[MUSIC]
Ramiro Calderon: Welcome to the Azure AD Architecture
Deep Dive Series. My name’s Ramiro Calderon and I’m a
Program Manager in the Azure AD Engineering team.
Corissa Koopmans: And I’m Corissa Koopmans and I’m
also a Program Manager on the Azure AD Engineering team
at Microsoft.
In this video, we are going to talk about the provisioning
cycle from on-premises all the way to the applications. So,
let’s walk through the first flow.
Taking the objects from on-prem to the cloud directory is
Step 1 here, which we call synchronization. The sync engine
connects to the on-prem AD and Azure AD as represented
by the triangle in the upper left hand corner and the
cylinder in the middle of the diagram. And it synchronizes
data between the two directories. Every component on-
prem follows an agent pattern relationship and has a sister
service on the cloud that they talk to. So in this case, the
sync engine on-prem talks to the Azure AD connect back
end, which is a SOAP based web service that sends the
objects back to the cloud directory.
Once the objects are in the cloud directory, then the other
components start to come alive. Dynamic groups is one of
them, as you can see in Step 2. It’s a batch job that defines
group membership based on a query. When the batch job
executes the query, it’ll reflect the objects that were added,
changed, or deleted, and the group membership is updated
based on the query results.
For example, Sam from HR was hired, added to the directory,
and then assigned to the dynamic group called The Best HR
Team Ever. The dynamic group back end will know to assign
Sam to this group because his department attribute is set to
HR and this matches the terms of the query. Once that group
is populated, it behaves like any other group in the system.
In Step 3, a batch job processes group based licensing from
Microsoft Cloud Services. Following the previous example,
The Best HR Team Ever group will be assigned licenses
specifically for the needs of that group, let’s say Exchange
Online, OneDrive for Business, and Dynamics 365.
Now, the flow transitions to provision objects to the
application, which is what we call outbound provisioning.
In Step 4, the first party provisioning service sends the
updates to various Microsoft cloud services to initiate
application specific provisioning activities, such as creating
the mailbox in Exchange or to create the SharePoint
underlying repositories for OneDrive for Business.
In Step 5, we have a provisioning back end service to
integrate users to third party applications in the cloud.
This component abstracts away the complexities of calling
the SaaS applications provisioning APIs, such as ServiceNow
or Salesforce. The provisioning services supports SCIM, so
any application that follows that standard can integrate
easily with the flow. We want to encourage you to connect
to your third party apps to get the full benefits of Azure AD
in addition to single sign-on. Automating the lifecycle with
Azure AD provisioning will be bring consistency, compliance,
and a smoother experience to end users. It’s important to
call out here all of these batch jobs happen independently
from each other. As a result, end-to-end provisioning from
AD to the applications has some latency from the time you
add an object to when they’ll be able to see their resources.
Now that the object has been added from on-prem directory
and has access to all cloud applications, the provisioning is
complete.
Ramiro: Great. Should we talk about the new cloud provisioning?
Corissa: Absolutely.
Ramiro: We recently introduced Azure AD Connect Cloud
Provisioning. So, let’s say you have an AD environment that
is disconnected from the corporate network, for example,
a recent acquisition. With cloud provisioning, you can install
language agent in the disconnected environment, very similar
to what we saw in the password authentication video. That
agent’s only job is to interact with Active Directory, and the
rest of the cycle happens in the cloud. As you can see in
the diagram, we are using the same provisioning service
that we used in the outbound provisioning flow. From this
point on, everything else looks exactly the same.
Now, let’s move onto the next scenario, which covers creating
an object in the cloud HR system.
So far, we have outbound provisioning, which means from
the directory to the applications. When an organization creates
an identity in the cloud HR system, the flow is reversed and
that’s why it’s called inbound provisioning.
So, let’s say we hire Suzie over here. After she accepts our
generous offer, there is a record created for her in the cloud
HR system, for example, Workday. In Step 1, the provisioning
service queries Workday to find employee record changes.
In this case, it will read Suzie’s new hire information and all
the attributes attached to it. This is the same provisioning
service that we used in the outbound provisioning that
Corissa spoke to in the previous slide.
In Step 2, the provisioning service queues up the task to
create a new object in AD through the hybrid agent’s back end.
In Step 3, the provisioning agent picks up the task from the
back end service for any updates. Remember that the on-prem
agents only initiate the traffic to the cloud; it’s never in
the other direction.
Then the agents pick up the fact that someone has been
added, so they go and provision Suzie and push the changes
to Active Directory in Step 4.
Once Suzie is in the on-premises Active Directory, the rest
of the steps are exactly the same as the outbound provisioning
flow in Step 5.
If the full cycle of provisioning to applications results in object
changes, for example, the email address being assigned after
provisioning the mailbox in Exchange Online, then the
provisioning service can write the changes back to the cloud
HR system, as we can see here in Step 6.
Corissa: Great. Thanks, Ramiro.
To wrap up, some of the key takeaways for identity provisioning
are changes from Azure Active Directory are replicated to
Office 365, other Microsoft services, and third party SaaS apps.
Azure AD Connect Cloud Provisioning can be used for disconnected
forest, and last but not least Cloud HR provisions on-prem
first, then Azure AD Connect sends changes back to Azure AD.
We hope you found this video useful. We will be adding videos
on different topics, like authentication, MFA, governance, and
many more. Please see the description below for links to
the diagrams used in this video and other useful information.
Thank you.
Ramiro: Thank you very much.
[MUSIC]