Synchronization is a critical aspect of Microsoft 365 Identity and Services. Understanding the prerequisites including connectivity methods, permissions, and server requirements is integral to mastering this aspect of the MS-100 exam.
1. Connectivity Method
When working with Microsoft 365, two primary connectivity methods can be used for synchronization: ExpressRoute and Azure AD Connect.
ExpressRoute:
This is a dedicated network connectivity method between on-premises networks and Azure. It guarantees high availability and minimal latency. Using ExpressRoute avoids passing data through the public internet, thus enhancing security.
Azure AD Connect:
The Azure AD Connect involves integrating your on-premises directories with Azure Active Directory. With this tool, users can manage their Azure services from an on-premises Windows Server Active Directory.
2. Permissions
Properly configured permissions are at the heart of secure and effective synchronization. The two types of permissions to pay keen attention to in Microsoft 365 are: Service administrator and global administrator.
Service Administrator:
They have access to all features within a single service but cannot access or perform operations within another service. An example would be a SharePoint administrator who wouldn’t have access to Exchange services.
Global Administrator:
These can access all administrative features. This is the highest level of permissions and is applied to those who set up the Microsoft 365 or Office 365 account.
3. Server Requirements
Setting up synchronization also demands a carefully-optimized server landscape. Key server requirements include:
- Azure AD Connect Server: This can be deployed on any member server that’s running Windows Server 2008 or later. However, it’s preferable to use Windows Server 2012 R2 or later.
- Domain Server: The domain server used should be running Windows Server 2008 R2 or higher.
- SQL Server: SQL Server 2012 or later is recommended. Full SQL Server installation is supported but isn’t required.
| Parameter | Requirement |
|---|---|
| Azure AD Connect Server | Windows Server 2008 or higher |
| Domain Server | Windows Server 2008 R2 or higher |
| SQL Server | SQL Server 2012 or higher |
In conclusion, understanding the prerequisites of synchronization – connectivity method, permissions, and server requirements – is key to your success in the MS-100 Microsoft 365 Identity and Services exam, and important for the effective management of any Microsoft 365 installation. Always remember to go through the latest official documentation and resources from Microsoft for the most up-to-date and in-depth understanding.
Practice Test
True or False: You need an Azure AD Premium P1 license to synchronize identities from on-premises Active Directory to Azure Active Directory.
- True
- False
Answer: True
Explanation: This license is required for Azure AD Connect sync which provides features such as Password Hash Sync, Seamless Single Sign-On, and Pass-through authentication.
Which of the following are requirements for Azure AD Connect?
- A. SQL Server 2012 or later
- B. .NET Framework 1 or later
- C. PowerShell version 5 or later
- D. Windows Server 2008 or later
Answer: B, D
Explanation: For Azure AD Connect, you need .NET Framework 1 or later. And it also requires Windows Server 2012 or later.
True or False: Azure AD Connect requires a connectivity method such as express or custom in order to synchronize.
- True
- False
Answer: True
Explanation: Azure AD Connect provides options such as express or custom mode for synchronization which aids in choosing the best-suited method for your organization.
Which of the following permissions are mandatory for synchronizing AD with Azure AD Connect?
- A. Enterprise Admin
- B. Domain Admin
- C. Global Administrator
- D. User Administrator
Answer: A, B, C
Explanation: Enterprise and Domain admin permissions are required for on-premises, Global Administrator permission is required for Azure AD.
SQL Server is a prerequisite for which of the following?
- A. Single Sign-On (SSO)
- B. Password Hash Sync
- C. Pass-Through Authentication
- D. None of the above
Answer: D. None of the above
Explanation: SQL Server is not a prerequisite for Single Sign-On, Password Hash Sync, or Pass-Through Authentication.
A port open on the firewall is required for the connectivity methods of Azure AD Connect.
- True
- False
Answer: True
Explanation: Firewall ports need to be open so that the Azure AD Connect tool can communicate with Microsoft 365 services.
Which of the following are server prerequisites for Azure AD Connect?
- A. Active Directory Federation Services
- B. Windows Server 2012
- C. SharePoint Server 2013
- D. SQL Server 2014
Answer: A, B
Explanation: Active Directory Federation Services and Windows Server 2012 are prerequisites for Azure AD Connect. SharePoint Server and SQL Server are not.
True or False: Connectivity for synchronization can be achieved only through the internet.
- True
- False
Answer: False
Explanation: You can establish connectivity using ExpressRoute which is a private connection to Microsoft cloud services, including Azure and Office
For configuring Azure AD Connect, which roles are essential?
- A. Global Admin
- B. Domain Admin
- C. SharePoint Admin
- D. Teams Admin
Answer: A, B
Explanation: To configure Azure AD Connect, the Global Admin role in Azure Active Directory and the Domain Admin role on your local Active Directory are required.
What is a prerequisite for enabling Single Sign-On?
- A. Office 365 License
- B. Azure AD Premium P2 License
- C. SQL Server
- D. None of the above
Answer: D. None of the above
Explanation: Single Sign-On feature does not require any specific licenses or server support. It is a functionality of Azure AD Connect.
Interview Questions
What is the primary connectivity method used for synchronization in Microsoft 365?
The primary connectivity method used for synchronization in Microsoft 365 is called Azure Active Directory Connect.
What are the permission requirements for the account used to run the Azure AD Connect synchronization engine?
The account used to run the Azure AD Connect synchronization engine must have full Administrator permissions in the on-premises Active Directory and in Azure AD.
What server requirements are necessary to run Azure AD Connect?
Azure AD Connect requires a machine running Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, or Windows Server 2019, with 4 GB of RAM and 70 GB of hard drive space available.
What protocols are supported by Azure AD Connect for connectivity?
Azure AD Connect supports several protocols for connectivity, including LDAP, LDAPS, Password Hash Sync, Federation with ADFS, and Pass-through Authentication.
Is a public IP address necessary for the server when implementing Azure AD Connect?
No, a public IP address is not necessary. Azure AD Connect communicates outbound to Azure AD, so as long as the server has connectivity to the internet, a public IP is not required.
Which cloud environments are supported by Azure AD Connect for synchronization?
Azure AD Connect supports a variety of cloud environments, including Microsoft 365, Office 365, Azure Government, and Azure China 21Vianet.
What type of internet connectivity does Azure AD Connect require to ensure proper synchronization?
Azure AD Connect requires a constant, reliable internet connection for synchronization; occasional disruptions can inhibit the sync process.
What type of permissions does the Azure AD Connect account need for the on-premises directories?
The Azure AD Connect synchronization account requires directory changes in permissions for writing back some attributes in the on-premises directory.
In Microsoft 365, can the synchronization process be run manually?
Yes, the synchronization process can be run manually in situations where immediate synchronization is required.
How can you verify whether synchronization is taking place in Azure AD Connect?
You can verify the synchronization status in Azure AD Connect by navigating to the Synchronization Service Manager tool.
What key factor needs to be ensured for permission rights in the synchronization process?
It’s essential to have the correct permission rights at all hierarchical levels in the directory to avoid any de-synchronization issues.
What is one major software prerequisite for installing the Azure AD Connect sync engine?
The server where the Azure AD Connect is installed must have .NET Framework 4.5.1 or later installed.
What is the default synchronization interval for Azure AD Connect?
Azure AD Connect uses a default synchronization interval of 30 minutes.
What minimum permission is required in the on-premise Active Directory to install Azure AD Connect?
The account used to install Azure AD Connect must have local Admin permissions in the on-premise Active Directory.
Does Azure AD Connect support provisioning from multiple on-premise Active Directories to a single tenant?
Yes, Azure AD Connect does support multi-forest and multi-domain scenarios, allowing for multi-directional sync from multiple on-premise Active Directories to a single Azure AD tenant.
extutorials.com