On-prem to AAD walk through

Posted by anonymousITCoward@reddit | sysadmin | View on Reddit | 8 comments

I'm not sure why I'm asking, I'm leaving the support team, and going into another department soon... so this is probably just for my own satisfaction I suppose. Does anyone have a link to a no nonsense guide on how to go from an On-prem, to hybrid, to AAD walk through? The few that I've ~~found online~~ read seem to be overly complex, and tend to have some pretty huge gaps in their processes...

Reply to Post

8 Comments

[-]

Sittadel@reddit

Here's the good news: The *actual* migration is usually much more simple than the guides, because the guides need to lead you through so many different decision points. That's where it gets complex. Your old team should begin with figuring out why they need to go hybrid, because federating on-prem and AAD is a process CHOCK FULL of troubleshooting. ADSync works great (except for when it doesn't), but we've found most of the companies who have come to us for guidance are only using hybrid as an intermediary step to cloud-first due to fear or just because it seems to be a migration path. You can eliminate some huge hurdles (and solve for /u/AppIdentityGuy's concerns) by migrating data to the azure repositories but creating net new AAD identities.

[-]

anonymousITCoward@reddit (OP)

> ADSync works great (except for when it doesn't), we're currently getting 5 sync errors per minute... we're falling into that parenthesis lol

[-]

AppIdentityGuy@reddit

Fair enough. My experience has mostly been in large multinationals where things are a lot more complex. Massive technical debt etc…

[-]

AppIdentityGuy@reddit

Depends on what you mean. If you have AD right now you will probably have AS quite a long time because it’s the apps that will hold you back….

[-]

anonymousITCoward@reddit (OP)

I'm not worried so much about apps, we have our volume licenses for our apps, I'm looking for more info about the process of going from on-prem to hybrid, to AAD.

[-]

AppIdentityGuy@reddit

What I meant by apps is those on prem apps that absolutely require AD. Those are the apps that will hold you back….

[-]

anonymousITCoward@reddit (OP)

Ahh even better, the previous regime didn't ldap anything lol. The only thing that is reliant on it is our firewall access, which we've done with other clients.

[-]

AppIdentityGuy@reddit

Well LDAP wouldn’t have solved much because it’s also a legacy protocol which AAD can’t do.