details.aspx?id=47594.
PS C:\> Start-ADSyncSyncCycle -PolicyType Delta
Contact :
