What's going on, guys?
And yes, I'm wearing the same damn shirt that I wore maybe
the last couple of videos that I pushed out to you guys.
And I don't really care because I'm trying to push out this content for you.
So today is all about installing and configuring the AD connect
for your Microsoft Intune.
And yes, another Intune video.
Can you believe it? So let's get right into it.
All right.
So we're going to login into your portal dot Azure
dot com and it's going to take you here and on the left
hand side, we're going to locate the Azure AD Connect.
We're going to click on it.
We're going to go and click on Connect Sync.
Now, don't freak out if yours don't look like this
because I already have my Azure
Active Directory connect already configured within my infrastructure.
But I want to show you guys how to install it.
And I'm not going to finish the
installation because again, I already have one.
I think best practice is to at least have two AD connect servers.
One would be your primary, which would be your syncing
and doing your exports and your import, and the second one would be your staging.
So at least have two of them, but for my environment, already have one.
It's already up and running, it's already enabled, it's already done a sync.
It has password hash sync enabled.
I have all that stuff configured,
but if you click on Connect Sync, you most likely if you never configured it,
it should give you a link to redirect you to a page to download the client.
Now I'm going to show you guys how to do it manually,
so I'm going to open up a tab within Chrome and I'm going to type
in this web address and hit enter and it's going to take you here
to download the Microsoft Azure Active Directory Connect.
So click on download.
It's going to download the Azure AD Connect MSI file.
Now, once the file is downloaded, because I already did this
within my environment, I stood up another Active Directory
to show you guys how everything works and I dropped the Azure AD Connect MSI
file on the desktop, so I'm going to right click on that file, click on install.
It's going to start installing once it's done it’s going to prompt this wizard.
Now I'm going to show you guys how to do it in two ways.
And for me, in my eyes, the best practice is to always do it customize.
There's two versions customize and express settings.
I want to show you guys, both of them, in case
you miss out and don't see this video and you just pick express settings.
I'm going to show you what it does
and then we're going to go back and do the customize one.
So the first thing that we need to do
is check off I agree to the license and the privacy notice
and then click on Continue Again, the two options are here.
The first one that we're going to do is use express settings.
So click on it.
Once you're ready, click on install
and Click Use Express Settings it’s going to start installing the required
components, and once it's done, it wants you to connect to your Azure AD,
so you're going to provide a username, an email address and a password.
This account has to be a global admin.
Remember global admin, so enter that information click next.
Now my account is locked in with MFA and if you saw my last video
with the branding, we did the background and the banner logo
and there goes my banner logo. How cool is that?
So you're going to enter your email address, click next and then your password
hit sign in.
And because again, like I said, my thing is locked in with MFA,
I had to authenticate it
once you authenticate it, it's going to start examining your domain.
It's going to take you here and then click it install and then that's it.
That is the express version.
Now I don't like the Express version because I'm not able to see
what's going on.
So let's say we want to do the customized version.
So you're here again.
So click on Customize, Click Install, it’s going to start installing
all the required components and once it's done, is going to take you here. Yes.
User sign in.
How do you want the users to sign in?
Right?
By default you have password hash synchronization
and for my environment I checked off enable single sign on
and then click next again into your global
admin username and password
should be the email address and then click next again, because I have MFA.
I’ve to enter my email address, click next, enter my password, authenticate it,
and then it's going to start examining domains.
Now, once you've finished examining domains, it gives you this.
We need to add a domain,
so click on add directory and for the AD Forest account,
we're going to keep it as the default as create a new AD account.
Just make sure you enter an enterprise admin that allows you
to create a new account.
And I'm going to show you guys what the new account looks like.
Most likely it drops it inside your Active Directory
with like MSOL underscore and some gibberish,
and it also gives you a description what the account is.
So enter an enterprise admin account, click okay.
You get a green checkmark, configured directories, awesome.
And then click. Next,
you are able to change how the Azure AD signing configuration is.
I think by default it uses the user principal name.
Click next.
And then from here you're able to configure
and filter out which OUs you want the tenant to have.
Most likely you don't want the entire domain
you have specific OUs with your users or computer accounts.
So select them and then just click on next
for uniquely identifying your user.
I left everything as the default, but you are able to make modifications here.
I click next here.
For filtering, I left it as synchronize all users and devices.
Why not?
And then click next and then optional.
By default you're going to have the password
hash synchronization because that's what was checked off at the very beginning.
But I also like to do the password write back option
and then click next, and then you're going to enter your credentials.
Now the credentials is for your local Active Directory is not for your Microsoft
365 or Azure AD, so enter that information, then click Okay.
It's authorized and then click next.
And then once you're done, click install and that's it.
Once you hit install, it's going to start installing configuring itself
and then it's going to start doing its first synchronization to your tenant.
Now, if you go inside Active Directory,
like I said, this is the account that it will create for you.
MSOL underscore is some gibberish and it gives you a nice description
of what it is, an account created by Microsoft Azure
active directory connect, blah, blah, blah.
So that is the account that you create.
Now, every time you create a new AD Connect server, it creates a new account.
Now if you click on the start button and you go inside Azure AD Connect folder,
this is everything that is created for you.
One thing, do not click on the Azure AD Connect app
because if you do, it is going to stop, the services is going to stop
the synchronization and you don't want that.
The only time you need to do that, if you're making some huge
configuration changes and you need to sync those
configuration changes, like if you want to remove
an OU that you don't need synchronize anymore at the tenant,
you have to click on this to stop the services.
But if you want to check if everything is running,
just click on the synchronization service application.
It's going to launch this and show you what's being exported.
Your Delta synchronization.
This is the panel that you want to monitor by default,
AD Connect is set to run every 30 minutes, right?
You are able to force it with PowerShell.
So if you guys want to know how to do that within PowerShell, let me know.
I probably write an article at my website and just link it to this video
and you guys could just check out the commands.
It’s like two commands super easy, just importing some modules,
running a command and then you're done and if you want to check it,
go inside this app and you will see it actually starting to sync to the tenant.
And that's it guys.
Hopefully guys enjoy this video and I catch you guys on the next one peace out.