Hello, I am Pim van de Vis, Staff Solution Engineer at VMware End User Computing.
Welcome to this operational tutorial on integrating VMware Dynamic Environment Manager with Microsoft
OneDrive for Business, which enables the move of user profiles to the cloud.
This is the first video of a series of four videos which are part of the tutorial that
can be found on VMware TechZone.
This video will guide you through the steps that are required to install the Azure AD
Connect tool.
Let’s get started with an introduction what benefits this brings.
This overview is a classic deployment of Dynamic Environment Manager, and the important part
for this tutorial are the two SMB file shares.
Since more customers start embracing Modern Management and end-users are working remote,
it might be a challenge to access these file shares, and typically a VPN would be required.
To solve this challenge, Dynamic Environment Manager can migrate to a cloud-based approach,
where the central Dynamic Environment Manager configuration share will be managed and deployed
from Workspace ONE UEM.
If you want more information on that specific integration, I recommend going to TechZone
and search for blogpost with the title “Dynamic Environment Manager Gets a Boost from Workspace
ONE UEM.”
This tutorial will focus on the other challenge of moving the second SMB share that contains
the user profiles to the cloud.
Since most customers already made the move to Office 365, Dynamic Environment Manager
version 2111 now supports storing the user profiles on OneDrive for Business.
To enable this, some requirements are needed to support the authentication to Office 365.
This shows the authentication flow that will be setup during this tutorial.
To make this integration work, it is required to federate Active Directory with Azure AD.
This can be achieved with ADFS or with a 3rd party identity provider.
In this tutorial Workspace ONE Access will be used for the federation and authentication.
The first step of this tutorial is to synchronize the On-Premises Active Directory with Azure
Active Directory using the Azure AD Connect tool, so that Azure AD has the same user accounts
and details as the on-prem AD.
The AD directory sync is needed so the DEM agent can connect to the correct user's OneDrive
for Business account.
Start with downloading the Microsoft Azure Active Directory Connect installer from the
Microsoft website.
Start the installation of the tool on one of your on-prem domain joined servers.
Agree to the license terms and privacy notice and continue.
Choose ‘customize’ to get all the configuration options.
If required, an existing SQL server and service account can be used.
For Federation Workspace ONE Access will be used, so we will choose the default setting
‘Password Hash Synchronization’ and ‘Single Sign-On’ will be enabled to allow a seamless
logon experience.
Next step is to authenticate to Azure AD with an account that has administrator permissions.
Connect to the on-premises Active Directory Forest and add the Directories that need to
be synchronized.
In this case the option to let the installer create a new service account is selected.
Provide domain administrator account credentials to authenticate and complete this action.
Leave the default selection to use the ‘userPrincipleName’ attribute as the Azure AD username.
Choose to synchronize only specific domains and OU’s or synchronize everything.
From a security standpoint it is best practice to only synchronize the OU’s that contain
the users and or computer accounts that are needed for Office 365.
To make the authentication with Workspace ONE access seamless, it is recommended to
select the ‘mS-DS-ConsistencyGuid’ attribute as the source anchor to identify users with
Azure AD.
If needed more filtering can be applied to determine which users and devices are synchronized.
It is convenient to enable ‘Password writeback’ as an optional feature, since this will keep
passwords in sync between on-prem and Azure AD.
Provide the credentials for an on-premises Domain Administrator account to enable single
sign-on and complete the installation.
Once the installation is complete, the synchronization will start in the background.
Thanks for watching this video.
I hope to see you on the second video of this series.